The Uninsured Agent

The mechanics matter, because they show how deliberate this is. ISO, the body that drafts the standard policy language most American insurers build on, introduced endorsements available from January 2026 that exclude bodily injury, property damage, and personal and advertising injury arising out of generative AI from commercial general liability policies. Attorneys tracking the forms report similar absolute AI exclusions appearing in directors-and-officers and professional liability lines. Cyber policies, where most boards assume this risk lives, typically do not respond to hallucinations that cause financial loss, to defamation by an AI output, or to intellectual property infringement. Technology errors-and-omissions cover is written for the vendors who build AI tools, not the enterprises that deploy them. Carriers including Coalition, AXA XL, Hiscox and Beazley are clarifying their boundaries through endorsements and sector products, which is a polite way of saying that cover is now decided case by case, priced on facts about your deployment that most buyers cannot yet evidence.

It would matter less if agent-caused losses were still a thought experiment. They are not. In March 2026 a poisoned release of LiteLLM, the gateway library that sits underneath many production agent stacks, went live on PyPI and was downloaded roughly 47,000 times in the three hours before it was pulled. In May, Microsoft's security team disclosed remote-code-execution-class prompt injection paths in agent frameworks including its own Semantic Kernel: a crafted input that becomes a shell on your infrastructure. OWASP now maps prompt injection to six of the ten categories in its agentic top ten, and there are credible reports of malicious skills appearing by the hundreds on public agent marketplaces. None of these are model failures in the familiar sense. They are failures of the supply chain, the permissions, and the verification around the model, which is precisely the surface insurers cannot yet price and are therefore excluding.

Against that backdrop, the industry's own numbers describe an uncomfortable posture. LangChain's State of Agent Engineering survey, vendor research but the largest sample available at 1,340 practitioners, found that 89 percent of organisations have observability in place for their agents. Only 52.4 percent run offline evaluations against test sets, and 37.3 percent run online evaluations against live production behaviour. Read that as an underwriter would. Nine in ten teams can watch their agent fail. Barely more than a third have machinery that would catch the failure before or as it happens. The same survey names quality as the single biggest blocker to production, which is exactly what you would expect from a population that monitors far more than it tests.

The distinction sounds academic until the claim arrives. Observability is a record of what happened; verification is a control on what is allowed to happen. When a loss lands and cover is contested, the questions asked are an underwriter's questions: what could the agent touch, what checked its output before the action became real, what evidence exists that the checks actually ran. A dashboard that watched the failure is not a control, it is a witness, and in a dispute it testifies against you, because it proves you could see the risk class and ran anyway. The wider governance picture is no better. On IBM's data, only 37 percent of organisations have a policy in place to detect shadow AI at all, so most firms cannot even enumerate the agents they would need to defend. The gap between watching and verifying is not an engineering nicety. It is the precise coordinates of where the uninsured losses of the next two years will land.