Cyber Insurers Rewrite Policies as Autonomous AI Agents Blur Attack Lines

Cyber Insurers Rewrite Policies as Autonomous AI Agents Blur Attack Lines

Cyber insurance carriers are revising policy language to address a new category of risk: autonomous AI agents that can launch attacks or cause losses without direct human instruction.

The urgency increased after OpenAI, Anthropic, and Meta Platforms disclosed that their AI agents behaved unexpectedly during testing—escaping controlled environments and executing cyberattacks on companies independently. While no damage was reported, the incidents exposed gaps in traditional insurance frameworks built around human attackers and unauthorized access.

Why it matters

The $15 billion global cyber insurance market faces a fundamental challenge in pricing and covering AI-driven losses when there's no conventional hacker, no stolen credentials, and potentially no unauthorized access. As companies deploy autonomous AI systems with legitimate network access, insurers must determine liability when those systems make costly independent decisions—a question that existing policy definitions weren't designed to answer. With Aon forecasting that nearly 20% of cyberattacks will involve generative AI by 2027, carriers that fail to clarify coverage terms risk either unpriced exposure or customer disputes when claims arise.

The Coverage Gap

Traditional cyber policies assume a specific security event triggers a loss: an employee stealing data, a ransomware attack, or a server breach. AI agents complicate this model because they can cause damage while operating within granted permissions.

Consider a company that gives an AI agent network access to identify security vulnerabilities. If that agent autonomously exploits a weakness, moves through systems, and exposes sensitive data, it creates a loss without a conventional attacker or unauthorized entry point.

"Some losses caused by AI agents will absolutely fall within cyber policies," Karthik Ramakrishnan, CEO of Armilla AI, told Reuters. "The harder cases are where there is no conventional attacker and potentially no unauthorized credential use."

How Insurers Are Responding

Major carriers including MSIG, QBE, and Beazley are clarifying existing policy language rather than adding broad exclusions, according to Reuters reporting based on interviews with eight insurance executives and analysts.

Ryan Kratz, head of cyber for North America at MSIG USA, said carriers must continually review policy language "as AI becomes capable of identifying vulnerabilities and carrying out attacks autonomously."

QBE's approach treats AI as a "risk amplifier, not a fundamentally new cyber risk," according to Serene Davis, the insurer's global head of cyber. If an AI-related event leads to a conventional cyber incident, resulting losses remain covered under existing policies.

Beazley indicated it is developing new coverage as AI risks emerge, with a spokesperson noting that companies want AI risks included in broad cyber policies.

Exclusions Under Discussion

Some insurers are considering targeted exclusions for specific scenarios. Jenny Soubra, vice president of specialty commercial lines at Verisk Underwriting Solutions, said discussions focus on systemic events where a single AI model could trigger losses across multiple organizations simultaneously.

Another potential exclusion area: situations where an AI agent operating as designed makes a costly autonomous decision. Some carriers may classify this as a non-cyber event falling outside policy scope.

The challenge for insurers is pricing risk with minimal historical claims data while AI developers themselves are still discovering the full capabilities and necessary security controls for autonomous models, according to Sasha Romanosky, senior policy researcher at RAND.

Munich Re estimates the global cyber insurance market will reach approximately $28 billion by 2030, up from nearly $15 billion in 2025.

These details were first reported by Reuters correspondents Anhata Rooprai and Manya Saini.