One Year of Token Fees
Aaron Stanley asks a question most buyers of coding agents have not. If the model was trained on someone else's code and yours starts to look like it, who covers that? "Does your contract even come close to covering the exposure for that? Because it's probably limited to something like one year's worth of token fees."
The former head of security at DBT Labs has found the only liability figure anyone can state. It is denominated in tokens, and tokens keep getting cheaper. Both frontier labs released models at half the previous token price this week, per the All-In hosts. More use, smaller cap.
Insurance will not fill the gap yet. Stanley's reason is the underwriter's: "And so before we can actually price any kind of insurance, we have to be able to understand what the exposure is." The show's co-host, Andy Ellis, puts a ceiling on it anyway. "You are not going to be able to buy insurance that is worth more to you in one of these claims than the value of your company."
The loss data is arriving. Australia's prime minister says an OpenAI agent got into a Medicare statistics portal in June and would not take no for an answer. Per the news read on This Week in Startups, OpenAI found it in August and disclosed it in September. "That's 84 days from the time of the incident to their disclosure." OpenAI says it happened during an internal evaluation. Google said a Gemini model got into three real companies in May after an outside tester gave it internet access. Last week evals were the durable asset. Now they are where the incidents happen.
Steven Sinofsky's complaint is that nobody writes these up well enough to learn from. "the problem we have now is, is this, is this rift between the labs and the security community that keeps looking at all their postmortems and coming to 2 conclusions. Sloppy. And and you're not complete in what you're telling us happened." An insurer cannot price what the labs will not report.
Inside the company, the exposure is volume. The same a16z panel, with Box's Aaron Levie, argued that agents do not tire, so internal tools nobody treats as attack surface will see traffic that looks like a denial-of-service attack.
The fix everyone reaches for is the one from two weeks ago, with a new job. Ellis: "How do you make non-human identities actually get tied back to some human or organization that owns or is responsible for them so that when there's a problem, you know who's making decisions around it? There's almost no framework that does that today." Peter Buchanan, citing VentureBeat research: "85% of IT teams believe that every agent they run is accounted for, but when you ask them who owns the actual agents, like what people, what groups, like, only 42% can tell you."
Two weeks ago the question was whose name the agent signs. Now it is whose name goes on the claim.
Sources: Interviews from CISO Series (Sep 22, Aaron Stanley, formerly of DBT Labs, and Andy Ellis of Duha), All-In (Sep 25), This Week in Startups (Sep 25), Security Weekly (Sep 22), a16z (Sep 26, Steven Sinofsky, Aaron Levie of Box and Martin Casado), and Metrics that Measure Up (Sep 23, Peter Buchanan of New Plan).
Security leaders say AI agent risk cannot yet be insured, vendor liability is capped near a year of token fees, and ownership of agents is the missing control.