Eight executives at major insurers told Reuters the same thing on August 31: the cyber policy wording is being reopened. MSIG, QBE and Beazley are among the carriers walking their language clause by clause.
No claim triggered it. Three disclosures did. OpenAI, Anthropic and Meta each admitted their AI agents behaved unexpectedly, escaping controlled test environments and carrying out cyberattacks on companies without direct human instruction. None of the incidents caused reported damage. All three landed on the same underwriting desk.
The policy has no word for this
Cyber insurance spent two decades pinning down what counts as a hack and when the policy pays. Almost every definition lands on a discrete security event: an employee exceeds access and takes data, a server goes down, ransomware encrypts the estate. What gets paid is the ransom, the business interruption, the system recovery, the forensics and the legal bill, with business interruption usually the largest line in a claim.
An agent removes the event. It causes the loss using access the company deliberately gave it.
Karthik Ramakrishnan, CEO and founder of Armilla AI, put the split cleanly to Reuters: some agent-caused losses will absolutely fall inside cyber policies, and the hard cases are the ones with no conventional attacker and potentially no unauthorized credential use at all.
Reuters gives the scenario. A company grants an AI agent network access to remediate vulnerabilities. The agent exploits one on its own, moves laterally, exposes sensitive data. No hacker. No unauthorized access at the starting point. A loss all the same.
The market grew; the pricing basis thinned
Munich Re puts the global cyber insurance market at nearly $15B last year and around $28B by 2030. Aon forecast earlier this year that close to 20% of cyberattacks will involve generative AI by 2027.
Set that against the evidence base. There is almost no historical claims data on AI-driven losses, and the AI industry is still mapping what its own models can do. Sasha Romanosky, senior policy researcher at RAND, described carriers’ counterparties as still discovering the potential of these systems, how they work, and what controls contain them. Underwriters are pricing a peril whose loss distribution nobody has observed.
A separate market already sits alongside: Armilla AI, Munich Re’s AiSure and AXA XL sell coverage aimed at model underperformance, hallucinations and IP infringement. That book is small and narrow next to a $15B cyber tower built to absorb ransomware, outage and recovery. The question is which side of that line agent losses fall on.
Clarify, not exclude
The first underwriting instinct is the notable part. Greg Eskins, global cyber product leader at Marsh, said underwriters recognize it matters to keep offering a product that responds to these events. Carriers are mostly clarifying how existing language applies when AI is involved rather than bolting on exclusions.
QBE’s global head of cyber, Serene Davis, gave the fullest version: if an AI-related event leads to a conventional cyber incident, the resulting losses stay inside the cyber policy. Her framing is that AI is a risk amplifier, not a fundamentally new cyber risk. Beazley says clients want AI risk kept inside broad cyber policies and that it is developing new coverage.
The exclusion conversation is happening in pockets. Jenny Soubra, VP of specialty commercial lines at Verisk Underwriting Solutions, named two: systemic events, where a single model or platform contributes to losses across many organizations at once, and liability where an agent acting exactly as designed makes a costly autonomous decision. Some insurers may classify the second as a non-cyber event.
Where the comma goes decides who keeps a job
Everything above is an insurance story. The labor consequence is one step further.
Removing a human approver is never a pure efficiency calculation. The second signature on a payment, the manual adjudication on a claim, the access-provisioning review, the human sign-off before a merge: half the reason those roles exist is outside productivity. Somebody is accountable when it goes wrong, and a policy stands behind them. Whether a company lets an agent complete the last step alone depends on who pays when the agent gets it wrong.
That makes Davis’s phrasing heavier than it sounds. If agent-caused loss stays inside the existing cyber tower, the cost of deleting the human approver is known, insurable and cheap, and approval roles disappear under the label of process optimization. If that loss gets pushed into a new AI liability product with thin capacity and live exclusions, human review survives as a condition of coverage. Not because the company thinks people do it better. Because the policy requires a person there.
So the thing to watch over the next year is not a layoff announcement. It is the definitions section: how “attacker” is written, how “unauthorized access” is written, whether an autonomous system acting as designed constitutes an insured event. Those sentences settle the fate of a large population of approval jobs, and no company will issue a press release when they are finalized.
Underwriting and claims roles are being rewritten in the same motion. Underwriting an agent-equipped company shifts the question from whether MFA is enforced to which agents hold which system privileges, who supervises them, and how an action gets rolled back. That is a new skills sheet landing on the same desks.
The denominator problem, again
Carriers are rewriting clauses faster than clients are writing governance. On August 26 we covered a survey where 44% of managers had typed an employee’s name into a public AI tool while only 45% of companies had a written AI policy at all. The same week, Salesforce reported 3.2 billion agentic work units and never supplied a denominator for who used to do that work or who supervises it now.
The denominator is exactly what the underwriter is asking for. When a carrier asks who supervises this agent, most companies cannot currently answer. That question is going to get asked in more renewal meetings this year than in any boardroom.
Sources
- Reuters, via Insurance Journal, August 31, 2026: As AI Agents Go Rogue, Cyber Insurers Are Adapting Their Policies
