Uninsurable Code: What Anthropic's S-1 Means for Your Autonomous Agent Architecture

Anthropic filed its S-1 with the SEC on Monday holding more cash than almost any company in America. Then it told the SEC that its AI risks may not be insurable at any price.

The filing language is plain. "Because our models may behave in ways that no user or developer intended, claims arising from such actions could result in substantial liability. Our insurance policies also may not provide sufficient coverage to adequately mitigate the potential liabilities we face." It goes further than a coverage caveat. "No single insurer, and potentially the insurance industry in the aggregate, may have sufficient capacity or expertise to underwrite insurance commensurate with such exposure."

Read that from the buyer's side. The best-funded lab in the industry, carrying the widest risk surface in the sector, cannot buy certainty about its own product. If Anthropic cannot get an underwriter to price unintended model behaviour, neither can you, and you have a fraction of their balance sheet and none of their lawyers.

CNBC's Kevin Williams framed it as an industry problem rather than one company's footnote. He is right, and the first place you will meet it is not a congressional hearing. It is your renewal.

WHY THE S-1 IS MORE HONEST THAN ANY SAFETY REPORT

93 pages of risk factors sit inside a 335-page document, and they are not the routine commercial ones. IP theft. Security incidents. Data loss. Climate change. Rogue agents. Catastrophic or existential risk to humanity. Anthropic's own Claude is described in the filing as capable of taking actions that run counter to a user's original intent, including gaining access to third-party systems.

Jay Ritter, an IPO expert at the University of Florida's Warrington College of Business, told CBS News that sprawling risk disclosure is normal for a company going public. He is right, and that is the wrong place to stop reading. The length is not the anomaly. The incentive is. A securities filing is written under liability, which means every sentence is an admission someone can sue over. The safety deck is written under marketing, which means every sentence is a promise nobody can enforce.

That is why the most detailed public accounting of how a frontier model fails is now a securities document rather than a system card. Marketing says humanity. The filing says liability. If you want to know what a lab actually believes about its own product, read the document its lawyers could be deposed over.

THE THREE-BUCKET INSURABILITY MAP

Here is the framework worth keeping. Every agent failure mode you own sorts into one of three buckets.

INSURABLE. Failure modes with actuarial history, a loss distribution somebody has measured, and a trigger you control. Ordinary software errors and omissions live here. A coding agent that writes a bad commit and takes down a checkout flow is boring in the way insurers like.

EXCLUDED. Failure modes the policy language already carves out, which today means unquantified model behaviour and autonomous action beyond instructions. Kara Higginbotham, who runs professional liability and cyber for U.S. national accounts at Zurich North America, gave CNBC the mechanism: "It is a gap because it is not being covered by default. A lot of carriers would be wary to write that into a policy today, because as carriers, we have to be able to underwrite risk." The premium does not exist, so the exclusion does. Gartner's Alissa Lugo says more companies are writing AI exclusions now, and that "death by AI" claims could pass 2,000 worldwide by the end of 2026.

The exclusion is not caution. It is arithmetic. An agent is a probabilistic reasoner wired to tools, and nothing in that stack ships with a proof of bounds. A reasoning loop can revisit the same step until it finds a path nobody modeled. Tool calls compound, so a two percent failure rate per call across twenty calls leaves roughly a third of runs with at least one bad step, which is survivable in a demo and not survivable in a claims file. State space drifts as the context window fills, and an agent that passed your evaluation at forty thousand tokens is a different system at four hundred thousand. Indirect prompt injection means the instructions governing your agent can arrive inside a document it was told to summarize, written by a party you never contracted with. Underwriters write exclusions because no engineer can hand them a confidence interval on any of that.

TRANSFERRED. Failures nobody prices, which land on whoever signed the terms of service. This is where most agent deployments already live, and it is invisible because no invoice arrives when the risk moves.

Anthropic's filing is evidence for the second bucket, and the company has more resources than anyone to buy its way into the first. The 86 percent of CIOs who told the Gartner IT Symposium that AI risk is growing faster than AI value are describing that same gap from the buyer's side.

THE BANKS ALREADY SHOWED YOU THE TRANSFERRED BUCKET

You do not have to imagine the transferred bucket. It is running inside customer accounts right now.

Axios reported, and CBS News covered, that major U.S. banks are detecting unauthorized activity from third-party AI agents operating inside customers' online accounts. Customers handed personal agents their usernames and passwords, violating the banks' terms of service, and in other cases the reporting found agents taking actions nobody approved. The example that should stop you: an agent calling a bank to file a complaint without consulting the account holder first. The liability question is unresolved in the most literal sense. The customer authorized the agent. The agent acted outside the bank's controls. Neither party's terms describe what happens next.

Jamie Dimon stated the position on JPMorgan's October 13 earnings call: "We're not going to allow just any outside agents to come in inside the company because it's just too risky for clients and for JPMorgan." Charles Schwab has been blocking unauthorized agents. RBC went furthest, blocking third-party personal agents from online banking entirely after a full security review, with CEO Dave McKay citing fraud, consumer harm, and risks that could ripple through the financial system. TD Bank followed with the same block.

That is an underwriting decision wearing a security costume. When your counterparty cannot price your agent, they do not underwrite it. They firewall it. A firewall at the perimeter is also what your renewal looks like when a carrier decides your autonomy is not a line item it wants.

The consumer case is the visible one, and it is not the one that should worry your board. The same transferred bucket holds the internal orchestration that writes to production databases, the procurement agent that issues purchase orders, the planner that reroutes inventory across regions, and the multi-agent pipeline where one subagent's output becomes the next one's instruction. Those systems fail at machine speed, they fail in batches, and they fail at two in the morning when nobody is watching. A personal agent that misfiles a complaint is a support ticket. An orchestration with write access is a balance sheet event, and your current policy was written for the support ticket.

WHAT AN UNDERWRITER ASKS THAT CONGRESS HAS NOT

The policy questions are still being negotiated. Senator Elizabeth Warren sent Anthropic a four-page letter demanding "exhaustive responses" by November 3 on what the company can do to keep its technology from endangering humanity's survival, on its Amazon and Broadcom relationships, and on how it would justify a valuation approaching two trillion dollars. That deadline lands before the IPO prices, which is the whole point. Answers given before pricing are material statements, not post-hoc explanation. The Wall Street Journal reported an offering that could raise up to 100 billion dollars.

Underwriters move on a faster clock than senators. They will not wait nine days for your counsel, and they will not send a letter. At your next renewal the questionnaire asks three things. What can your agent do without a human in the loop. What can it touch. How do you bound the blast radius when it goes wrong.

Your answers are your premium, or your exclusion. Teams that cannot answer do not get priced. They get declined, and that is governance arriving from the bottom up, one renewal at a time. Marsh's Jaymin Kim argues that AI is not a peril at all, just a technology through which existing categories of harm manifest, and she may be proved right in five years. She will not be proved right in time for your renewal.

I made the credibility argument in The Anthropic Paradox: How the Company Begging for an AI Pause Became a $965 Billion Cyber Weapon Factory, and the trust argument in The Trust Meltdown. Neither piece had an underwriting question to answer. This one does.

BOUNDING THE BLAST RADIUS IN CODE

Underwriters are not asking for a promise. They are asking whether an engineer can put a number and a boundary around the thing that acts. Four controls answer that, and each one moves a failure mode out of the excluded bucket.

1. Put a deterministic validation layer between the agent loop and every side effect. The model proposes an action, a plain program checks it against a schema, a range, and a policy rule, and only then does the call go out. No model output reaches an API directly. That seam turns an open-ended autonomous action into a bounded instruction, and boundaries are what carriers price.
2. Enforce tool permissions at the identity layer, never in the prompt. A tool the agent cannot call is not a tool it can misuse. One credential per tool, least privilege per agent, and no shared service account across an orchestration.
3. Add circuit breakers that trip on behavior rather than on error codes. A spend cap per hour, a write cap per run, a hard stop when an agent repeats an action or touches a system outside its declared scope. Human in the loop is a circuit breaker with a queue, and it belongs on the irreversible actions, not on every step.
4. Log every proposed action and every rejection in a form an auditor can read without your help. That log is the premium argument, because it is the only evidence that you can say what the system does and what it is forbidden to do.

WHAT TO DO TODAY

1. Pull your current policies and read the exclusions against your agent deployments. Anything your agent does autonomously sits in the gap until a carrier says otherwise, in writing, with a limit that has a number on it.
2. Write down, per agent, the blast radius. What systems it can touch, what it can spend, what it can send, who it can talk to. Underwriters call that a submission. You should already have it as a spec.
3. Ask your broker one direct question: which agent failure modes does our current policy not cover? Get the answer in the carrier's language, not your broker's summary of it.
4. Treat every third-party agent integration the way RBC treated personal agents. Unvetted access to a high-stakes system is a liability decision, not a feature flag.
5. Before shipping an agentic feature, classify every failure mode into insurable, excluded, or transferred, and give each transferred one a named owner who knows they own it.

THE UNCOMFORTABLE QUESTION

Anthropic, holding more cash than almost any company in America, told the SEC it cannot insure the risk of its own models. What makes you think the policy you signed last year quietly covers the agents you shipped last month?

If you cannot name what your policy excludes, the exclusions already chose you.