Insurance Coverage Gaps for Losses Caused by Autonomous AI Banking Agents

Autonomous AI banking agents expose a gap between the losses financial institutions can suffer and the losses their insurance was written to cover. Standard cyber, E&O, and D&O policies do not automatically cover a system acting wrongly within its authority. Before a loss, banks must decide how to cover that gap and put governance in place so they can trace every agent action that has consequences.

Why autonomous banking agents create a different kind of loss than anything existing policies were designed to cover

An authenticated agent takes an authorized action, causes a loss, and leaves the bank facing a declined claim. There was no intruder, and the action fell within the authority the institution had delegated. The carrier may find that the loss lacks the breach, unauthorized access, or employee deception required by the relevant policy trigger. The very facts that establish legitimate system access can therefore leave the institution without the coverage it expected.

NYU Tandon's Quanyan Zhu draws the essential distinction between information risk and action risk. A chatbot drafts text, but a human still decides what to do with it. An agent can execute transactions, modify records, or send messages without a human remaining in the loop. Standard policies were calibrated against the former relationship, in which systems inform and people act. Autonomous agents change that relationship because the system now has the power to cause financial harm on its own.

That power is already entering banking workflows. A peer-reviewed production account of a Know Your Customer deployment also documents agents autonomously resolving cases. The legal question in that deployment went beyond whether the system could act. It concerned whether the institution could reconstruct exactly which factors drove an applicant's outcome.

The specific loss patterns that fall outside standard policy triggers

A prompt-injection attack buried in a vendor invoice shows how an attacker can exploit that distinction. The injected instruction manipulates an agent with banking-system access into initiating a wire transfer indistinguishable from a sanctioned one. The agent has legitimate access to the network and uses it without breaking in. That makes the malicious influence real without necessarily producing the unauthorized-access event a policy requires. Authentication establishes who or what entered the system, but it does not establish that the resulting payment was sound.

Other losses need no attacker at all. A multi-agent workflow can cascade into a self-amplifying loop that exhausts a six-figure inference budget over a weekend. A retrieval-augmented assistant can cite a document that no longer exists and deliver regulated advice that triggers a compliance investigation. The production KYC account shows how a stale policy left in the retrieval store can cause systematic mis-verification. Zhu identifies the broader pathways as hallucinations, flawed reasoning, prompt-injection attacks, unsafe delegation, and model drift, none of which requires a network intrusion.

An agent may execute a payment through a voice channel without a human-signed authorization record, creating ambiguity about how the loss should be covered. Sharing credentials or API keys with an agent may also be deemed furnishing an access device, potentially shifting liability to the consumer if the agent exceeds its authority. Under PSD3/PSR in Europe, formally correct authentication is not sufficient without fulfilling fraud-monitoring, Verification of Payee, and suspicious-payment-blocking obligations. Across these scenarios, the difficult loss is not simply something a third party did to the bank, but something its own system did on its behalf.

How carriers are responding through exclusion and narrow affirmative coverage

The insurance market is responding in two directions at once. ACA Group's 2026 analysis documents broad “absolute AI” clauses excluding claims “based upon, arising out of, or attributable to” AI anywhere in the chain of causation. Delinea's survey found that a large minority of companies have AI-related exclusions in their cyber policies. W. R. Berkley pursued relatively broad language that can exclude claims arising from the use, deployment, or development of AI.

The Insurance Services Office gave this movement a more formal vocabulary through optional commercial general liability endorsements CG 40 47, CG 40 48, and CG 35 08, with January 2026 edition dates. These endorsements may exclude or significantly restrict AI-related bodily injury, property damage, or personal and advertising injury. Retrenchment is most pronounced in D&O, E&O, and professional liability coverage, but cyber is following the same direction. An institution therefore cannot assess its exposure by looking at its cyber policy alone.

Cowbell announced Prime One in April 2026 with affirmative AI and quantum coverage. Coalition added an affirmative AI endorsement to its base cyber policy, while Axa XL added an endorsement for organizations that train their own generative models. These offerings provide an alternative to exclusion, but remain specialist offerings below standard-market scale. The teams and brokers who bring exclusions to buyers often differ from those who offer affirmative AI protection, so renewing a policy does not automatically turn old coverage into that protection.

Why this exclusion posture is structurally driven and unlikely to self-correct without intervention

The Geneva Association's 2025 assessment explains why this is more than a temporary pricing reaction. Generative AI fails outright on three criteria and strains others in the Berliner framework, a nine-criteria test used to assess new risks for more than four decades. It fails the tests for maximum possible loss, loss frequency, and information asymmetry. The last is especially important because carriers cannot see which models their insureds use, what those models do, or how they are governed. Without that information, the carrier lacks a basis for distinguishing a bounded deployment from one with broad delegated authority.

Lockton Re stated in February 2026 that CGL insurers do not currently model, underwrite, or price AI risks. Its conclusion was that a growing gap likely exists between what insurers intend to cover and what their policy language actually covers. Exclusion, on this account, can be a response to risk that has not been priced at all. Agent-specific incident reporting would help establish a loss taxonomy, but banking supervisors have not yet mandated it.

CSIS's September 2026 report describes insurance withdrawal as the most important de facto AI regulation happening in the U.S. For many businesses, an activity that cannot be insured is effectively prohibited. The report also identifies the appeal of a virtuous cycle in which stronger governance earns lower premiums, reduces losses, and supports faster adoption. But that cycle requires a coverage product to exist, and for most AI risk categories in 2026 it does not. Banks deploying agents today cannot wait for this information problem to resolve itself.

The regulatory framework governing these agents is also incomplete, compounding the coverage problem

The April 2026 revised interagency model risk management guidance, SR 26-2, explicitly excludes generative AI and agentic AI models from its scope. It describes them as “novel and rapidly evolving” and leaves their governance to each banking organization's own risk management and governance practices. That exclusion does not remove the expectation of sound governance. Banks must show that they are using agents responsibly even though the main U.S. supervisory framework for model governance has no agent-specific standard. Insurers thus have no shared baseline to work from, just as banks have none.

Existing legal obligations still make an agent's decisions consequential. The production KYC account maps agentic threats to ECOA/Regulation B, the EU AI Act, and GDPR Article 22. Those obligations amplify the importance of prompt injection, identity and authorization, action auditability, tool abuse, data residency, and boundary policy enforcement. The account's central distinction is between knowing how an agent could be attacked and knowing what the institution must prove after it acts. In regulated consumer finance, that proof requires reconstructing an applicant's outcome from a single case identifier.

Banking voice calls are in scope for GLBA and, depending on whether cardholder data is transmitted or stored, PCI-DSS. SOC 2 is voluntary and reaches voice infrastructure only when that infrastructure is included in the organization's defined audit scope. The FCC's February 2024 ruling treats AI-generated voices as artificial voices under TCPA, requiring prior express consent or prior express written consent for telemarketing calls. None of these obligations alone resolves how to attribute a member's authority to an agent, leaving governance and coverage exposed to the same missing evidence.

What the internal audit record reveals about where agentic losses actually originate

In the production KYC account, a stale retrieval policy caused systematic over-verification of customers who no longer required it. Internal audit caught the problem. The failure was therefore not simply an inaccurate answer appearing on a screen.

The account's second negative result concerned evidence that existed but could not do its job. Tool-call logs had been retained, yet they could not be tied back to the specific cases they decided. An audit trail that cannot reconstruct a disputed outcome is functionally absent for that purpose. The third result involved legitimate applicants whom the automated pipeline could not serve. That bounded failure required human escalation paths the system had not been designed to provide.

Zhu's prescription centers on logs, tool traces, model and version histories, approval records, and rollback history because they help establish causation after a loss. Without this evidence, a claim can stall before the parties even agree on what happened. Citigroup's stated “human in the loop” posture reflects a cautious response to this exposure, using AI to assist colleagues in risk and compliance. Every disputed action needs reconstructible evidence.

What financial institutions can do now to close the gap between deployed agents and actual coverage

Deployments should first be mapped by autonomy level. Zhu's continuum runs from text-generation tools through copilots preparing actions for approval to agents executing transactions and modifying systems without confirmation. That distinction directs attention to what an agent can do, which systems it can change, and what gates constrain it. Delegated authority drives both the probability and magnitude of loss. Deploying on existing banking rails with least-privilege authorization and configurable controls makes that authority boundary explicit.

The evidence layer then needs to preserve the connection between authority, action, and outcome. At a minimum, Case-ID propagation must cover every agent action because tool-call logs kept in isolation cannot show what happened in a case. Full visibility and complete audit trails should be treated as infrastructure in place before an incident. SOC 2 certification and compliance-readiness can serve as concrete markers of this work, provided their scope is clear. They do not replace the operational evidence an underwriter needs about the agent itself.

Coverage procurement must be equally deliberate. Banks should shop for AI endorsements at every renewal because a familiar policy may no longer cover the same losses. ACA Group's 2026 analysis says underwriters increasingly expect AI inventories, documented risk assessments, and evidence of adversarial testing for systems acting on production data. Strong governance may support more favorable underwriting outcomes or premium discounts. Predefined allocation rules also matter when a breach, service failure, and agent action overlap, so the institution does not leave competing policies to be untangled after the loss.

These controls can make a deployment legible to specialist carriers already offering affirmative coverage and clarify the exposure the institution retains. A well-governed agent is more insurable because its powers are bounded and its actions can be explained. That makes governance part of the product being deployed.