JD Durkin talks with Arvind Parthasarathi, founder and CEO of CYGNVS, about the growing risk of AI incidents. Durkin notes that Anthropic’s latest filing warns AI liabilities could exceed what insurers can cover. Parthasarathi says AI incidents are a serious and real concern, citing a CYGNVS benchmark of 9,500 organization assessments that found 89% of organizations have already had some kind of AI incident and 16% have one a week. He says organizations deploying AI need to reevaluate their insurance coverage, policy wordings, and contracts now.
Asked what is driving the numbers, Parthasarathi describes AI as a probabilistic black box and says it has become the new internal threat, since organizations give it credentials and decision-making authority. He says common problems include rogue agents, data leakage, and broken guardrails, and that CYGNVS has cataloged about 23 different ways an AI can go wrong.
On who is responsible when an agent makes an unauthorized transaction or leaks data, Parthasarathi says 56 jurisdictions already have an AI law or regulation and he expects more than 150 within a year. He says many of those laws agree that the organization deploying the AI is ultimately responsible, so those organizations need to protect themselves through vendor indemnity or insurance.
Get the latest news and updates on FINTECH.TV
JD Durkin: Arvind Parthasarathi joins us now, founder and CEO of CYGNVS. Arvind, grateful for your time. Been looking forward to our conversation all day today. Let’s talk about Anthropic. We got the S-1 last week and an updated filing a few days ago, warning that AI liabilities could exceed what insurers can even cover. Do you view that as a risk, and if so, how big of a risk?
Arvind Parthasarathi: Well, great to be here, JD. Thank you for having me. AI incidents are a serious and real concern. We’ve all heard about what happened with OpenAI and Hugging Face, but this is happening every day. The CYGNVS benchmark of 9,500 organization assessments found that 89% of them have already had some kind of AI incident, and 16% of organizations are having one a week.
And what this means is that when organizations are deploying AI, they need to really reevaluate their insurance coverage, their policy wordings, their contracts, and really start to make adjustments based upon what they’re doing in terms of their AI deployment and their risk. Now, things are still developing in this market, but the discussions, I think, need to happen now.
JD Durkin: Your research has found 89% of organizations have experienced some type of AI incident. What is driving that statistic? It’s pretty startling.
Arvind Parthasarathi: It’s just the way you think about AI. Effectively, it’s a probabilistic black box, where it’s hard to figure out what it’s going to do or when it’s going to do it. And so in some sense, AI has become the new internal threat for organizations. In your previous interview, we were talking about Binance and so forth, and I think AI is certainly being used by external actors to accelerate their threats. But AI is the new internal threat, and organizations are giving it credentials, decision-making authority, all kinds of capabilities. And an AI can effectively start to do things that you didn’t want it to do.
Rogue agents are very common, where an AI kind of breaks out and starts to cause harm, either to yourself or to someone else. Data leakage is another kind that happens a lot, where your AI starts to take proprietary information from your organization and put it out publicly. We’re seeing broken guardrails being a very common one, where effectively either the safeguards are not there or the monitoring is not there, and the AI kind of goes off and does things you didn’t want it to do. All in all, we’ve already cataloged something like 23 different types of ways that an AI can go wrong.
JD Durkin: [unclear: “Are events.”] This is a version of a question I’m asking a lot of experts as of late. I’m fascinated with the answers. When an AI agent inadvertently makes an unauthorized transaction or is responsible for leaking data, whose fault is that? Who gets held responsible?
Arvind Parthasarathi: Well, I’ll give you an interesting perspective. So far, there are already 56 jurisdictions globally that have some kind of AI law or regulation on the books, and there’s a bunch in the works. And so in a year from now, we anticipate it’s going to be over 150 jurisdictions. And they don’t agree on a lot of things. But the one thing that a lot of these laws and regulations have is the agreement that the organization deploying the AI is ultimately responsible.
Now, of course, the technology could be built by somebody. There could be multiple parties and multiple vendors, deployed by others. There are implementation services and so forth. But at the end of the day, I think the laws and regulations are focusing on the organization deploying the AI as the responsible party. And those organizations now need to start to think about how they protect themselves, either through indemnity from the vendors or, of course, insurance.
JD Durkin: Arvind, I always say it’s a great interview when I’m out of time and I have many other topics and questions to get to. That means you’ll have to rejoin us again. Really grateful for your time today. Arvind Parthasarathi, founder and CEO at CYGNVS. Arvind, thank you.
Arvind Parthasarathi: Thank you so much, JD.