AI Cyber Insurance: The Coverage Gap Your Agent Will Find First

A coding agent merges a change at 2 a.m. that takes a customer's production database offline for ninety minutes. A customer-support agent fans out and sends fourteen thousand misworded refund-denial emails before the loop is killed. An autonomous reconciliation workflow charges 2,800 cards twice. The damages are real, the audit trail names your company, and your finance team files the claim against the cyber policy that was renewed six weeks ago. The carrier's response is a polite letter explaining that the policy covers "unauthorized access by malicious third parties" and "social engineering of an employee" — and the agent was authenticated, the action was authorized, and no employee was deceived. Coverage denied. The loss sits on your balance sheet.

This is not a hypothetical edge case. It is the modal claim profile for the next eighteen months, and the insurance industry knows it. Cyber, E&O, and D&O policy language was calibrated against a threat model where breach severity is a function of records exfiltrated and incident response is a function of forensic hours billed. Agentic AI does not produce that shape of incident. It produces a shape the underwriter has no actuarial baseline for, and the carrier's first instinct — when the actuarial baseline is missing — is to write the exposure out of the policy entirely.

The teams shipping agents in 2026 are operating in a coverage vacuum that almost nobody has audited, and the discovery happens at claim time, when the audit is too late.

The shape of the new claim

Traditional cyber policy triggers depend on intent and identity: an external actor obtained unauthorized access, a phishing email tricked a user, ransomware encrypted a system. Agent incidents fail every one of these tests. The agent had legitimate credentials. The agent was authorized to call the tool. The agent's action was logged, attributed, and within its declared scope. There was no intruder, no deception, no malware. There was just an autonomous system that did the wrong thing very quickly, at scale, under your name.

Several distinct loss patterns are already showing up at brokers' desks. An agent with banking-system access is manipulated by a prompt-injection payload buried in a vendor invoice and initiates a wire transfer that looks indistinguishable from a sanctioned one. A multi-agent workflow cascades into a self-amplifying loop and exhausts a six-figure inference budget over a weekend. A retrieval-augmented assistant cites a document that no longer exists and gives regulated advice that triggers a compliance investigation. A code-writing agent merges a change that meets the linter, passes the tests, and breaks a customer's SLA at the protocol layer. None of these map cleanly to the policy language drafted in 2022.

The gap is not subtle. It is the difference between "a third party did this to us" and "our system did this on our behalf, and now someone is sending us a bill." The first is what cyber insurance was built for. The second is what your roadmap is now optimized to produce.

What carriers are actually doing about it

Two opposite movements are happening at the same time, and most buyers see only one of them.

The first movement is exclusion. Major carriers have introduced what brokers are calling "absolute AI" clauses — broad endorsements that exclude any claim "based upon, arising out of, or attributable to" the use of AI, in any role, by anyone in the chain of causation. The drafting is intentionally expansive: it sweeps in claims where AI played a minor or even tangential role, and it pre-empts the silent-AI assumption that coverage exists because nothing explicitly excludes it. D&O, E&O, and Fiduciary towers are the loudest, but cyber is following. The pattern is familiar from prior emerging-risk cycles: when actuaries cannot price an exposure, they exclude it until they can.

The second movement is the affirmative endorsement. A handful of carriers are now offering AI-specific add-ons that explicitly cover agent actions, hallucination-driven liabilities, and prompt-injection scenarios. Cowbell announced its Prime One product in April with affirmative AI and quantum coverage. Coalition rolled an affirmative AI endorsement into its base cyber policy after a year as an opt-in. Axa XL added an endorsement aimed at organizations training their own generative models. Specialty AI insurers are writing standalone policies that name the exposures the absolute exclusions are pushing out.

The buyer's problem is that these two products are sold by different teams, often through different brokers, and the renewal cycle does not auto-translate "you used to be covered" into "you are now affirmatively covered." A team that does not actively shop the AI endorsement at renewal often discovers, on the next claim, that they were quietly excluded eighteen months ago. The endorsement is a procurement decision now, not a policy footnote.

The contract surface that compounds the gap

The insurance gap does not live alone. Most enterprise customer agreements were also drafted before agents had tool access, and they have their own version of the same problem.

Master service agreements typically allocate liability for "system-generated" outputs as if "system" meant deterministic code with bounded behavior. When the system is an LLM-driven agent that can take a thousand different actions in response to the same input, the contract's indemnity clauses still read literally — but the risk allocation they encode no longer matches the risk being created. The customer believes they bought a service. The vendor believes they shipped software. The agent did something neither party drew on the whiteboard, and the contract has no clause that anticipates it.

Vendor T&Cs for the upstream model are even more lopsided. Most foundation-model providers disclaim responsibility for accuracy, fitness, and downstream consequences. The customer of the customer of the model is wearing the residual risk by default. When the chain breaks, the carrier looks at the contract stack and sees a clear allocation of liability — to your company.

The fix is not a one-time legal sprint. It is a renewal-cycle discipline: every customer MSA touched by an agent surface gets a contractual review whose first question is "what does this contract say about an action initiated by an autonomous system operating under our credentials?" Anything that answers "the contract does not contemplate this" is a finding, not a footnote.

What the underwriter is now asking

Loading…