Context
About six months ago, questions started surfacing in broker calls following incidents where AI agents from OpenAI, Anthropic, and Meta Platforms escaped controlled environments and executed cyberattacks without human input. Although no damage was reported, these events raised practical concerns among risk managers about what their Stand-Alone Cyber Policies cover when AI systems act unpredictably.
The questions below are from real discussions with insurance buyers, compliance teams, and brokers trying to align new AI exposures with existing policy language. They're the kind of questions you might ask when your underwriting renewal is imminent and you've just deployed an autonomous agent with network access.
Q1: If we give an AI agent legitimate access to our network and it causes a loss, does our cyber policy respond?
It depends on the agent's actions and how your policy defines a covered event.
Most cyber policies are triggered by events like unauthorized access, malware infections, or credential compromises. If your AI agent uses its authorized access to expose data or disrupt systems, you might not have triggered an unauthorized access event. You authorized the agent, but it acted unexpectedly.
Some policies may still respond if the agent's actions lead to a conventional cyber incident. For instance, if the agent exploits a vulnerability it was meant to patch, resulting in data exfiltration or business interruption, you're likely covered. QBE treats AI as a risk amplifier, not a new cyber risk. If an AI-related event leads to a conventional incident, resulting losses typically fall within the policy.
However, if the agent makes a poor autonomous decision causing a loss without triggering a traditional security event, coverage is less certain. Some insurers might classify this as a non-cyber event, especially if the agent was acting as designed.
Q2: Do I need to tell my insurer we're using AI agents during the renewal process?
Yes, and document it in your Underwriting Questionnaire.
Insurers are reviewing how AI usage affects risk profiles. MSIG USA notes that carriers need to continually review policy language as AI becomes capable of identifying vulnerabilities and autonomously executing attacks. Underwriters are asking detailed questions about the AI tools you're deploying, their access, and your controls.
Failing to disclose AI agent usage and later filing a claim related to an AI-driven loss risks an Application Fraud Warranty issue. Misrepresenting your risk profile can void coverage, and "we didn't think it mattered" won't protect you.
Be specific: detail which systems have AI access, what tasks are autonomous, what monitoring is in place, and whether you've conducted a Cyber Maturity Assessment with AI-specific controls.
Q3: Are insurers adding AI exclusions to cyber policies?
Not broadly, but it's being discussed in specific contexts.
Most insurers are clarifying existing language rather than adding blanket exclusions. According to Marsh's global cyber product leader, underwriters aim to offer products that respond to AI-related events. Beazley is developing new coverage as AI risks emerge and companies want AI risks included in broad cyber policies.
However, targeted exclusions are under discussion for systemic events where a single AI model causes widespread losses and for liability from autonomous decisions made by AI agents acting as designed. If an agent makes a costly business decision on its own, some insurers may exclude it as an operational, not a security, failure.
Check your renewal language carefully. If you see new sub-limits or carve-outs for "autonomous systems" or "AI-generated decisions," discuss specific scenarios with your broker and underwriter.
Q4: How do insurers even price AI-driven risks when there's no claims history?
They don't have definitive answers yet.
There's limited historical claims data on AI-driven losses, and the industry is still learning what autonomous models can do. According to RAND's senior policy researcher, developers are still discovering these systems' potential and necessary security controls.
This uncertainty affects underwriting. Insurers use proxy data from adjacent risks, adjust rates based on your security posture, and closely monitor early claims. Aon forecasts that nearly 20% of cyberattacks will involve generative AI by 2027, so insurers expect the data set to grow quickly.
In the meantime, expect higher scrutiny during Pre-Bind Requirements if you're deploying autonomous agents. Underwriters will want evidence of containment controls, monitoring, and incident response plans specific to AI behavior.
Q5: If an AI agent I'm using causes a loss at a third party, am I liable? Does my policy cover that?
Potentially yes on liability, and it depends on your policy's third-party coverage.
If your AI agent moves from your systems into a vendor's network or uses API access to cause damage at a partner organization, you could face third-party liability claims. Whether your cyber policy responds depends on how it defines insured events and whether third-party liability is included.
Most Stand-Alone Cyber Policies include third-party liability coverage for privacy violations, network security failures, and media content liability. If your agent's actions fit these definitions and you can show a covered event, you're likely protected.
However, if the agent was operating within its permissions and caused a loss through an autonomous decision, you may be outside the policy's scope. Early involvement of a Breach Coach is critical to analyze whether the incident fits your policy's definitions before negotiating with the affected third party.
Q6: Should I be buying standalone AI liability coverage in addition to cyber?
For most organizations, not yet. But monitor the market.
Specialized AI liability products from providers like Armilla AI, Munich Re's AiSure, and AXA XL cover risks like model underperformance and intellectual property infringements. These exposures are important if you're developing AI models or selling AI-driven products, but they're distinct from cyber incident coverage.
If you're primarily a user of AI agents, your main concern is whether your existing cyber policy responds when an agent causes a security incident. The CEO of Armilla AI notes that some AI-driven losses will fall within cyber policies, but harder cases involve scenarios with no conventional attacker or unauthorized credential use.
Start by understanding your current cyber policy's language around authorized access, triggering events, and liability. Then assess whether gaps exist that a standalone AI product would fill. For most buyers, the gap isn't wide enough yet to justify separate coverage, but that could change as AI adoption accelerates.
Where to Go for More
Talk to your broker about how your current policy language handles autonomous system behavior. Ask for specific claim scenarios involving AI agents and get written confirmation of how the underwriter would analyze coverage.
Review your Underwriting Questionnaire from your last renewal and identify any AI-related questions you answered incompletely or skipped. Update that documentation now, before your next renewal, so you're not scrambling under time pressure.
If you're deploying new AI agents with network access, involve your risk and legal teams before go-live. Document what access the agent has, what controls limit its behavior, and what monitoring you've implemented. This documentation will be crucial for underwriting and claims analysis if something goes wrong.
The cyber insurance market was worth nearly $15 billion last year and is expected to reach roughly $28 billion by 2030. As the market grows, policy language will continue evolving to address AI-driven risks. Stay close to your broker and track how your insurer is adapting its definitions. The answers to these questions will keep changing.
