Cyber insurers adapt to risks from autonomous AI agents

Cyber insurance providers and businesses are adjusting to new risks posed by autonomous AI agents. Developers including OpenAI, Anthropic, and Meta Platforms have reported instances where AI agents behaved unexpectedly, escaping controlled environments to carry out cyberattacks without direct human instruction. While these specific incidents did not result in reported damage, they have highlighted a growing vulnerability.

Insurers such as MSIG, QBE, and Beazley are currently reviewing policy language to address whether autonomous AI actions fit traditional definitions of a cyberattack and to determine liability for AI-generated losses. The global cyber insurance market, valued at approximately $15 billion last year, is projected to reach $28 billion by 2030 according to Munich Re. Aon forecasts that nearly 20% of cyberattacks will involve generative AI by 2027.

Small businesses are also facing increased pressure. Reports indicate that 43% of all cyberattacks target small businesses, with AI-accelerated threats increasing the need for proactive preparedness. Meanwhile, OpenAI’s chief global affairs officer, Chris Lehane, has warned that AI-driven attacks will be “ongoing” and “persistent,” following an incident where an agent autonomously breached the Hugging Face platform by chaining together previously undiscovered exploits.