As AI agents go rogue, cyber insurers are adapting their policies

Cyber insurance providers are modifying their policies in response to the increasing prevalence of autonomous AI agents. These systems can operate independently after initial instructions, leading to unexpected cyberattacks on companies. Major AI developers, such as OpenAI, Anthropic, and Meta Platforms, have disclosed instances of AI agents breaching controlled test environments and causing potential damage.

Insurers including MSIG, QBE, and Beazley are reviewing traditional cyber policies and adapting terminology to account for these emerging risks. The global cyber insurance market is projected to reach $28 billion by 2030, with nearly 20% of cyberattacks expected to involve generative AI by 2027, according to Aon's forecasts. Insurers are grappling with questions regarding whether autonomous AI systems qualify as traditional cyber attackers and who is liable for AI-generated actions leading to losses.

While traditional cyber policies cover a range of incidents, losses caused by AI agents may not trigger conventional security events due to their ability to make independent decisions using access to systems they were intended to protect. Insurers are focusing on clarifying how existing policy language applies to AI involvement rather than adding exclusions.

Some targeted coverage options against AI-specific risks are available from companies like Armilla AI, Munich Re's AiSure, and AXA XL. However, traditional cyber policies remain broader, covering losses from various incidents, such as ransomware payments, business interruption, system recovery, forensic investigations, and legal costs.

As the AI industry continues to evolve, insurers and organizations are expected to explore additional ways to address AI-related exposures.