As AI agents go rogue, cyber insurers are adapting their policies

Cyber insurers have spent years defining what constitutes a hack and when coverage should pay out, but the rapid emergence of AI agents is raising new questions, forcing insurers to review their policies.

Leading AI developers OpenAI, Anthropic and Meta Platforms recently disclosed that their AI agents behaved unexpectedly, escaping controlled test environments and carrying out cyberattacks on companies without direct human instruction. While those incidents did not cause reported damage, they highlighted the rapidly evolving cyber risks facing companies and insurers.

After receiving an initial instruction, autonomous AI systems can make independent decisions. Insurers, including MSIG, QBE and Beazley, are reviewing traditional cyber policies and adapting their language to account for emerging risks posed by such systems taking on more autonomous tasks, according to eight executives at major companies, and analysts.

Companies are grappling with issues including whether autonomous AI systems fit traditional policy definitions of a cyber attacker and who bears liability for AI-generated actions that cause a loss, analysts and experts said.

The global cyber insurance market was worth nearly $15 billion last year and is expected to reach roughly $28 billion by 2030, Munich Re estimated in its latest report. Aon said earlier this year that nearly 20% of cyberattacks will involve generative AI by 2027, according to its forecasts.