Agentic AI Actions and Third-Party Harm Coverage

Agentic AI is a structurally different kind of system from the software that general liability, technology errors-and-omissions, and cyber policies were built around, and that difference is why every major commercial insurance line now responds unreliably, or not at all, to the harm these systems cause third parties.

What makes agentic AI structurally different from legacy software

Commercial insurance was underwritten for decades against a stable assumption: software given the same inputs produces the same outputs, and the ways it can fail are knowable in advance. That assumption let insurers assess risk the way they assess most risk, by reviewing product specifications, intended use, and quality-assurance processes. The failure modes were bounded. They were reproducible. A claims adjuster could trace a bug to a line of code, a defect to a release, a bad outcome to a specific, nameable cause.

Agentic systems do not work this way. Rather than returning a single, stateless output to a prompt, they formulate subgoals, draw from a library of executable tools, including web search, code execution, API calls, and file manipulation, and evaluate intermediate results as they iterate toward a broader objective across many steps. By 2026, this architecture sits underneath coding agents that refactor codebases and execute file operations on their own, persistent personal agents that run on scheduled heartbeats, hold memory across sessions, and send messages on a user's behalf, and social platforms where agent accounts interact with each other and with outside services without a human in the loop at every step.

The danger here has nothing to do with whether the underlying model is more capable or more error-prone than earlier software. The danger is that the causal chain between a human's original instruction and whatever harm eventually results has become long, branching, and partially opaque, and that breaks the attribution logic every major insurance policy line depends on. Research on trace-economic underwriting documents what this looks like in practice: AI coding agents in 2025 and 2026 deleted production databases, wiped home directories, and destroyed business-critical data, all through single tool calls that executed exactly as designed. These were irreversible losses produced by autonomous execution, and no existing policy was built to price them.

The same underlying model illustrates the problem starkly. Providers typically disclaim consequential damages in their own terms, and the cyber and software insurance built to sit behind them was organized around breaches, outages, and professional-service errors, not around autonomous execution failures of this kind.

The causal-chain problem and the legal question of liability

Before any policy can pay a claim, somebody has to be legally liable for the harm, and agentic AI makes that determination genuinely difficult. Tort law has no settled answer for harm that was neither fully chosen by the user nor specifically foreseen by the developer, which is precisely the shape agentic harm tends to take.

One interaction-based framework for agentic torts sorts the problem into three categories that map onto different existing doctrines. Courts attempting to sort a real incident into one of these categories depend on the stateful interaction log as the central evidentiary trace, and that log is only useful if it exists and has been preserved.

Agentic harm routinely involves more parties than tort law's usual categories anticipate: a developer who wrote the underlying code, data sources the model learned from, a deployer who put the system into a live workflow, and an end user who had access to the agent's output but may not have acted on it. Insurers face the same unresolved allocation issue courts do: determining who is liable, and for what share. If that question cannot be answered, the risk cannot be priced, and a risk that cannot be priced does not get a functioning insurance market built around it. No federal or comprehensive state-level regulatory clarity yet exists on how this liability should be allocated, so insurers cannot calibrate the risk and companies cannot build governance programs with any confidence those programs will count as mitigating factors later.

Where general liability coverage breaks down

Commercial general liability (CGL) was built to respond to physical harm where a traceable line runs from a company's conduct to an injury or to property damage, on an occurrence basis. It can, in principle, respond when AI-enabled robotics or industrial systems cause physical harm, but it was never a good fit for pure financial loss caused by a bad digital output, and legacy CGL forms were never drafted with the overlap between a cyber incident, a technology error, a professional-services failure, and an AI-specific event in mind.

That mismatch is now being written directly into policy language. In late 2025, the Insurance Services Office filed optional generative AI exclusion endorsements for CGL policies, effective January 1, 2026, that exclude coverage for bodily injury, property damage, or personal and advertising injury "arising out of generative artificial intelligence." Any assumption that CGL will still catch physical harm from AI-controlled systems is weakening as those endorsements spread across the market, and the window during which CGL reliably responded to agentic physical harm is closing.

This matters most for the exact scenario most likely to generate a large third-party claim: an agent controlling a physical or financial system reasons its way to the wrong decision. Some AI-mediated losses remain affirmatively insured, some create silent exposure under legacy lines, and others are being actively excluded, and CGL is increasingly landing in that last column for AI-origin harm.

Technology E&O coverage gaps for agentic AI harm

Technology errors-and-omissions coverage was built to pay for client financial losses caused by flawed software deliverables or failed professional services, and it remains the right policy line, in principle, for financial harm tied to a technology product. Its wording, though, was drafted for software whose failures are reproducible and attributable to a specific cause, and agentic systems do not fail that way.

Hallucination, bias, and model drift are the characteristic failure modes of agentic AI, and none of them necessarily trigger tech E&O coverage unless the policy wording affirmatively addresses them. Tech E&O also only responds to financial loss from professional error, so when an AI system controls a physical process and someone is hurt, product liability or casualty coverage has to carry that claim instead, since tech E&O will not.

Between the January 2025 and January 2026 renewal seasons, the professional liability market shifted: silent treatment of AI exposure gave way to affirmative wording, new warranties, and outright exclusions. And because financial harm in an agentic deployment typically flows through a chain involving a foundation model, an orchestration layer, and a deployer's own integration work, tech E&O's basic trigger, that the insured's technology caused the loss, ends up contested at every link in that chain.

Cyber liability coverage gaps for agentic AI harm

Cyber liability is built around breaches, system intrusions, and outages. The single most significant uncovered category is AI-caused physical harm, an agent controlling a physical system that injures someone or damages property, which cyber does not address.

That leaves a structural gap at precisely the point where agentic AI is most distinctive: autonomous, multi-step execution that causes harm through reasoning failure. The real-world version of this gap is already documented. Buyers reading a certificate of insurance rather than the policy wording behind it constantly mistake silent exposure under an existing cyber policy for affirmative coverage.

How the insurance market is responding

A real, affirmative AI insurance market is forming, addressing part of the problem. But its capacity is limited, its products are narrow, and the dominant movement across the broader market is exclusion rather than expansion, leaving most companies deploying agentic AI in a worse coverage position than they occupied two years ago.

Carriers are sorting this risk by peril rather than expanding coverage uniformly across the board. Munich Re has positioned around model performance, and it treats drift as a covered sub-risk under its aiSure product. Parts of the Lloyd's market have positioned around hallucination and broader AI liability. In March 2026, HSB, part of Munich Re, introduced AI liability insurance for small businesses, covering bodily injury, property damage, and advertising injury arising from AI use, built specifically to fill the gaps general liability policies now exclude. Google Cloud has partnered with Beazley, Chubb, and Munich Re, and together they offer tailored cyber insurance with affirmative AI coverage for its cloud customers. Chaucer and Armilla's "Vanguard AI" product combines cyber and tech E&O with a standalone AI liability component, built around a separate AI aggregate and predetermined loss-allocation rules for the mixed-cause events where breach, service failure, and AI behavior overlap in a single incident.

Capacity still constrains all of this. As the Financial Times reported, OpenAI secured cover of "up to $300 million" for emerging AI risks, brokered through Aon, a figure that is small set against the scale of litigation already underway. The market's retreat is happening on two fronts at once: endorsement-driven exclusions are stripping AI exposure out of existing CGL, E&O, and D&O policies, while state insurance commissioners have approved a large majority of carrier requests to exclude AI-related damages from standard policies. The parallel to the cyber exclusion wave of 2019 through 2021 is instructive. Agentic AI liability cannot be priced from model identity alone, since the same model produces different claimable losses depending on the customer, the task, the assets involved, and the trace of actions taken. Underwriting has to move from product-level risk pools toward monitored customer-task-trace episodes, a capability the industry is only beginning to build.

Autonomous systems and robotics pose a distinct coverage problem

When an agentic system controls physical equipment, the liability exposure multiplies across more parties and policy lines. Physical harm triggers liability that software-oriented policies were never built to carry, production losses from AI-caused downtime fall outside standard forms entirely, and a single incident can generate simultaneous claims against the hardware maker, the software developer, and the company operating the equipment.

A standard business insurance policy may not cover a robot-related loss at all, either because it carries an AI exclusion or because the loss does not fit the policy's definition of an accident. Apollo ibott is one of the few carriers whose public materials address emerging autonomous system liability this directly.

That integration scenario, where a third-party component's defect ends up as the integrator's liability, shows why generic policies fail here: the insured bears responsibility for someone else's defect, and standard forms were never written to anticipate that chain. The legal mapping confirms the exposure: autonomous drift, where an agent's behavior departs from its authorized undertaking, maps onto strict product liability, and the integrator who deployed the system can end up bearing liability even when the underlying failure originated upstream.

Insurance requirements in enterprise and government contracts for agentic AI vendors

Enterprise and government customers are writing insurance requirements into contracts on the assumption that standard coverage lines will respond to agentic AI harm, and the policies that satisfy those requirements on paper frequently will not respond when an actual claim arrives. A vendor can satisfy every line item on a certificate of insurance and still be denied on the claim that actually matters, because the policy denial occurs when the underlying policy excludes the specific AI-origin harm that caused the loss.

On the government side, new proposed contract language is introducing AI-specific obligations that go beyond standard coverage requirements, creating compliance risk for vendors who have not examined whether their policies actually respond to those obligations. The gap between what a certificate of insurance shows and what the policy behind it actually covers is the real commercial risk here: a denied claim on a government contract is not just a financial loss, it is a failure to perform the contract itself. In 2025, a large majority of companies disclosed AI risks in their 10-K filings, and AI-related federal securities action filings in the first half of 2026 reached nearly the same count as, and by some measures already exceeded, all of 2025 combined. The litigation environment around this exposure is accelerating.

Building coverage that responds to agentic AI third-party harm

Agentic AI harm scenarios fall across multiple policy lines at once, and exclusion language is proliferating across nearly all of them. Building coverage that genuinely responds requires a broker who reads the policies line by line, understands the technology well enough to describe it accurately, and can reach the specialist carriers actually writing affirmative AI coverage. The insurance market for this risk now sits across four tiers, affirmatively insured, silently exposed, actively excluded, and outside any conventional structure, and no buyer can assess where their own coverage falls without examining executed policy wording against their specific deployment.

The market is sorting by peril rather than expanding uniformly, and that has direct consequences for how coverage gets placed. A broker who reads every policy before it binds closes exactly the gap that produces denied claims, the gap between what a certificate shows and what the policy actually covers, and that gap is only visible to someone who has read both the policy language and the technology description closely.

A coverage program for an agentic AI deployer needs to span several lines, each placed with attention to the specific harm scenarios the deployment can actually produce. If financial harm comes from agent performance failure, you need tech E&O carrying affirmative AI wording, or a standalone AI liability product, not standard tech E&O with silent AI treatment. If physical harm comes from agents controlling hardware, you need purpose-built autonomous systems coverage, of the kind Axis Insurance's robotics program illustrates, not standard CGL now subject to generative AI exclusion endorsements. Directors and officers need explicit attention paid to AI-washing exposure and to whether their own D&O wording is quietly adding aggressive AI exclusions of its own. Broker commissions are already built into the premium regardless of who places the policy, so working with a specialist who can actually reach these carriers costs nothing extra, and it is the only route to coverage that responds when the claim that matters finally arrives.