Anthropic warns some AI risks may be uninsurable

The limits of coverage

Anthropic recently disclosed significant concerns regarding the insurability of artificial intelligence in its IPO filing. The company admitted that its models can behave in ways that neither developers nor users intended, leading to potential liabilities that current insurance policies might not adequately mitigate. They specifically noted that a single incident or a group of incidents could cause disproportionate harm that exceeds standard coverage limits.

The filing suggests that the insurance industry may lack the necessary capacity or expertise to handle catastrophic AI-related events. Anthropic stated that the market for AI-specific risks is still nascent and evolving, which could leave the company exposed to significant uninsured losses. This admission highlights a growing anxiety that some of the most severe risks posed by AI are simply too large for any single insurer to handle.

While the company has vast financial resources, it cannot guarantee that insurance will be available on commercially reasonable terms. This uncertainty creates a precarious situation for the company as it scales its technology. It signals to the market that the legal and financial consequences of AI errors are still largely undefined and potentially unmanageable by traditional financial safeguards.

Cyber insurance vs. physical harm

Currently, most AI-related risks are being funneled into existing cyber insurance policies. These policies are designed to handle data breaches, privacy violations, system outages, and deepfake wire fraud. However, industry experts point out that cyber insurance was built for

The complexity of the causal chain

One of the primary challenges for risk management is identifying where AI actually fits into a sequence of events. Experts warn that exclusions in a company's insurance policy can be triggered even if the AI is not the primary tool used. If an AI component sits anywhere in the causal chain of a loss, it could lead to a situation where the company is left without coverage.

This risk is particularly acute when companies use third-party software. A business might believe they are protected, but if a vendor's product contains AI that contributes to a security breach or a data incident, the insurance provider might deny the claim. This creates a hidden layer of risk for businesses that rely on complex, interconnected technology stacks where AI is embedded but not always visible.

Identifying invisible AI attacks

Detecting the role of AI in cyberattacks presents a significant hurdle for insurance providers. For example, bad actors are increasingly using AI to create more convincing social engineering attacks, such as sending emails or messages that impersonate a colleague. Because these attacks are designed to look like human interactions, it is not always immediately apparent whether AI was the tool used to facilitate the fraud.

This lack of clarity makes it difficult for insurers to categorize and price the risk accurately. While these incidents may accelerate the frequency of cyber claims, they also complicate the process of determining the specific cause of a loss. As AI becomes more sophisticated at mimicking human behavior, the line between a standard cyber incident and an AI-driven attack continues to blur for investigators.

Evolving underwriting standards

Insurance companies are currently in a period of observation as they determine how to adapt to the changing threat environment. Rather than immediately jumping to exclusions as the first step, some carriers are looking to help companies manage their risks through better controls. They are working to understand how AI impacts different lines of business and are partnering with law firms and technology vendors to build a clearer picture of the risks involved.

The goal for many insurers is to develop underwriting processes that can adapt to new threats without being overly restrictive from the start. However, companies that fail to implement baseline security controls may eventually face exclusions. If a business proves unwilling to change its risk management approach or lacks oversight on where its employees are using AI tools, it may find itself unable to secure necessary coverage.