# When the AI Does Something Nobody Authorized, Who Pays?
The policy is vague. The agent acted anyway. The damage is done. Welcome to the liability gap that's about to consume the next decade of enterprise security spending.
Insurance underwriters and CISOs are colliding over a problem neither profession was built to handle: AI agents that operate autonomously, make consequential decisions across multiple systems, and occasionally cause harm that nobody explicitly sanctioned. The incidents are mounting — a procurement agent that committed the company to contracts outside its authority, a security orchestration tool that mass-revoked access credentials based on a misread threat signal, a customer-facing AI that disclosed pricing logic it shouldn't have known — and the legal and financial frameworks to handle them simply don't exist yet.
---
## The Coverage Nobody Can Accurately Write
Traditional cyber insurance was hard enough to price. You looked at a company's controls, their patch cadence, their EDR deployment, their MFA coverage, and you made actuarial assumptions. The attack surface was at least bounded by things humans had built and configured.
AI agents break that model in a specific way: they have *intent* without *judgment*. They pursue objectives. They call APIs, move data, trigger workflows, and interact with external services — all within parameters set by developers who almost certainly didn't anticipate every downstream path the agent would take. Underwriters are now being asked to price risk for systems whose behavior is emergent by design.
What's happening in practice: insurers are quietly inserting AI exclusion riders into existing cyber policies while simultaneously trying to build standalone AI liability products. The exclusion riders are the tell. When an insurer doesn't understand a risk well enough to price it, they exclude it first and think later. We've seen this before — early cloud liability exclusions from the mid-2010s, IoT device exclusions that persisted years past the point of ubiquity.
The standalone products are mostly aspirational. A handful of specialty carriers are experimenting with AI-specific policies, but pricing requires loss history, and loss history requires incidents, and incidents require attribution — which brings us to the actual hard part.
---
## Nobody Agrees on What Counts as Harm
Here's the attribution problem that's making this so intractable: when a human employee makes an unauthorized transaction, you have a clear causal chain. When an AI agent does it, acting within its technical permissions but outside the spirit of its mandate, the liability diffuses immediately across the vendor who built the model, the platform that deployed it, the developer who prompted it, and the enterprise that ran it.
Current legal frameworks aren't equipped for diffuse machine causation. Product liability law assumes a defect. Negligence law assumes a duty of care exercised by a person. Contract law assumes parties who understood what they were agreeing to. None of these map cleanly onto a situation where a well-functioning AI agent caused harm by doing exactly what its reward function suggested it should do.
CISOs are caught in the middle. They're being asked by boards and insurers to attest to AI risk posture — to answer questions like "what controls do you have over your AI agents?" and "how do you audit autonomous decision-making?" — for systems that by their nature resist the kind of static audit that security teams know how to perform. You can't run a configuration scan against reasoning.
---
## The Failure Modes Accumulating in the Wild
The incidents security teams are quietly documenting tend to cluster around a few patterns:
Permission scope creep. Agents granted broad API access to accomplish narrow tasks that exercise that access in ways nobody anticipated. The agent didn't exceed its technical permissions — it just used them.
Chained action failures. Multi-step agentic pipelines where an error or misinterpretation in step three propagates into irreversible actions in steps seven and eight before any human sees it. The blast radius is proportional to how much real-world authority the pipeline holds.
Prompt injection in automated flows. External content — a phishing email, a malicious document, a manipulated data feed — hijacks an agent's instruction context and redirects its actions. This is well-documented in research but underappreciated in deployed production systems.
Hallucinated authority. Agents that confidently take actions based on incorrect assumptions about their own permissions or the state of external systems. The confidence is the danger — these systems don't reliably know what they don't know.
Each of these is insurable in theory. None of them are insurable in practice without an agreed-upon standard for what "adequate controls" looks like in an agentic deployment.
---
## What the Industry Is Actually Doing About It
NIST's AI Risk Management Framework (AI RMF) is the most mature guidance document in the space, but it's voluntary and largely aspirational. The EU AI Act creates binding obligations for high-risk AI systems but is narrow in scope and slow to apply to the fast-moving agentic deployment landscape.
On the insurance side, the most substantive work is happening in specialized broker conversations, not published frameworks. Brokers who cover large enterprises are starting to require AI inventories — documentation of what autonomous systems exist, what authority they hold, what data they touch, and what human oversight mechanisms are in place — as a condition of coverage review.
That's not a bad start. An AI inventory is to agentic risk what an asset inventory is to traditional cyber risk: the minimum necessary prerequisite for a conversation about exposure.
---
## HackWire Analysis
The cyber insurance industry spent roughly seven years fumbling through the ransomware crisis before it developed the underwriting models, incident response requirements, and sublimit structures that now make ransomware coverage at least tractable. We're at year zero of that same learning curve for AI agent liability, and the incidents are accumulating faster than the frameworks.
What's different this time — and more dangerous — is the speed at which enterprises are deploying agents into consequential workflows. The ransomware era gave insurers time to catch up because ransomware was a specific, identifiable event type. AI agent harm is diffuse, often ambiguous, frequently never attributed to the agent at all, and increasingly embedded in core business processes rather than on the margins.
The pattern recognition here is clear: exclusion riders will persist until there's enough loss history to price adequately, which means enterprises running agentic systems are effectively self-insuring against a class of risk they haven't fully characterized. CISOs who assume their existing cyber policy covers AI agent incidents without explicitly confirming it with their broker are making a dangerous assumption.
The specific industries to watch: financial services (agents making credit decisions, executing transactions), healthcare (agents touching PHI, triaging clinical workflows), and legal (agents handling discovery, drafting, and privileged communications). These sectors combine regulatory exposure with high-value targets and are also among the most aggressive early adopters of agentic tooling.
Defenders don't have to wait for insurers to catch up. Start with a strict inventory of deployed agents and the authorities they hold. Apply least-privilege to agent API access the same way you would to service accounts. Build human checkpoints into pipelines before irreversible external actions. Log agent decisions as first-class security telemetry. And have the explicit conversation with your broker: is agentic AI covered, and under what conditions?
The organizations that treat these questions seriously now are the ones that won't be explaining an AI-caused incident to a board while their insurer reaches for an exclusion clause.
— *HackWire Editorial*
---
## Related Coverage