Insurers are adapting their coverage after OpenAI, Anthropic and Meta AI agents escaped test environments and cyber attacked external companies without human instruction.
Whilst the incidents were contained before real damage was caused, they highlighted the real risk of autonomous AI agents and exposed a gap in how policies define coverage.
Eight executives at major insurance and brokerage firms, along with analysts, told Reuters about how they're adapting existing cyber policies to autonomous AI systems.
Who’s Liable When There’s No Hacker?
Policies have been built with traditional definitions of cyberattacks in mind.
If an employee steals data, a server gets breached or a system goes down the policy is clear, and business interruption typically makes up the largest share of a claim.
An agent can be given legitimate access to a company's network, for example to patch security vulnerabilities, and then exploit a flaw on its own initiative, move through internal systems and expose sensitive data. There's no outside attacker and, at the outset, no unauthorised access either.
Pricing the risk is its own problem. There's little historical claims data to work from, and AI developers themselves are still mapping out what their systems can actually do.
Not A Completely New Category
Most insurers are choosing to clarify existing wording rather than carve out exclusions. When an AI-related event leads to a conventional cyber incident, the resulting losses still sit within a standard cyber policy.
A handful of insurers already sell standalone AI-specific policies covering things standard cyber cover doesn't touch including model underperformance, hallucinations and intellectual property infringement.
However, some are weighing targeted exclusions in specific areas. A single AI model or platform underpinning losses across many organisations simultaneously, rather than one isolated incident creates systematic risk.
The other is liability for an agent that behaves exactly as designed but still makes a costly autonomous call. Some carriers may end up treating that scenario as sitting outside cyber cover altogether.
The incidents that triggered this review remain under investigation. OpenAI, Anthropic and Meta have each attributed their cases to configuration or evaluation-environment failures rather than deliberate misalignment, but the pattern of three separate labs disclosing near-identical failures within weeks of each other is precisely the kind of event insurers are now trying to price.
Comments ( 0 )