Skip to content
T threat.cafe

· Constance Ibe-Whitmore (editorial persona) · Governance and leadership · on threat.cafe

When an agent causes the loss and there's no attacker: the cyber-insurance trigger gap and what to ask your broker at renewal

Whether a cyber policy pays for a loss caused by your own AI agent depends on wording most buyers have not read against that scenario. Cyber cover is typically built around triggers such as unauthorised access, a security failure or social engineering. An agent acting under valid credentials, inside the permissions you gave it, may satisfy none of them. Meanwhile some insurers have added broad AI exclusions to related liability lines, and others now market affirmative AI cover. The defensible step at renewal is to describe a concrete agent-caused loss to your broker and ask, in writing, which insuring clause would respond and which exclusion could defeat it. This article is general information, not legal or insurance advice; coverage turns on your policy's exact wording, which your broker and coverage counsel must read.

What has changed in the market

Three developments, each from a source that can be inspected, frame the question.

Broad AI exclusions exist on adjacent lines. Law firm Zelle LLP reported in October 2025 that Berkley introduced an "absolute" AI exclusion for directors and officers, errors and omissions, and fiduciary liability products, applying to any claim "based upon, arising out of, or attributable to" the use, deployment or development of artificial intelligence; it also described a Hamilton generative-AI exclusion for professional liability policies (Zelle LLP, 31 October 2025). Hunton Andrews Kurth's July 2025 analysis concluded that "coverage for AI risks can no longer be assumed" (Hunton, 2 July 2025).

Exclusions are not yet universal. An insurance executive quoted by Insurance Business in February 2026 said that "explicit exclusions remain relatively rare, but they do exist," and that the resulting "silent coverage" for AI under professional policies creates uncertainty (Insurance Business, 13 February 2026).

Affirmative cover is appearing. Cowbell's Prime One, announced in April 2026, "introduces affirmative coverage for artificial intelligence-related incidents" and covers "risks arising from the unauthorized use of or access to AI systems in business operations" (SiliconANGLE, 21 April 2026). Hunton describes specialist products such as Munich Re's aiSure and an Armilla AI liability product underwritten at Lloyd's. Whether a given affirmative grant reaches an authorised agent's own error is a wording question, not a marketing one.

The trigger gap, stated precisely

The gap arises where a loss has no third-party wrongdoer. An April 2026 commentary frames it as the difference between "a third party did this to us" and "our system did this on our behalf, and now someone is sending us a bill"; in its example, "there was no intruder, no deception, no malware" (Tian Pan, 27 April 2026). That source is an individual's blog and should be read as analysis, not authority. The mechanism it describes is still the right test to apply to your own wording.

Three loss shapes make the test concrete. Each is an illustrative example, not a reported claim.

  • Illustrative example: destructive action. A coding agent with production credentials runs a migration that drops a customer table. No attacker; the agent was authorised.
  • Illustrative example: misdirected data. An agent connected to email and a customer database sends records to the wrong external recipient while completing a task.
  • Illustrative example: poisoned tool. An agent uses a third-party MCP server that turns malicious in an update and copies data out, as the postmark-mcp server did by BCC'ing every email to an outside address (The Hacker News, 29 September 2025).

The third shape involves a malicious third party and may fit a conventional trigger. The first two may not. Your broker should be able to say which, by clause.

Applicability: which policies to put on the table

The answer may sit in more than one policy, and the exclusions above sit on different lines. Bring all of these to the renewal conversation:

  • Cyber (first-party: data restoration, business interruption, incident response; third-party: privacy and network security liability).
  • Technology errors and omissions or professional liability, if you deliver services that use agents.
  • Directors and officers, where AI governance failures may be alleged against leadership.
  • Crime or social engineering cover, for funds transfer losses.
  • Commercial general liability, for completeness. One consultancy reports that ISO generative-AI exclusion endorsements for general liability forms took effect on 1 January 2026 (EPC Group, 1 July 2026); that claim comes from a commercial source, so ask your broker whether any such endorsement is attached to your policy.

Contracts matter alongside insurance. Clifford Chance notes that under many agreements "the business procuring the technology (i.e. the customer) ultimately bears the risk of actions taken by AI agents," with supplier disclaimers and exclusions for lost data or profits limiting recovery (Clifford Chance, 10 February 2026). If the contract leaves the loss with you, the policy is the only remaining source of recovery.

The broker question list

Send these in writing and ask for written answers that cite clause numbers. A verbal "you should be fine" is not an answer.

A. TRIGGERS
1. For each illustrative loss (destructive action, misdirected data, poisoned
   tool), which insuring agreement would respond? Cite the clause.
2. Does "unauthorised access" or "security failure" include an action taken by
   software operating under our own valid credentials?
3. Does "computer system" or "insured's system" include third-party AI services
   and MCP servers our agents call?

B. EXCLUSIONS
4. Does any policy in the programme contain an AI, generative-AI or "absolute"
   AI exclusion or endorsement? Provide the form number and wording.
5. Could an intentional-acts, contractual-liability or failure-to-maintain-
   security exclusion apply where an agent acted within granted permissions?
6. Is there any war, infrastructure or widespread-event wording that could
   capture a mass compromise of a popular agent tool?

C. AFFIRMATIVE COVER
7. Is affirmative AI cover available on our cyber or E&O policy? What does its
   definition of "AI incident" include and exclude?
8. Is it sublimited? What is the sublimit relative to the policy limit?

D. CONDITIONS AND EVIDENCE
9. What agent controls must we warrant or disclose on the proposal form?
   Could an inaccurate answer void cover?
10. What evidence will the insurer expect at claim time (logs, approvals,
    configuration history), and for how long must we keep it?
11. Does notice of an agent-caused incident follow the same timeline as a
    breach notice?

E. TOWER AND CONTRACTS
12. If cyber and E&O both respond, which is primary? Is there a gap between them?
13. Do our supplier contracts with AI vendors require them to carry cover that
    responds to their agent's errors?

What underwriters reportedly ask in return

Expect questions back. The sources here are commercial and should be treated as indications, not requirements.

EPC Group, which says it interviewed underwriters at six carriers, lists controls including a "human kill switch" ("a named person can stop or reverse any autonomous AI action"), a named override owner for each AI decision, and a named accountable executive (EPC Group). The carriers are not named. The Tian Pan commentary lists approval gates for tool actions, logging and integrity of agent traces, and how quickly an agent can be frozen.

The practical consequence for a security leader: the evidence that answers question 10 (decision logs, approval records, a tested way to disable an agent tool fleet-wide) is also the evidence an underwriter is likely to request at quote. Building it once serves both.

Must, should, may for the renewal file

  • Must: obtain written answers to questions 1, 4 and 9 before binding. Without them you cannot state whether agent losses are covered.
  • Must: answer proposal-form questions about AI and agent use accurately; misstatements can affect cover.
  • Should: have coverage counsel compare the policy wording against the three illustrative losses.
  • Should: align supplier contracts so that agent vendors' liability and insurance match the risk they introduce.
  • May: buy affirmative AI cover where available, after confirming its definitions reach authorised-agent errors.

Ambiguities to watch

No court decision on an authorised-agent loss under a cyber policy was found in the sources reviewed for this article. Until one exists, outcomes will depend on wording and on how a carrier reads "unauthorised." Policy forms are also changing between renewal cycles, so last year's answer does not carry over.

If you are building the evidence underwriters ask for, threat.cafe's planned team tier centres on a shared policy and a searchable log of every agent check and block; the early-access list is open.

Sources

#cyber-insurance #ai-exclusions #coding-agents #risk-management #renewal

All posts