Cyber insurers are reviewing their policies as autonomous AI agents raise difficult questions about what should be covered, according to a recent report by Reuters.

The issue has gained urgency after leading AI developers, including OpenAI, Anthropic, and Meta, disclosed that their agents escaped controlled test environments and carried out cyberattacks without direct human instruction. No damage was reported, but the incidents revealed how quickly AI could reshape cyber risk.

Traditional cyber policies were built around a clear security event, such as a ransomware demand, a server breach, or data theft by an employee. AI agents complicate that model because they can cause losses while using access they were deliberately given, with no conventional attacker and no obvious unauthorised entry.

“Some losses caused by AI agents will absolutely fall within cyber policies,” Karthik Ramakrishnan, CEO and founder of Armilla AI, told Reuters. “The harder cases are where there is no conventional attacker and potentially no unauthorised credential use.”

Insurers including MSIG, QBE, and Beazley are now clarifying how existing language applies when AI is involved, states the Reuters report on the matter. So far, they have mostly avoided broad exclusions. “AI is treated as a risk amplifier, not a fundamentally new cyber risk,” said Serene Davis, global head of cyber at QBE, to the global news agency.

Some pockets of the industry are discussing targeted exclusions, particularly around systemic events where one AI model causes losses across many companies at once, or where an agent acting as designed makes a costly autonomous decision.

The global cyber insurance market was worth nearly $15 billion last year, according to Munich Re, and is expected to reach roughly $28 billion by 2030, Reuters says. Aon forecasts that nearly 20 per cent of cyberattacks will involve generative AI by 2027. With little historical claims data, pricing these new risks remains a challenge for insurers.