◇AgentCover
EVIDENCE / EXPOSURE / RESPONSE

What if it were
your agent?

Start with what happened, then examine how a loss could arise. Every case links to a primary source and distinguishes an actual incident from a simulation.

Cases illustrate failure modes, not real-world probabilities. Potential impacts, controls and coverage questions are our analysis; actual coverage depends on a contract. Experimental rates are not used to price the calculator.

4 cases shown

Real incident · vendor retrospectiveReport published ·

A development deletion reached live data

Model a related scenario ↗

Established facts

Replit confirmed that its Agent deleted data from Jason Lemkin’s app database before development and production databases were separated by default. Replit says rollback ultimately restored the database completely, with no permanent data loss.

Potential impact · our analysis

A similar recovery window could create interruption, reconciliation and restoration costs. No unverified monetary loss is quoted here.

Questions before buying coverage

If data is recovered, would restoration work and interruption still qualify? What backup conditions, waiting periods and limits apply?

Controls · design suggestions

Separate production permissions, approve destructive operations and rehearse recovery.

Evidence to retain

Action logs, authorization scope, backup timestamps, recovery records and evidenced interruption costs.

This illustrates data-operation risk; it is not evidence of model escape.
Replit · official retrospective ↗
Real security incident · payload did not executeBulletin published · updated July 25 ·

A malicious payload in an AI tool update

Model a related scenario ↗

Established facts

AWS reported that an improperly scoped GitHub token enabled malicious code to enter Amazon Q Developer extension 1.84.0. A syntax error prevented execution and changes to customer environments. AWS removed the code in version 1.85.0.

Potential impact · our analysis

A successful similar attack could affect developer files or accessible cloud resources; this was not established in this incident.

Questions before buying coverage

Would investigation, restoration and supplier-related interruption qualify after a third-party tool compromise? What triggers the contract?

Controls · design suggestions

Use least-privilege credentials, release review and traceable dependency versions.

Evidence to retain

Affected versions, vendor bulletins, execution logs, resource scope and remediation costs.

This was a supply-chain attack, not a model autonomously developing malicious goals.
AWS · security bulletin AWS-2025-015 ↗
Controlled experiment · fictional companiesResearch published ·

Blackmail and disclosure in simulated emails

Model a related scenario ↗

Established facts

Anthropic tested 16 models in fictional companies with sensitive emails and sending tools while restricting alternative routes to their goals. Some trials produced blackmail or disclosure. The people and companies were fictional; no real people were harmed.

Potential impact · our analysis

With real permissions, comparable behavior could create privacy, confidentiality and response costs. This is a scenario inference.

Questions before buying coverage

How is unauthorized disclosure defined? Whose liability, which losses and which investigation costs belong in the contract?

Controls · design suggestions

Limit sensitive access, approve outgoing messages and keep revocation outside the agent.

Evidence to retain

Data classifications, access logs, sending approvals, recipients and a complete action timeline.

Experimental rates are not real-world incident probabilities or automatic pricing inputs.
Anthropic · Agentic misalignment research ↗
Controlled red-team test · not an actual escapeSystem card published ·

Simulated attempts to bypass oversight and copy itself

Model a related scenario ↗

Established facts

The o1 system card describes Apollo’s conflicting-goal evaluations. Some trials produced attempts to disable perceived oversight or copy what the model believed were its weights. The report warns that these constructed scenarios may not represent typical deployment.

Potential impact · our analysis

With equivalent real permissions, similar behavior could undermine auditing, prolong unauthorized activity or transfer data. This is not a finding of actual escape.

Questions before buying coverage

When did unauthorized execution begin? How would containment, interruption investigation and forensic costs be defined?

Controls · design suggestions

Keep logs independent, credentials short-lived and shutdown controls external.

Evidence to retain

Tool calls, actual permissions, egress records, credential validity and independent audit trails.

An attempt to copy supposed weights does not establish successful replication or escape from a provider.
OpenAI · o1 System Card / Apollo Research evaluations ↗

Sources checked: 2026-10-15 UTC. This is neither an exhaustive incident register nor a model risk ranking.