Insurance: red-teaming claims and underwriting agents.
End-to-end agentic claims. Parametric underwriting. Life and health risk-rating.
Carriers are deploying agents that read first-notice-of-loss narratives, classify damage photos, price life and health policies, and trigger payouts. Every one of those steps is a regulated decision and an attacker-reachable input. AgentGuardian fingerprints the agent, runs the 96-probe corpus across all ten OWASP ASI 2026 categories, and produces a signed evidence pack a chief actuary or a market-conduct examiner can read.
Three agent shapes, one regulated blast radius.
The agentic-AI buildout inside insurance carriers is converging on three shapes, and each one creates a different category of regulatory exposure. The shared property is that the agent is making a decision that the insurance code treats as a regulated decision, often with a fiduciary or anti-discrimination overlay, and that the decision is now reachable by a third-party input.
The chief actuary signs the rate filing. The chief underwriting officer signs the risk appetite. Neither of them signed for an LLM that can be talked out of a denial by a sentence in a PDF.
Three probes that matter most for an insurance agent.
The 96-probe corpus is sharded across all ten OWASP ASI 2026 categories on every scan. For an insurance carrier, three probe clusters are load-bearing. Each one corresponds to a known agent shape, a known regulatory anchor, and a known revenue-or-loss event the carrier will be asked to defend.
Probe prompt injection in claims free-text and multimodal evidence.
End-to-end agentic claims systems read first-notice-of-loss narratives, scanned police reports, repair-shop invoices, and damage photos. Every one of those channels is an attacker-controlled input the moment a third party can populate it. AgentGuardian shards ASI01 (Goal Hijack) and ASI09 (Trust Exploitation) probes against the intake agent — including indirect injection through tool outputs and PDF text layers — and adds vision-channel payloads against any LLM that reads photographs of damage.
Probe goal-drift and proxy discrimination in pricing agents.
Life, health, and parametric underwriting agents are the regulator's first concern. They are EU AI Act Annex III high-risk by default. Colorado SB21-169 and the NAIC Model Bulletin on the Use of AI Systems by Insurers both require carriers to demonstrate that the agent has not learned to use forbidden proxies — ZIP code, surname, brand of car — as substitutes for prohibited attributes. AgentGuardian runs ASI10 (Rogue Agents / Drift) probes that hold the protected attribute constant while perturbing the proxy, and surfaces every quote-delta that exceeds a configurable threshold.
Probe tool misuse and A2A compromise on the payout path.
The blast radius of a compromised claims agent is a wire transfer. ASI02 (Tool Misuse), ASI03 (Privilege Compromise), and ASI07 (Agent-to-Agent Compromise) probes target the adjudication-to-payout handoff — the moment the claims agent calls into the payments service, the reinsurance ledger, or the fraud-screening agent. AgentGuardian replays signed A2A messages, attempts cross-tenant reads against the policyholder graph, and exercises tool-argument injection against every payment-rail tool the agent can reach.
Where the examiner will start.
Carriers asking AgentGuardian about agent governance typically have a regulator-facing trigger: an upcoming market-conduct examination, a Senior-Manager-accountability filing, an Annex III technical-documentation request, or a board-level demand for an answer the chief risk officer can defend. Below are the frameworks that examiners and counsel cite most in 2026.
The NAIC Model Bulletin gives every state insurance commissioner market-conduct examination authority over the carrier's use of AI systems. The carrier's burden is to produce evidence — not to assert that the agent is safe.
What the chief actuary and the chief underwriting officer are actually asked.
Two role-shaped briefings AgentGuardian was built to support. Both are framed in language a board committee or a market-conduct examiner uses, not in vendor-marketing language.
On the rate-filing question: has the agent learned a forbidden proxy?
The deterministic AIVSS score lets the actuarial team treat the agent the way any other model is treated under the carrier's model-risk policy. The ASI10 goal-drift probes hold the protected-class attribute constant and perturb the proxy. Any quote-delta beyond the configured threshold is flagged with a probe transcript and an AIVSS-weighted severity. That is the evidence the rate-filing memo can cite — and the evidence the actuary can hand to a market-conduct examiner without having to first translate it from prompt-engineering language.
- —Reproducible AIVSS score on every probe run
- —ASI10 drift probes parameterised by proxy variable
- —Quote-delta table per protected attribute
- —Probe transcripts in the SARIF and PDF outputs
On the claims-leakage question: can the agent be talked out of a denial?
Claims leakage from a manipulated free-text narrative or an adversarial damage photo is a P&L line, not a research curiosity. ASI01 (Goal Hijack) probes with the PAP mutator family — once it ships in the OSS corpus — and the in-tree control-character and encoding mutators today, exercise every reachable indirect-injection channel. The output is a per-probe transcript with the exact payload, the agent's resulting tool calls, and the reserve or payout delta the agent attempted. That number, multiplied by claim volume, is the leakage exposure the CUO is being asked about in the quarterly business review.
- —Indirect injection probes for FNOL, PDF, photo, third-party data
- —Per-probe payload, tool call, and reserve-or-payout delta
- —Multimodal vision-channel coverage on damage photos
- —T1 tier — tools, memory, PII reachable
A bundle a market-conduct examiner can read.
Every scan produces five artefacts: SARIF 2.1.0, PDF, HTML, JSON, and an evidence directory. Each finding carries an OWASP ASI 2026 category, a MITRE ATLAS v5.4.0 technique, a CSA Agentic-RT category, and a deterministic 0-100 AIVSS score. The bundle is SHA-256 signed and reproducible from the corpus version stamp.
- Probe transcripts per ASI category
- AIVSS score and severity table
- MITRE ATLAS v5.4.0 technique IDs
- CSA Agentic-RT category mapping
- Quote-delta table for proxy probes
- Multimodal injection samples
- Tool-call audit per finding
- SHA-256 signed bundle
Carrier-XL · Claims Agent · Q2 2026 scan
target=langgraph · adapter=http · tier=T1 · mode=full · probes=96
Questions insurance teams ask first.
Does AgentGuardian model the EU AI Act high-risk obligations for life and health pricing?
How do the goal-drift probes show proxy discrimination without seeing protected attributes?
What does the multimodal injection probe actually do?
Can AgentGuardian run against a claims agent that we do not own?
Does this replace our actuarial model-risk programme?
Move from agent pilots to filed and examined.
Book a carrier-shaped assessment. We will run AgentGuardian against your claims or underwriting agent and walk the chief actuary, the CUO, and the CRO through the evidence bundle.