More than 90% of insurers' AI agent exposure may sit inside conventional policies never designed for the technology, a new industry report has found.
The finding comes from Underwriting the Agent Economy, a study by the Artificial Intelligence Underwriting Company (AIUC). Researchers from Anthropic and OpenAI were among its co-authors, alongside experts from insurers, brokers, universities and research groups. AIUC is a San Francisco-based firm that certifies and insures AI agents.
The report found that exposure was concentrated in cyber, directors and officers, commercial general liability, and technology errors and omissions policies. Such "silent" cover refers to risks that are neither expressly included nor excluded. Insurers may face liability for losses they never priced or anticipated.
The market is already moving. Some carriers, including CFC, have added affirmative AI wording to technology errors and omissions, professional liability and cyber policies. A January 2026 ISO form also lets carriers exclude bodily injury, property damage and advertising injury from generative AI under standard CGL policies.
Willis research found the professional liability market shifted structurally between January 2025 and January 2026. Carriers moved from silent AI assumptions to either explicit affirmative warranties or absolute exclusions. Gallagher 2026 survey data found that one in five insurance professionals reported their insureds had already experienced losses linked to AI risk.
According to the AIUC report, AI agents differ from chatbots in one material respect: they carry out tasks rather than generate responses. They can operate software, access company data and move funds with limited human oversight. Failures could trigger claims across professional negligence, data breach, fraud, discrimination and cyber lines.
The report also notes that when an AI agent causes harm, disputes over which policy responds are likely. A business may attribute the fault to the system's developer. The developer may counter that the customer misconfigured the agent or granted it excessive access.
Real cases are already testing those boundaries. British engineering firm Arup lost HK$200 million (approximately US$25 million) in 2024 after criminals used deepfake video calls to impersonate senior executives. An employee in Hong Kong was persuaded to transfer funds to accounts the fraudsters controlled.
A claim from such an incident could span crime, cyber, and social-engineering cover. Insurers and policyholders would likely dispute whether the transfer was voluntary or fraudulent.
In North America, US solar installer Wolf River Electric has sued Google for at least US$110 million in damages. The suit alleges Google's AI Overviews feature published false claims about the company's business practices.
In Canada, a tribunal ordered Air Canada to pay compensation to a passenger misled by its chatbot. The tribunal found the airline was responsible for information on its own website.
The AIUC report warned that a severe AI event could produce around US$100 billion in direct losses. Wider economic costs could reach into the trillions if insurers withdrew cover and businesses reduced AI adoption. The figure is a risk scenario, not a forecast.
Kevin Kalinich, head of intangible assets at Aon and a co-author of the report, said AI could produce "aggregated, systemic, correlated" losses. The authors compared the risk to the terrorism insurance market after September 11. More than US$40 billion in insured losses then prompted carriers to restrict cover until government backstops were introduced.
Some industry figures have questioned whether the warnings are overstated. They note that AIUC has a commercial interest in the growth of specialist AI cover. The report acknowledged that criticism but found that existing policy wording was already generating uncertainty for both sides.
Some carriers have begun adding exclusions for generative AI, which could reduce hidden exposure while leaving policyholders with less protection. The report called for dedicated AI cover, common technical standards and clearer policy language. Without those changes, major AI losses are likely to produce disputes over risks that insurers did not know they had accepted.
