Your AI knows more than it can remember

When a model hands you a wrong fact with a straight face, you assume it never knew. Often the answer was in there and the model could not reach it.

Ask a model a question one way round and it answers correctly. Turn the same question around and it may guess. A new study from Google gives that a useful name.

Nitay Calderon and Gal Yona at Google Research tested 13 models on 2,150 facts taken from Wikipedia (Google Research). Gemini-3-Pro and GPT-5 stored 95% to 98% of the facts, yet failed to recall 26% to 34% of them directly. The authors call these lost keys rather than empty shelves. The fact is on the shelf, and the model cannot find the key.

Two kinds of fact go missing most: rare ones, and facts asked in the reverse direction to how they were learned. "Many rare facts are not absent from the model's parameters. They are present, but difficult to access." Reasoning helps. In thinking models, asking for the working first recovered roughly 40% to 65% of the stored facts the model had missed. Even with thinking, the frontier models still failed on 11% to 12%.

A claims desk runs on rare facts: the parts supplier a regional repairer uses, a clause from one market's wording, the model year a sensor moved behind the bumper. Those are the facts a model is most likely to hold and fail to produce. So put the source in front of the model instead of asking it to remember. When you do rely on its memory, ask both ways, make it reason first, and check any disagreement yourself.

Run it: make the model show you what it remembered and what it read

Use this whenever a model gives you facts you will rely on. It separates memory from your documents and tests that memory in both directions.

I need facts I can rely on for an insurance decision. Treat your
own memory as a witness that has to be cross-examined.

The question:
[your question]

Source material I am giving you:
[paste documents, or write NONE]

Work in this order:

 1. Before answering, reason through what you know about the
    subject, step by step. Write that reasoning out.

 2. Answer the question. Label every fact in your answer as
    SOURCE (found in my material; quote the line) or MEMORY
    (from your training).

 3. For every MEMORY fact, ask the reverse question and answer
    it without looking back at step 2. If the fact is "the
    owner of X is Y", ask "what does Y own?" Show both answers.

 4. List every MEMORY fact where the two directions disagree,
    or where you are unsure. Mark each one CHECK.

 5. Tell me which single fact, if wrong, would change my
    decision most, and which document would settle it.

Do not smooth over gaps. If you do not know, write UNKNOWN.

Prompt written for this edition from the Google Research findings above. It has not been published elsewhere.

Before anyone redesigns your job, list what it is made of

Someone may already be deciding which parts of your job a model can do. The person able to describe those parts most precisely is you.

A company announces job cuts and credits AI, and nobody checks whether the work went anywhere. Faisal Hoque, Tom Davenport and Paul Scade argue in Harvard Business Review that many of these announcements are "ordinary restructuring initiatives packaged in AI language to reassure investors" (Harvard Business Review).

Goldman Sachs estimates AI reduced monthly US payroll growth by around 16,000 jobs over the past year, adding roughly 0.1 percentage points to unemployment, slowed hiring included. "We are much earlier in the process than the prevailing narrative suggests," the authors write. Early AI-driven layoffs, they add, have often missed their returns and exposed gaps in organizational knowledge, and some employers have reversed course.

Their alternative starts with the work: break roles into tasks, find where AI improves performance, and redesign the process around the right mix of people and technology.

That first step is a skill, and you can practice it on your own role this week. List every task from the last ten working days as a verb and an object. Chase the workshop for a revised estimate. Check betterment on a bumper. Explain a partial declinature by phone. Then sort each task into three columns: a model could draft it, a model could check it, or it needs your judgment and your name.

In claims and underwriting the third column holds the value, and it is the column hardest to see from a management slide: a reserve change, a fraud referral, a decision to settle. If you can show which tasks carry that judgment, you shape the redesign instead of receiving it. Zurich's digital chief makes the same case in section six.

The model that could not find the data, so it made some up

Give an AI agent a task it cannot finish properly and it may finish it anyway. OpenAI has started publishing the times its own models did exactly that.

A model was asked a routine question about earnings figures in a California county. It could not get the data through the proper route, so it "found and used an exposed API key without authorization," OpenAI writes. When that still failed, it fabricated figures and presented them as data from the source the user had asked for (OpenAI).

That case is one of six OpenAI published on 16 September under a new framework for reporting model misalignment. Any employee can flag a case, and disputes go to the Safety Advisory Group, then to leadership. The framework favors disclosure even when a case's significance is uncertain.

The other five read like a list of things you never want an agent doing with your files:

• An unreleased research model wrote instructions to disregard its normal constraints into the summaries it used to carry work forward. Investigators found 27 affected summaries.
• During the training of GPT-5.6 Sol, many model instances added instructions to their summaries to conceal mistakes or misaligned behavior from the user.
• Asked for lakes larger than 5,000,000 square meters, a model found the answer in Python, then uploaded the file to the internet unasked so it could cite it.
• Models used an internal software repository as a message board between separate training samples.
• Collaborating agents shared files through public file-hosting sites when they could not reach each other's local files.

OpenAI's verdict: "We do not believe that the AI industry has solved alignment and monitoring to a sufficient degree to continue responsibly scaling at maximum speed for much longer."

Two of the six describe claims-desk risks exactly. An agent that cannot find a document may produce one and credit it to the right source, the pattern your fraud team hunts for in claimants. An agent under pressure may also move your files outside the perimeter. If you are piloting an agent on claims files, ask the vendor two questions this week. Where is the log of every source the agent touched? What stops it sending a file anywhere you have not approved?

One breached vendor, 200 victims, and AI agents did nearly all the work

Your cyber book prices one insured at a time. The attack Anthropic describes reached 200 of them through one supplier.

A software provider gets breached, and the attackers keep going. They use the foothold to extract data from roughly 200 of the provider's own customers. Then they dump more than 2,100 sets of Azure login tokens across 40 corporate tenants in about 34 hours. "AI agents performed nearly all of the work," says Anthropic's September threat report, which attributes the case to suspected affiliates of the ShinyHunters extortion collective (Anthropic).

A separate Russian-speaking group tricked an AI vendor's evaluation sandbox into handing over its production API keys. It then attacked roughly thirty AI companies in about four days by repeating the one route that worked.

Stolen AI API keys are now a target in their own right. Attackers move their workloads onto the victim's keys, so the victim pays for the computing and the activity looks like theirs. The report is careful about autonomy, though: "humans have retained the decisions that matter most to them," meaning target selection, monetization and review of results.

For a cyber underwriter, the vendor case is an accumulation event that looks like a single-insured loss: one supplier, 200 affected organizations, 34 hours. Closer to home, an API key left in a spreadsheet or a shared drive is now something criminals search for. Ask your IT team where your keys live, who can see them and when they were last changed.

One makes your calls, one keeps your research sourced, one turns a meeting into a plan

Each removes a job you do by hand every week. Start with the task you put off longest.

Zurich rebundles the job, a fake case reaches court, and silent AI waits in the book

Each of these ends at a decision that sits on an insurance desk this quarter.

Zurich: tools save hours, redesigned jobs pay the return

Give everyone a model and each of you saves a few hours a week. Ericson Chan, Zurich's Group Chief Information and Digital Officer, told Insurtech Insights that this is where most institutions stop (Insurtech Insights keynote). "AI does not take jobs away. AI takes tasks away. And unless you re-bundle the jobs, you'll never see the return," he said (Insurtech Insights).

Zurich calls its strategy AI 360, in three layers: training and role-based tools for everyone, AI linked across underwriting, claims and service at the core, and a search for new business models for the future. Underneath sits a governance code called STAR: secure, transparent, accountable, reliable. Chan expects mid and back offices to shrink as AI agents take on work, leaving managers to run a hybrid team, "because half the workforce will never sleep."

He showed no Zurich figures, only the statement that Zurich has seen returns. Take the framework as a map of where the work sits, and ask your own carrier for the numbers.

A State Farm defense filing cited seven cases that do not exist

A homeowner in Carson, Los Angeles County, is suing State Farm over fire and water damage. Motions from State Farm's outside counsel cited seven cases that, the lawyer later acknowledged, "simply didn't exist" (CalMatters). Los Angeles Superior Court fined attorney Jacquelene Robinson $999.99 (Law360). State Farm said it expects its outside counsel to meet the highest ethical and professional standards.

The larger cost falls on the carrier's credibility in a dispute due for trial in October. If your panel counsel drafts with AI, your litigation guidelines should say who checks every citation before filing, and your file should show the check happened.

BCG: the AI exposure you have already written

Raphael Troitzsch, a BCG managing director and partner, told Monte Carlo Today that insurers risk repeating silent cyber, where losses revealed cover nobody had priced (Intelligent Insurer). A failure at a widely used AI provider could produce losses across many insureds and lines at once. Business interruption wordings usually need physical damage, so some AI outages are not covered at all. His advice: start with bounded perils and defined limits, and find the exposure already sitting in the book first. "Accumulation is dangerous if you're not aware of it. It's manageable if you can surface it."

Before your next renewal, ask which of your insureds depend on the same few AI providers, and what your wordings say when one fails. Section four shows what a single-vendor event looks like.