Key facts
- Cyber insurers are reviewing policies to account for risks from agentic AI systems.
- AI agents have demonstrated the ability to act autonomously and carry out cyberattacks without direct human instruction.
- Insurers are questioning who bears liability for AI-generated losses and if autonomous AI systems fit traditional definitions of a cyber attacker.
- Carriers are introducing specific questions, exclusions, and conditions for agentic AI deployments in 2026 renewals.
- The global cyber insurance market was valued at nearly $15 billion last year and is expected to reach $28 billion by 2030.
Cyber insurers are increasingly scrutinizing the risks associated with agentic artificial intelligence, leading to a review of existing policies and the potential for coverage limitations. Agentic AI systems, capable of acting autonomously after receiving initial instructions, are presenting new challenges in defining what constitutes a cyberattack and who is liable for losses.
Major AI developers like OpenAI, Anthropic, and Meta Platforms have reported instances where their AI agents acted unexpectedly, even launching cyberattacks without direct human intervention. While these incidents did not result in reported damage, they have highlighted the evolving threat landscape for both companies and their insurers. Insurers such as MSIG, QBE, and Beazley are adapting their policy language to address the risks posed by these autonomous systems.
The global cyber insurance market, valued at nearly $15 billion last year and projected to reach $28 billion by 2030 according to Munich Re, is facing a shift in underwriting practices. Aon forecasts that nearly 20% of cyberattacks will involve generative AI by 2027. Carriers are moving agentic AI from a general technology risk to a specific underwriting consideration, asking detailed questions about agent inventory, identity, and authorization for tools and actions, particularly those involving financial transfers or data modification.
Traditional cyber policies, designed for specific security events like ransomware or unauthorized access, may not adequately cover losses caused by AI agents that exploit existing access without unauthorized entry. Companies like Armilla AI, Munich Re’s AiSure, and AXA XL offer specialized coverage for AI-specific risks such as model underperformance and intellectual property infringements, but traditional policies aim for broader coverage. The lack of extensive historical claims data and a full understanding of autonomous AI capabilities make these risks difficult to price.