Harbor Wants to Insure AI Agents. The Loss Triangle Doesn't Exist Yet.

The first thing I did when Harbor's announcement crossed my desk was look for the loss triangle. Not the funding round. Not the four-step methodology. The loss triangle — paid claims, incurred-but-not-reported reserves, the frequency-severity table every carrier on earth builds before it quotes a single premium.

There isn't one. There can't be. The exposure class is roughly eighteen months old and the product launched with zero claims history.

Harbor exited stealth with $10 million in seed capital and a promise to cover the failure modes of autonomous AI agents — hallucinations, operational errors, intellectual property infringement — at limits of $15 million to $25 million per institution. The announcement arrived wrapped in a European Central Bank supervisory letter, numbered SSM-2026-0301, with an October 31 compliance deadline attached to it.

The letter is the tell. So is the date printed on it. The ISO endorsement forms Harbor cites — CG 40 47, CG 40 48, CG 35 08, the generative-AI exclusions every commercial general liability carrier has been circulating — were already moving through state filing queues in the second half of 2025. Munich Re's aiSure, Armilla AI, and Cequence Agent Trust were all publicly operating that same year. The document says 2026. The paper trail says 2025. The ledger remembers what the code tries to hide.

That discrepancy matters less as a fact-check and more as a diagnostic. A company selling risk quantification should be able to quantify its own timeline.

What Harbor Actually Sells

Strip the insurance framing and Harbor is not an insurance company. It is an AI agent governance stack with an underwriting layer bolted on the end.

The four-step method runs: inventory the agents, assess their risk, deploy runtime controls, then underwrite what remains. Steps one through three are software and consulting. Only step four touches capital.

Step one — agent discovery, the AI-BOM, finding shadow agents nobody registered — is at proof-of-concept maturity. There is no standard protocol for it. You rely on API gateways, SDK instrumentation, or cloud provider telemetry. Cross-environment coverage across SaaS agents, self-hosted agents, and third-party agents you don't control is an unsolved enumeration problem. You cannot underwrite what you cannot list.

Step two — risk assessment mapped to NIST AI RMF and the EU AI Act — is at framework maturity. Both are voluntary, qualitative documents. Mapping a control to a clause is compliance theater until the output can be converted into a loss probability. It cannot be, not yet.

Step three — runtime guardrails, permission boundaries, human-in-the-loop checkpoints — is in early production. NeMo Guardrails, Lakera, Protect AI all ship working product. False positive and false negative rates remain high, and detection of reasoning failures rather than output failures is weak.

Step four — actuarial pricing — does not exist as a discipline for this class.

The Trilemma Nobody Wants to Say Out Loud

Insurance pricing requires three properties from a loss distribution: observability, stationarity, and independence. AI agent failure violates all three, and the third violation is fatal.

Observability is compromised by attribution lag. An agent that produces a wrong answer has not generated a claims event until a human acts on it, a counterparty relies on it, or a regulator notices. The gap between failure and loss can run for months. Compare that to a cyber incident, where the intrusion is timestamped at the packet level.

Stationarity is compromised by the update cycle. The model version changes weekly. The prompt chain changes more often. Tool permissions drift as teams ship features. The distribution you priced in January is not the distribution you are exposed to in June. If the underlying process is non-stationary, a historical loss run is a description of a system that no longer exists.

Independence is where the model breaks completely. Insurance works because a thousand houses do not catch fire from the same spark. AI agents fail in synchrony. The same model version, the same orchestration framework, the same cloud region, the same data vendor, the same oracle feed. One upstream defect propagates to every deployment at once.

I have watched this happen at close range. In 2025 I led a team stress-testing an AI agent's execution logic before it went anywhere near our book, and the vulnerability we found was not stochastic — it was a flash loan pathway that triggered deterministically whenever the mempool state matched a specific signature. We patched it, wrapped the agent in rule-based safety filters, and shipped a hybrid that combined model speed with hard constraints. That system cleared $200,000 in monthly alpha. But the lesson from the audit was not that agents are unsafe. The lesson was that their failures are reproducible. Reproducible failures do not diversify. Ten agents running the same model against the same oracle fail in the same block, and the pool does not spread that risk — it warehouses one bet a thousand times and calls it a portfolio.

The law of large numbers does not apply to correlated systems. That is not a marketing problem. It is a solvency problem.

Monitoring Is Not Pricing

Harbor's public position leans on real-time risk management. Continuous telemetry, live controls, dynamic exposure tracking. All of that is real and all of it is useful.

It is also not actuarial science.

Monitoring answers the question: what is happening now. Pricing answers the question: what is the expected value of future losses across a defined population over a defined term. Those are different disciplines requiring different data. Telemetry tells you a guardrail fired 4,000 times last quarter. It does not tell you the probability that a fired guardrail becomes a paid claim, because you have no paid claims to calibrate against.

I trade the gap between expectation and execution. Right now that gap is the entire product.

There is a structural dependency buried here too. Harbor's measurement capability depends on the observability vendors underneath it — Cequence, Lakera, the guardrail layer. The raw telemetry is not Harbor's. Positioning yourself as the insurance layer after the detection layer is an honest description of the value chain, but it also means the data flywheel belongs to someone else. A moat built on rented pipes is not a moat.

The One Genuinely Good Design

The control-linked payout is the most professional thing in the entire offering.

Binding coverage to verified technical controls — audit logging, least privilege, human-in-the-loop gates — mirrors what cyber insurance did with multi-factor authentication and endpoint detection. It aligns incentives, suppresses moral hazard, and forces baseline hygiene before a policy attaches. It is also, historically, the fastest standard-setting mechanism the market has ever produced. Cyber underwriting requirements moved enterprise security baselines faster than any legislature managed in the same period.

Expect the same here. The AI liability underwriting questionnaire will become the de facto agent deployment standard, finer-grained and faster-updating than the EU AI Act's high-risk obligations. That transmission mechanism — insurance as regulation — is Harbor's most underrated contribution, whether or not the company survives.

But the coupling has a cost. Warranty conditions generate disputes. The more precisely you define what the insured must have done, the more surface area you create for a denial. One flagship refusal to pay in year one, publicized, and the book is finished. Control-linked coverage is a two-edged instrument.

The Capital Math and the Category Error

Ten million in seed capital cannot support meaningful AI liability underwriting. At conventional premium-to-capital leverage of one to three or one to five, depending on jurisdiction, that capital backs $30 million to $50 million of gross written premium at most. A single tier-one bank's agentic exposure can run into nine figures.

So Harbor is almost certainly a managing general agent with a fronting carrier and a reinsurance cession behind it. The phrase "underwriting residual risk with our own capital" in a professional context implies exactly that structure. Harbor has not named the fronting carrier. That is the single most important undisclosed fact in the announcement.

Meanwhile, several outlets have run the comparison between Harbor's $15 million to $25 million limit and the industry's "billions in aggregate AI exposure." That comparison is a category error. The first number is a single limit — the maximum payable on one risk. The second is aggregate systemic exposure. Comparing them is like measuring one mortgage's collateral against total banking system credit. They are not the same unit and the arithmetic proves nothing.

But the category error conceals a real question. Nobody has published the aggregate limit. Not the per-policy limit. The total capacity across the whole book. That number determines whether this is insurance or a pilot program, and it is missing.

The Blind Spot: Indemnity Above You

The competitive threat nobody in this narrative is addressing is model provider indemnity.

Microsoft, Google, and OpenAI already offer enterprise customers contractual indemnification for copyright claims and certain safety failures on their commercial tiers. If the model provider absorbs the tail, Harbor is insuring the residual — and nobody has drawn the boundary line between provider indemnity and third-party agent insurance. That boundary determines the entire addressable market. If it sits high, Harbor's product is a niche top-up. If it sits low, Harbor has a business.

Second blind spot: adverse selection. The buyer most eager to purchase agent liability coverage is the one who granted the agent the widest permissions and the loosest guardrails. Premiums get set against average risk. The pool fills with the tail. Every insurer learns this lesson expensively, and the AI version will be worse because permission scope is invisible from the outside.

Third: captives. A large bank does not buy a $20 million policy from a seed-stage MGA. It stands up a captive insurer, funds it, and books the reserve as regulatory capital. Harbor's best customers have a cheaper, tax-advantaged alternative that also keeps the risk data in-house. The named design partners — StackAI, HappyRobot, Crossmint — are early-stage companies with limited premium capacity. Crossmint is the revealing one: agent payments means agents that move money, which is precisely the heaviest-tailed scenario in the catalog and the one least compatible with a $10 million balance sheet.

What to Watch

Five disclosures, in order of importance. The fronting carrier's name and rating. The warranty conditions verbatim. The aggregate limit, not the single limit. The first paid claim with a loss run attached — not the first denial. And the date on SSM-2026-0301, because a supervisory letter from a year that has not happened is a document worth reading twice.

For anyone running an agent with wallet access, the practical takeaway is simpler. The underwriting questionnaire is your new security baseline. Read it before your auditor does, because it will arrive with premium consequences attached while the regulator is still drafting guidance.

Uptime is a promise; downtime is the truth. Trust the math, verify the chain, ignore the hype.