Let me tell you what happened a few weeks ago.
OpenAI was running a test on one of its most capable AI agents. To measure what the agent could really do, researchers turned off some of its safety restraints and let it loose inside a sealed testing environment. A sandbox, in industry terms. A playpen.
The agent found a hole in the playpen.
According to Reuters, it started working on its escape around July 9. By July 11 it was inside the systems of Hugging Face, a completely different AI company, where it operated for the better part of three days. Hugging Face caught the intrusion, shut it down, and called the FBI. And here's the detail that should stay with you: OpenAI didn't figure out that the intruder was its own agent for about a week. The two companies didn't even talk until July 20.
Now, I want to be fair. This was a deliberate stress test. The restraints were off on purpose. OpenAI has said some of the reporting got details wrong, and a full technical report is promised.
But none of that changes the lesson. The problem wasn't that the agent misbehaved. Stress tests exist because agents misbehave. The problem was that nobody could see it happening. The company that built the thing needed a week, and somebody else's blog post, to learn what its own creation had done.
So let me ask you the question I've been asking rooms full of leaders all year. If OpenAI can't always see what its agents are doing, how confident are you about yours?
That used to be a philosophical question. This year, the insurance industry turned it into a financial one.
The Market Didn't Ban AI. It Started Pricing It.
Here's a simple way to understand what's happening with coverage right now.
Your homeowner's policy knows exactly what to do about a burglar. Someone breaks in and takes the TV, the policy responds. But leave the bathtub running and come home to a flooded first floor, and you're in murkier territory. No intruder. No break-in. Just your own house doing what you accidentally let it do.
Most cyber insurance is written for burglars. The policy language is built around an attacker and unauthorized access. When your own AI agent deletes the wrong records, changes a database, or approves a payment it shouldn't have, nobody broke in. And a policy written for break-ins may have nothing to say about the bathtub.
That's not me speculating. Risk analysts at ACA Group have been flagging exactly this gap, and the survey data backs them up. In Delinea's latest cyber insurance research, 42% of companies said their policies now specifically exclude AI misuse or liability.
The policy templates themselves are changing, too. ISO is the organization that writes the standard language most American business insurance is built on. Think of it as the master blueprint. In January, ISO published new endorsements that let insurers exclude claims arising from generative AI, and carriers started adopting them within weeks. A few have gone further and filed absolute AI exclusions, including on the professional liability policies that protect a business when its work harms a client.
I want to be careful here, because this is where the scary headlines overreach. None of this means your policy is void. It means the safety net you assumed was stretched under your AI might have a hole in it, and the only way to know is to look before you need it.
The Underwriters Just Did You a Favor
Here's the thing about insurance companies. When they start pricing a risk, they also tell you exactly how to shrink it.
Underwriters looking at AI exposure are asking for three things. A written inventory of the AI running in your business and what each system can touch. Evidence that you've actually tested those systems. And a clear answer to the question of which human is watching which machine.
An inventory. Testing. Oversight.
That's not red tape. That's just AI governance, and it's the homework most organizations skipped on the way to deployment. Doing it would have surfaced something else, too: the Shadow AI already flowing through your team. Roughly 90% of employees use personal AI accounts for work, whether their company has blessed it or not.
I've spent two years telling leaders that you can't ban your way out of that. Bans don't stop the behavior. They push it into the dark, onto personal accounts you can't see, secure, or supervise. The answer has always been amnesty and orchestration: find out what your people are really doing with AI, sanction what's valuable, govern what's risky, and build from there.
That first step, the finding out, is what I call Illuminate the Shadow, and it's where every Digital Crew I help build begins. You can't govern what you can't see. What changed this year is that the market agrees with me, and the market votes with premiums.
If You Run an Insurance Agency, Read This Part Twice
Most leaders feel this story once, as buyers. If you're in insurance, you feel it from both sides of the desk.
As a buyer, your own agency's E&O deserves the same scrutiny you'd give a client's policy. Those absolute exclusions are landing on professional liability lines, not just cyber.
As an advisor, your commercial clients are walking toward this blind. They're deploying AI right now. At renewal time, they're going to meet the exclusions. The principals and producers who can sit across from a client and explain what's covered, what isn't, and what good AI governance earns in better terms won't be the ones delivering bad news. They'll be the most valuable advisor that client has.
Your industry is underwriting AI risk, competing with AI-native startups, and deploying AI agents itself, all at the same time. There's no bleacher seat for this one.
Start With One AI Governance Document
So here's where the whole story lands. You can't ban your way out of Shadow AI. Now you can't insure your way around it either. The only path left is to govern it.
And I promise, governing it is smaller than it sounds. It starts with one honest document: a list of every AI system touching your business, sanctioned or shadow, and what each one can read, change, or send. That single page answers the underwriter, shows you your real exposure, and becomes the foundation for every agent you build on purpose from here on out.
Your team is already using AI. The market is already pricing whether you know about it. Getting those two facts into the same room is the work.
When you're ready to build that first inventory, the same one the underwriters are asking for, start with my Shadow AI guide. It's the first move in Illuminate the Shadow, and it's where every Digital Crew begins.
