The threat

Anthropic has demonstrated a self-replicating AI programme, an 'AI worm', which is capable of spreading autonomously across internet-connected devices (IoT). In testing, the team ran a large AI model distributed across 15 cheap Android TV boxes, each hosting a slice of the model. The system was slow, but functional. Critically, the worm improved as it spread: when copies passed 'notes' to successors, setup success rates rose from 45% in the first generation to between 61% and 84% in later ones. Anthropic concludes that full self-replication capability across consumer devices is feasible by the end of 2026.

What makes AI worms structurally different from traditional malware is that there is no 'off switch.' A model distributed across millions of poorly secured IoT devices such as smart televisions, ovens, fridges would require individual, device-by-device, remediation. 

Why this is an underwriting problem

1. Existing policy triggers may not respond

Many cyber policies are triggered by a recognisable breach event: unauthorised access, data compromise, or funds transfer fraud. Depending on the language, where agentic AI systems operating within an insured's own environment cause loss by deleting records, authorising errant payments, the absence of an external attacker or conventional breach may mean the policy does not respond.  

2. Aggregation exposure is material and unmodelled

The global AI supply chain is highly concentrated as there are a handful of AI model providers. A worm propagating across millions of devices before detection could trigger simultaneous business interruption claims across an entire book. Current catastrophe models were not designed to absorb this.

Key underwriting considerations

Policy language: Do coverage triggers respond to AI worm scenarios, and are exclusions drafted with sufficient precision? 

AI worms are expected to exploit unpatched IoT vulnerabilities. 'Known vulnerability' exclusions may exist in cyber insurance policies and operate to deny coverage for claims or losses resulting from security flaws that were publicly documented or patchable before the incident occurred. Such exclusions often do not require an insured to have actual knowledge of the vulnerability but turn on a threat actor exploiting a known flaw that the policyholder failed to remediate within a specified timeframe. However, precisely because these next-generation AI worms can adaptively discover, combine, and exploit completely different localised flaws in real time, 'known vulnerability' clauses may be rendered ineffective.

Further, AI worms exploit complex paths of multiple misconfigurations across multiple IoT items which historically may have been perceived as low risk. Some issues in that pathway may have patches whilst others may not. How 'known vulnerability' exclusions would apply in such scenarios may well be less clear cut.   

Furthermore, IoTs are patched infrequently. Where there is no appetite to cover such exposures, migrating away from exclusions predicated upon 'unpatched software' scenarios towards stricter 'Failure to Maintain Minimum Security Standards' clauses might be an option.

IoT exposure requires dedicated assessment

Insurers may wish to consider enhanced underwriting around the extent of an insured’s IoT exposure. For example, does the insured maintain an IoT device inventory? Does the insured know what is on its network? How frequently are they patched?