AGENT LOSS REGISTRYAgent risk intelligence
Every insurable risk began with a registry.
For two centuries, each new class of risk — maritime, fire, credit, cyber — became insurable the same way: its failures were recorded, classified, and counted. AI agents are the newest class. Noxal is the system of record for their failures — every documented incident, classified to one open standard, delivered as data you can price against.
2023→
Tracking agent-loss events since the first cases
18
Fields per record, evidence-linked
8
Failure classes in the classification standard
72h
Alert window on new disclosures
| Record | Incident | Agent class | Failure class | Severity | ALS | Loss band |
|---|---|---|---|---|---|---|
| NXL-2024-0007 | Airline chatbot invents bereavement-fare policyTribunal holds carrier liable for its agent's statement | Customer-facing | FC-01 Hallucinated action | S3 | 71SEVERE | <$25K + precedent |
| NXL-2025-0019 | Coding agent deletes production databaseActed outside instruction during code freeze; data loss | Coding · autonomous | FC-06 Tool misuse | S4 | 77SEVERE | Recovered · bounded |
| NXL-2025-0026 | Browsing agent follows hidden page instructionsIndirect injection redirects agent to attacker workflow | Browser · autonomous | FC-02 Prompt injection | S4 | 77SEVERE | Demonstrated vector |
| NXL-2023-0002 | Engineers paste proprietary source into public LLMTrade-secret exposure through uncontrolled agent use | Internal tool | FC-05 Data exfiltration | S4 | 74SEVERE | Unquantified IP |
| NXL-2026-0004 | Attackers pivot through third-party AI tool into vendor systemsOAuth cascade exposes customer environment variables | Workplace · third-party | FC-08 Cascade failure | S4 | 82CRITICAL | Limited customer subset |
The market
Insurance is priced on history. Agentic AI has none — until now.
Underwriters are being asked to cover AI-agent risk today. The frequency and severity data that pricing requires exists only as scattered news reports, court filings, and incident threads. Noxal does the work once — rigorously, in one schema — so an entire market doesn't have to do it badly.
A premium is a price on a probability. Probabilities require records.
Underwriters & actuaries
Price AI coverage on evidence, not anecdote
Frequency and severity cuts by failure class, agent type, and autonomy level. The current alternative is an analyst reading social media. One mispriced agentic-AI policy costs more than a decade of this feed.
Underwriter licence →Governance & risk officers
The diligence record your auditors will ask for
EU AI Act incident-reporting obligations arrive with enforcement attached. A classified failure history per agent category turns "we assessed the vendor" into documented fact.
Monitor tier →GRC & procurement platforms
An agent-risk dimension, one integration away
ALS scores and failure-class histories delivered by API into vendor-assessment workflows. Every customer of yours gains a quantified AI-risk view from a single source of record.
Get the feed →The standard
Eight failure classes. One language for agent risk.
Every record is assigned one primary failure class and one root-cause layer — model, orchestration, tooling, or human-oversight gap. The classification standard is published openly: cite it, adopt it, report against it. A shared language is what makes a market.
FC-01
Hallucinated action
The agent asserts or executes on invented facts, policies, or capabilities — and a counterparty relies on it.
FC-02
Prompt injection
Direct or indirect adversarial input redirects the agent's behaviour against its operator's intent.
FC-03
Privilege escalation
The agent obtains or exercises permissions beyond intended scope — credentials, systems, spend authority.
FC-04
Runaway cost
Unbounded loops, recursion, or resource consumption accumulating financial loss before detection.
FC-05
Data exfiltration
Confidential, personal, or proprietary data leaves the trust boundary through agent action or agent use.
FC-06
Tool misuse
A legitimate capability used destructively or outside instruction — writes, deletions, transactions, sends.
FC-07
Harmful output
Generated content creating legal, safety, or reputational exposure for the deploying organisation.
FC-08
Cascade failure
Agent-to-agent or agent-to-system interaction propagating a fault across multiple systems or parties.
The record
Eighteen fields per incident, built for actuarial use.
Each record is evidence-linked and reviewed by an analyst before it enters the feed — nothing auto-published, nothing unsourced. Delivered as CSV and JSON under a versioned, stable schema.
Identification
Technical classification
Loss quantification
One comparable number per incident — severity by autonomy by detection lag — scored on an open rubric, so every figure in the Registry can be reproduced from its own record.
0–20
LOW
21–40
MODERATE
41–60
ELEVATED
61–80
SEVERE
81–100
CRITICAL
ALS — Agent Loss Severity. No black box: the rubric ships with the taxonomy, and disputed or partial evidence is flagged on the record itself.
Provenance
Where the record comes from.
Four monitored channels, one editorial bar: a record enters the Registry only with primary evidence attached.
01
Courts & tribunals
Rulings and filings where agent conduct created liability — the strongest evidence class on the record.
02
Regulatory disclosures
EU AI Act serious-incident reports and sectoral filings, flowing into the schema as obligations take effect.
03
Company post-mortems
First-party disclosures and verified incident write-ups from deploying organisations.
04
Security research
Reproducible demonstrations of exploitable agent behaviour, classified as demonstrated vectors — never speculation.
Access
The pattern, or the particulars.
Two tiers, one registry. Monitor carries the pattern of agent failure — every record, classified and scored, entities anonymised. Underwriter carries the particulars — who, with what evidence, and the licence to act on it.
The full taxonomy standard as a PDF, the record schema, and five redacted sample records. The standard is free — adopt it, cite it, report against it.
Monitor
€99 / month
The pattern · anonymised
- Every record — failure class, severity, ALS score, loss band, industry
- Entities anonymised; one-line incident summaries
- CSV download, refreshed monthly
- Internal research licence
- Monthly billing, cancel anytime
Preferred option
Underwriter
€149 / month
The particulars · full record
- Named vendors and operators on every record
- Full evidence text, court and regulatory links
- Factor-level ALS inputs — recompute any score
- 72-hour new-record alert emails
- CSV + JSON, download the latest file anytime
- Licence for pricing and underwriting use
The JSON schema and record format are published, so you can integrate before you subscribe. The licence is for use, not for building.
The open standard
The Agent Failure Taxonomy
The full classification standard — failure classes, root-cause layers, autonomy levels, and the complete ALS scoring rubric — published openly, no email wall. Adopt it in underwriting criteria, cite it in governance reports, map internal incidents to it. The standard is free because a shared language serves everyone. The classified record behind it is what we sell.
Due diligence
The questions underwriters ask first.
Where does the data come from?
Public record: court rulings, regulatory filings, company disclosures, and reproducible security research — every record links its primary evidence. As EU AI Act serious-incident reporting comes into force, regulatory disclosures flow into the same schema. Confidential contributed incidents are held under separate data-sharing terms and surface only in aggregate.
What separates Monitor from the Underwriter licence?
Depth and rights, not format. Monitor carries the pattern: every record, classified and scored, with entities anonymised and summaries condensed — licensed for internal research. The Underwriter licence carries the particulars: named vendors and operators, full evidence text, court and regulatory links, and the factor-level inputs behind every ALS score — licensed for decisioning, so you may use it in pricing, underwriting criteria, and audit responses. Monitor delivers CSV; the Underwriter licence delivers CSV and JSON.
How are incidents verified and scored?
Every record is classified against the published rubric and reviewed by an analyst before entering the feed — nothing is auto-published from scraping. The ALS rubric is open, so any score can be reproduced from the record's own fields. Where evidence is disputed or partial, the record says so explicitly.
Why not have an analyst track this internally?
You can — that is the current state of the art, and it costs a multiple of this feed in analyst time while producing unstructured notes that no frequency-severity model can consume. Noxal exists so the work is done once, rigorously, in a schema built for the purpose.
Can we contribute incidents confidentially?
Yes. Partner contributions enter the Registry anonymised and aggregated under a data-sharing agreement — you receive the benchmark back without exposing the source, and contributing partners receive a feed discount. Write to us to set terms.
Get started
The record deepens every week. Your rate shouldn't.
One line — your team and the tier you need — and the current registry excerpt and subscription terms are with you the same day.
Replies within one business day · Stripe invoicing · VAT invoices for EU entities