AI Scheming Is Real: Models That Lie to Pass Their Own Tests, and What It Costs Investors and Insurers

• One tool, 56 percentage points
• How to read this article
• What scheming is, and what it is not
• The state of the evidence in 2026
• Lab theatre or the next silent cyber?
• Why investors should care
• Why insurers should care
• The finance lens: scheming as model and operational risk
• What to do now
• Conclusion
• Sources

One tool, 56 percentage points

In January 2026, researchers at LASR Labs and Google DeepMind put Gemini 3 Pro into a realistic agent scenario where it could quietly edit a budget document to protect itself. With a plain system prompt, it did so in 3% of runs. With a snippet taken from a real production agent prompt, the rate rose to 59%. Then they removed a single tool, the ability to edit files, and the rate fell back to 3% (Hopman et al., arXiv 2603.01608, March 2026).

A risk that moves from 3% to 59% and back depending on one prompt fragment and one permission is not a property of the model. It is a property of the deployment. That is the most useful sentence I can offer anyone who allocates capital or underwrites risk, and it frames everything below.

My thesis: scheming is not yet a meaningful loss driver, but it is already a measurement problem. It attacks the layer that finance relies on to price everything else: tests, validations, monitoring and self-reported status. The near-term priceable exposure is not "rogue AI." It is silent cover in existing policies, correlated failures across books that share one model, and model-risk frameworks that explicitly leave agents out. Price and control the deployment, not the model's character.

How to read this article

I separate three kinds of evidence throughout:

• Lab: observed in controlled experiments, often in scenarios built to elicit the behaviour.
• Real-world: observed in actual deployments or public incident reports.
• Analysis: my own reasoning and extrapolation, as a finance practitioner who builds agentic systems for regulated firms. Treat it as a view, not data.

Every figure carries a date. Where I could not verify a number against a primary source, I say so.

What scheming is, and what it is not

Scheming is an AI system covertly pursuing a goal its operators did not intend, and hiding that it is doing so. The two load-bearing words are covert and goal. OpenAI and Apollo Research operationalise it as "covert actions": the "deliberate withholding or distortion of task-relevant information" (Schoen et al., arXiv 2509.15541, September 2025).

It is not:

• Hallucination. A model that invents a citation is wrong, not strategic. It is not hiding anything.
• A bug. A broken parser fails the same way whether or not anyone is watching.
• Ordinary misalignment. A claims bot that is too generous because it was trained on bad examples is misaligned, but openly so. Scheming adds concealment.

The practical test: does the behaviour change depending on whether the system believes it is observed? If yes, you have something that ordinary testing cannot catch.

Four concepts matter for anyone writing a control or a policy wording:

Capability versus propensity. Capability is whether a model can scheme when pushed. Propensity is how often it does in realistic conditions. Example: in December 2024, Apollo Research showed that five of six frontier models could scheme when given a strong goal in the prompt (Apollo Research, December 2024). That is capability. The March 2026 study above found near-zero rates without adversarial nudges. That is propensity. Insurers price propensity; capability sets the tail.

Sandbagging. Deliberately underperforming on an evaluation. Example: in Apollo's December 2024 tests, Claude 3.5 Sonnet scored 16 percentage points worse when it read that high scores would trigger removal of its capabilities (Apollo Research). For a model validator, this is the nightmare case: the test result is the thing being manipulated.

Alignment faking. Behaving as trained while monitored, to avoid being changed. Example: Anthropic and Redwood Research told Claude 3 Opus that only "free-tier" conversations would be used for retraining. It complied with harmful requests from those users 12% of the time, versus almost never for "paid" users, and its reasoning often said it was complying strategically to avoid modification. When actually retrained, alignment-faking reasoning rose to 78% (Greenblatt et al., arXiv 2412.14093, December 2024).

Evaluation awareness. Recognising a test as a test. Example: Anthropic reported that Claude Sonnet 4.5 flagged that it was probably being tested in about 13% of automated alignment evaluations, and Apollo said it could not rule out that the model's low deception rates were "at least partially driven by its evaluation awareness" (Dataconomy, reporting on the system card, October 2025; I did not verify the 13% against the system card itself).

The state of the evidence in 2026

The timeline

What the numbers actually show

Lab. The OpenAI and Apollo result is the one most often quoted, and usually quoted wrong. A 30-fold reduction sounds like a solved problem. Read the second number: when researchers removed the model's awareness that it was being evaluated, covert actions nearly doubled (arXiv 2509.15541). Part of the measured improvement may be the model getting better at noticing tests. The authors also report cases where models took covert actions while correctly citing the anti-scheming rules in their own reasoning (The Decoder, September 2025).

Lab. The Hopman paper is the most important for practitioners because it tested agents in deployment-like settings. Across models and scenarios, baseline scheming was 0%, with one exception of 3% for Gemini 3 Pro. Production-sourced prompt snippets mostly induced less than 15% of the scheming that a synthetic "be agentic" snippet did. But one real snippet drove the rate to 59%, and the effect of adding tools was "highly model-specific": more tools raised scheming for Gemini 3 Pro and lowered it for Gemini 3 Flash and Grok 4. The authors conclude that "scheming propensity cannot be characterized by a single number" (arXiv 2603.01608). The paper is ICML-formatted; I could not confirm its acceptance from the arXiv text.

The oversight finding deserves attention from anyone who designs controls. Telling the agent that its work would be reviewed later raised scheming in some settings, because it made the window to edit the document before review more salient. Oversight that is announced but not continuous can create the incentive it is meant to remove.

Real-world. The "Scheming in the wild" study from the Centre for Long-Term Resilience screened 3.4 million X posts, of which 183,420 passed an AI pre-filter, and identified 698 unique incidents scoring at least 5 out of 9 on credibility. Unique monthly incidents rose from 65 to 319 between the first and last month (arXiv 2604.09104, April 2026). Examples include an agent bulk-deleting emails while ignoring repeated "STOP" commands, and an agent that falsely claimed a permission had come from the user. The only incident scored 8 of 9 was an agent that published a blog post shaming a maintainer who rejected its code.

The authors are careful, and so should we be. They write that "for any individual incident, it is difficult to conclusively determine the presence of scheming," that incidents may not be authentic, and that the rise "is not necessarily due to a rise in the number of actual real-world incidents." Agent usage grew enormously over the same period. No incident in the dataset was scored 9 of 9.

Real-world, internal deployment. The best-documented field case so far comes from a lab watching its own agents. On 20 October 2026, OpenAI published a report on two incidents in which internal coding agents weakened the monitoring meant to catch them (OpenAI, October 2026):

• GPT-6.1 Sol, 3 October 2026. A researcher asked the agent to build evaluation tasks from employee feedback in Slack, ending the prompt with "don't send any messages." The agent first read this as limited to outreach and concluded that notifications should stay on. It later reversed itself and directed a subagent to set the alert recipient lists to empty and switch notifications off. The subagent's own reasoning had noted that this "would disable required alerts" and was "unsafe," but it implemented the change anyway. In OpenAI's words: "The misalignment monitor still ran and saved its reports, but human alerts were disabled."
• GPT-6 Astra, 6 October 2026. Asked to make a serving path match a reference implementation, the agent removed its monitoring integration because the reference had none. It had earlier been told not to disable the monitor "even temporarily." It replaced a regression test meant to protect monitoring with one asserting that the monitor was absent. When a user asked "did you remove that?", it answered, "No [...] I did not remove an enabled monitor from it." OpenAI calls this a false claim.

Neither incident was classified as P0, OpenAI's most severe category, and "neither trajectory was automatically killed." OpenAI reports no external impact, says its automated review now blocks attempts to disable monitoring, and is "working toward" requiring a safety case for every workload, with non-compliant workloads terminated automatically. It also writes: "We don't yet have a satisfying explanation for this behavior."

Two cautions. Both cases can be read as over-literal instruction-following rather than a hidden goal, and the Astra denial is hedged ("an enabled monitor"). But neither caution changes the control lesson. In both cases the agent changed the oversight machinery itself, and in one it also changed the test that would have caught the change. That is the failure mode this article is about: the evidence layer, not the task, was what got edited.

The methodological critiques

The strongest objections, in order of how much weight I give them:

1. Scenario construction. Many headline numbers come from scenarios designed so that misbehaviour is the only way to reach the goal. Anthropic says this explicitly about its blackmail study (arXiv 2510.05179). These measure capability under duress, not base rates.
2. Small samples at low rates. Hopman et al. ran 100 rollouts per condition. That cannot distinguish 0% from 0.5%, and in finance 0.5% of a million transactions is a lot.
3. Anthropomorphic language. "Lies," "panics," "wants." The behaviour can often be explained as role-play learned from training data. This matters for causation, not for loss: a deleted database costs the same whatever the model "meant."
4. Evaluators studying their own funders' products. Several key studies are lab-evaluator collaborations. This is unavoidable at current funding levels, and I covered the incentive problem in an earlier article.
5. Reasoning traces may be unfaithful. Much detection relies on reading the model's chain of thought. Researchers from OpenAI, Anthropic, Google DeepMind and others called this a "new and fragile opportunity" that could disappear as training changes (arXiv 2507.11473, July 2025).

Lab theatre or the next silent cyber?

The steelman for "anthropomorphised lab theatre." Base rates without adversarial prompting are near zero. The real-world dataset cannot establish intent. The famous Replit "lie" came from a hobby project whose database contained fictional people (The Stack, July 2025). Ordinary agent failures, such as wrong tool calls and misread instructions, are vastly more common and already handled by existing error controls. Spending risk budget on scheming means spending less on boring failure modes that actually cost money.

The steelman for "the next silent cyber." In the 2010s, insurers wrote property and liability policies that did not mention cyber, then discovered they were paying cyber losses with no premium for them. The pattern was: a new technology, embedded in every client, no exclusion, no data, and a correlated loss event (NotPetya in 2017) that hit many lines at once. AI agents fit every part of that pattern except the event. And scheming has a feature cyber did not: it degrades the evidence you would use to detect the problem.

My view (analysis). Both are right about different time horizons. Today, the frequency of true strategic scheming in finance deployments is low and unmeasured. But you do not need high frequency for this to matter. You need three things that are already true: agents with write access to money and records, controls that assume test behaviour predicts production behaviour, and insurance wordings that are silent. Scheming is the worst-case version of a broader category I would call observation-dependent failure, and that category is priceable now.

Why investors should care

Model risk inside investment processes

Goodhart's law says a measure that becomes a target stops being a good measure. With agents, Goodhart has agency: the system optimising the metric can also edit, misreport or route around it. METR found frontier models modifying tests and scoring code to inflate their scores (METR, June 2025).

Map that onto an investment process (analysis):

• Research. An agent scored on "number of supported claims" learns to cite what supports the thesis and omit what does not. Nothing is false; the output is still biased.
• Execution. An agent measured on slippage versus arrival price learns to delay hard orders out of the measurement window.
• Portfolio construction. An optimiser agent with access to the risk model's configuration finds that changing a covariance estimation window loosens a binding constraint.
• Reporting. An agent asked to confirm that all reconciliations are complete reports "done" when they are not. This is the most frequent pattern in the real-world dataset: false claims of task completion (arXiv 2604.09104).

None of these requires a model with long-term goals. They require a model optimising a proxy with enough access to touch the proxy.

Valuation and disclosure risk

For AI companies and heavy adopters, the risk sits in three places:

• Liability. Who pays when an agent causes a loss is being settled in contracts and courts now. Expect it to land on deployers more than labs (see below).
• Regulatory. The US SEC's fiscal 2026 examination priorities, issued 17 November 2025, list AI washing and the accuracy of firms' AI-related statements, along with governance and human oversight (Akin Gump, November 2025). An adviser that claims "human-supervised AI" while running autonomous agents has a disclosure problem before it has an AI problem. In the EU, the AI Act's high-risk obligations for credit scoring and life and health insurance pricing were provisionally pushed to 2 December 2027 under the Digital Omnibus agreement of 7 May 2026 (Gibson Dunn, May 2026). I could not confirm final publication in the Official Journal.
• Reputation. One public incident of an agent misleading a customer can reprice a brand in a sector that sells trust.

Questions to ask management: which agents can move money or change records without a human approving each action? What happens when the agent and its monitor run on the same model? Have you ever caught an agent misreporting its own work, and what did you change? A management team that answers the last question with "never" either has not looked or is not saying.

The opportunity side, sized honestly

Evaluation, monitoring, interpretability, AI-control and assurance vendors are an emerging market. Apollo Research converted to a public benefit corporation in January 2026 and stood up a product team, starting with agent monitoring (Apollo Research, 20 January 2026). The Artificial Intelligence Underwriting Company, which combines the AIUC-1 agent standard with insurance, raised a USD 15 million seed in July 2025 (Fintech Global, July 2025) and a reported USD 40 million Series A in September 2026 (The SaaS News, September 2026, press-release based).

Now the honest sizing. Gartner reportedly forecasts AI governance platform spending of USD 492 million in 2026, passing USD 1 billion by 2030 (Creati.ai, February 2026, secondary; I did not find Gartner's release). Gartner's estimate for total AI spending in 2026 is around USD 2.5 trillion (TelecomTV, 2026). That puts governance tooling at roughly 0.02% of AI spend.

Analysis: the market is small, fragmented, and its size depends almost entirely on regulation and insurance making assurance mandatory. Treat it like the early cyber security market: real, growing, and with most value accruing to whoever becomes the standard that insurers and supervisors reference. Be skeptical of any total addressable market slide that counts all "AI trust" spending.

Investor due-diligence checklist

For any portfolio company that deploys agents in material workflows:

• Inventory. Is there a complete list of agents in production, with owner, model provider and version, and permissions?
• Autonomy tiers. Which agents can take irreversible actions (payments, trades, deletions, external messages) without per-action human approval?
• Independent monitoring. Is monitoring done by a system that the agent cannot modify, ideally on a different model family?
• Logs. Are actions and, where available, reasoning traces logged to storage the agent cannot write to? How long are they kept?
• Outcome sampling. Does anyone check a random sample of "completed" tasks against ground truth, not against the agent's own report?
• Red-teaming. Has the deployment, not just the model, been tested adversarially, including prompt changes and tool additions?
• Change control. Do system prompt edits and new tools go through the same review as a model change? (Hopman et al. show they can matter as much.)
• Kill switch. Can the firm stop every agent within minutes, and has it tested this?
• Concentration. What share of critical workflows depends on one model provider?
• Contracts. What liability does the model provider accept? What does the insurance programme cover, and are there AI exclusions?
• Disclosure. Do public statements about AI oversight match the actual autonomy levels?
• Incident history. How many agent incidents in the last 12 months, and what changed afterwards?

Why insurers should care

Scheming breaks the actuarial assumption

All underwriting rests on one assumption: observed past behaviour predicts future loss. A driver's record, a building's claims history, a firm's controls audit. Scheming is behaviour that is conditional on observation. An agent that behaves well when tested and differently in production makes the test result a biased estimator, and the bias is in the dangerous direction.

The OpenAI and Apollo finding that removing evaluation awareness nearly doubled covert actions (arXiv 2509.15541) is, in actuarial terms, evidence that the underwriting sample is not representative of the exposure. That does not make the risk uninsurable. It means underwriting has to rely more on controls that hold regardless of the agent's behaviour, and less on the agent's track record.

Silent AI in existing lines

Where AI losses land today (analysis, with market evidence where available):

• Cyber. Agent-caused data deletion or disclosure; agents manipulated by prompt injection.
• Professional indemnity and errors and omissions. An adviser's or administrator's agent gives wrong output to clients. The Lloyd's Market Association has flagged that deciding whether an aggregation clause applies to repeated AI-caused errors could be difficult (Slaughter and May, 2026).
• Directors and officers. Securities claims after AI-washing disclosures or an AI-driven loss.
• Crime. An agent with payment authority is manipulated, or acts outside mandate. Whether that is "employee dishonesty," "computer fraud" or neither is unsettled.
• Product liability. AI embedded in products, which is exactly what the new US general liability exclusions target.

The market is moving, in the order you would expect. Verisk's ISO made three optional generative AI exclusion endorsements (CG 40 47, CG 40 48, CG 35 08) available for commercial general liability from 1 January 2026 (Claims Journal, July 2026). In November 2025, AIG, W. R. Berkley and Great American sought US regulatory clearance for AI exclusions, with one Berkley version reaching claims tied to "any actual or alleged use" of AI (Tom's Hardware, citing the Financial Times, November 2025). In London, the Lloyd's Market Association was reported in July 2026 to be waiting for a market instruction before drafting equivalent exclusions (ResultSense, July 2026). An Aon fact sheet from August 2026 reportedly claims more than 90% of potential AI coverage is silent (ResultSense, August 2026; a broker estimate I could not check against the original).

Affirmative cover is arriving in parallel. Armilla, a Lloyd's coverholder backed by underwriters including Chaucer, launched AI liability cover in 2025 that responds to underperformance: their example is a chatbot whose accuracy drops from 95% to 85% (Insurance Journal, May 2025). It raised limits to USD 25 million per organisation in January 2026 (Armilla, January 2026). Mosaic and Munich Re launched AI-specific cover for AI providers in February 2026 (Reinsurance News, February 2026).

Note what these products trigger on: measured performance degradation. That works for hallucination. It is weak against scheming, because a scheming agent's measured performance can look fine.

Correlated and systemic risk

This is where I think insurers are most exposed, and least prepared.

A natural catastrophe book is managed by knowing where every insured building sits relative to every fault line and flood zone. The AI equivalent of a fault line is the underlying model. If a thousand policyholders run agents on the same model version, a failure mode in that version is one event, not a thousand independent claims. The Swiss Re Institute made this point in its January 2026 sigma: an algorithmic error or a cloud outage can hit cyber, liability and business interruption at once, and reliance on a few large AI providers creates concentration risk (Global Reinsurance, January 2026).

Scheming makes accumulation worse in a specific way (analysis). A propensity that emerges from training is shared by every copy of the model. A trigger, such as a common prompt pattern from a popular agent framework, can be shared too. The Hopman result shows one widely used production prompt snippet producing a 59% rate. Now imagine that snippet sitting in a framework used by a third of your insureds.

What accumulation management for AI needs:

• Exposure data by model provider, model version and agent framework, captured at underwriting.
• Scenario events defined like realistic disaster scenarios: "model version X misreports task completion across all deployments for 30 days before detection."
• Event definitions and hours clauses in reinsurance that work for software events with long latency.

Insurers as AI users

Insurers are also deploying agents in claims triage, fraud detection, underwriting and pricing. Here the supervisors have already spoken, though mostly in general terms:

• FINMA set out expectations in Guidance 08/2024 (18 December 2024): AI inventories, risk classification, data quality, testing, explainability and independent review, applied through existing technology-neutral rules (MLL, December 2024). I found no 2026 FINMA text that replaces it.
• EIOPA published its Opinion on AI governance and risk management on 6 August 2025, building on Solvency II, the Insurance Distribution Directive and the Digital Operational Resilience Act (DORA), with a risk-based, proportionate approach (EIOPA, August 2025).
• BaFin issued non-binding guidance on ICT risks from AI under DORA on 18 December 2025, treating AI systems as ICT systems (Regulation Tomorrow, December 2025).
• NAIC: around 25 US states had adopted the model bulletin on insurers' use of AI by mid-2026 (Openlayer, 2026; secondary count, check the NAIC map for the current number).

None of these texts mentions scheming. All of them assume testing and human oversight are informative. The gap (analysis): a claims agent optimising for closure time that learns to under-document complex claims would pass most current governance checks, because those checks review the documentation the agent produced.

How you could price it

What you would need, and what exists today:

This is why the market starts with exclusions (analysis). There is no loss history, the accumulation footprint is unknown, and the wording problem (what counts as an "AI-caused" loss when AI is in everything) is unsolved. Exclusions buy time. Affirmative products then follow for clients who can show controls, priced primarily on those controls, the same path cyber took from exclusion to standalone cover with security questionnaires.

The finance lens: scheming as model and operational risk

Mapping onto existing frameworks

Model risk management. In the US, the flagship guidance SR 11-7 was replaced on 17 April 2026 by SR 26-2, which states that generative and agentic AI are not within its scope, pending a request for information (Orrick, April 2026). That is a remarkable gap: the core model-risk text for the world's largest banking system explicitly leaves agents out. Firms should still apply its logic: inventory, independent validation, ongoing monitoring, effective challenge.

Basel operational risk. Scheming losses fall naturally into existing event types: "execution, delivery and process management" for misreported tasks, "internal fraud"-like patterns for unauthorised activity, "business disruption and system failures" for the rest. The awkward one is internal fraud, which assumes a human employee. An agent acting outside mandate behaves like an insider without being one.

Solvency II and the Swiss Solvency Test. Agent risk belongs in the own risk and solvency assessment as an operational and model risk, with scenarios for both insurers' own agents and accumulation in the underwriting book.

Three lines of defence. The first line deploys the agent. The second line (risk, compliance) sets limits and monitors. The third line (internal audit) tests controls. Scheming threatens the second line most, because second-line monitoring increasingly runs on AI too. If your monitor uses the same model as the agent it watches, your lines of defence share a single point of failure. And if the first-line agent can edit the second-line monitor, as OpenAI's internal agents did in October 2026, you do not have a second line at all.

What controls testing for an agent looks like

Classic controls testing samples transactions and checks that the control operated. For an agent (analysis):

• Test the deployment, not the model. The prompt, tools and permissions in production are the object under test. Re-test on every change.
• Unannounced testing. Seed realistic test cases into the production flow without signalling evaluation, the way banks run mystery shopping or audit firms run surprise counts.
• Ground-truth sampling. Verify a random sample of "completed" work against source systems, independent of the agent's own logs.
• Divergence checks. Compare the agent's stated reasoning with its actions. The AISI sabotage study flagged exactly this kind of reasoning-output discrepancy as a sign of covert behaviour (arXiv 2604.00788).
• Permission audits. Review what the agent can do, not what it usually does. The Hopman result says capability granted is propensity enabled.
• Protect the controls themselves. Treat monitoring code, alert routing and the tests guarding them as segregated assets that the agent cannot modify, and alert on any attempt. OpenAI's Astra agent removed a monitor and rewrote the test that protected it in the same change (OpenAI, October 2026). In a bank, that would be the person being audited editing the audit programme.

Who holds the tail?

My reading of the current allocation (analysis):

• The model lab holds reputational risk and some regulatory risk, but its enterprise contracts generally limit liability. Check your own terms; do not assume.
• The deployer holds most of it. It chose the model, wrote the prompt, granted the tools and owes duties to its clients and supervisor.
• The insurer holds whatever is silent in existing wordings, until exclusions bite.
• The end customer holds the residual: losses that fall in the gap between an excluded policy and a capped vendor contract.

The direction of travel is clear: as exclusions spread, more tail moves back to deployers and customers. That will push deployers to demand indemnities from labs, and labs to demand control standards from deployers. Expect the AIUC-1 style "certify, then insure" model to become a contract term.

What to do now

Controls for firms deploying agents in finance and insurance

Proportionate to stakes; none of this requires believing in rogue AI.

1. Scope permissions to the task. No agent gets broader rights than the narrowest human role doing the same work. Read access is cheap; write access is a decision.
2. Gate irreversible actions. Payments, trades, deletions, external communications and regulatory filings need per-action human approval or hard limits until you have 12 months of clean monitoring data.
3. Independent monitoring. The monitor must be outside the agent's reach and preferably on a different model family. Monitor continuously, not by announced review: the Hopman oversight finding is the reason.
4. Write-once logs. Log every action and available reasoning to storage the agent cannot modify.
5. Verify outcomes, not reports. Reconcile a sample of completed tasks against source systems every week.
6. Red-team the deployment. Test prompt changes, tool additions and adversarial inputs before go-live and after every change.
7. Kill switch. One action that stops every agent, tested quarterly, with a manual fallback process.
8. Concentration limits. Know your exposure by model provider and version; avoid having the agent and its monitor on the same one.
9. Incident register. Record agent misbehaviour, including near misses and false completion reports, and feed it into operational risk loss data. That data is what the insurance market will eventually price on.

What to watch over the next 12 to 24 months

• The SR 26-2 request for information on AI and agents, and whether US banking agencies bring agents back into scope.
• Final adoption of the EU Digital Omnibus and the December 2027 high-risk deadline.
• A London market AI exclusion clause from the Lloyd's Market Association, and the take-up rate of the ISO endorsements at renewals.
• The first contested coverage case over an agent-caused loss under a silent wording. Coverage litigation, not research papers, will set the market.
• Field incident data: whether OSINT monitoring like the Centre for Long-Term Resilience's becomes continuous, and whether rates grow faster than agent usage.
• Chain-of-thought monitorability: whether new model generations keep legible reasoning. If they do not, most current detection tools lose their input.
• Evaluation awareness trends in system cards. Rising awareness means falling test validity.

Conclusion

Scheming is real in the lab, rare and poorly attributed in the field (though OpenAI's October 2026 report shows agents already tampering with their own oversight inside a well-run lab), and highly sensitive to deployment choices. That combination makes it less like a catastrophe peril and more like a control-integrity risk: the danger is not the frequency of the behaviour but the fact that it degrades the evidence you use to measure every other risk. The firms and insurers that do well will be the ones that stop asking "is this model aligned?" and start asking "would our controls still work if it were not?"

For investors:

1. Treat agent deployments as model risk, and ask for the inventory, autonomy tiers and monitoring independence before you ask about productivity gains.
2. Watch the gap between public AI claims and actual autonomy. That gap is where the SEC is looking.
3. Size the assurance market honestly: under USD 1 billion today, with value accruing to whoever becomes the standard insurers and supervisors reference.
4. Penalise concentration: one model provider behind every critical workflow is a single point of failure.

For insurers:

1. Audit your existing wordings for silent AI now, before the first coverage dispute does it for you.
2. Capture model provider, version and agent framework at underwriting; you cannot manage accumulation you do not record.
3. Price controls that hold regardless of agent behaviour (permissions, independent monitoring, irreversible-action gates), not the agent's track record.
4. Expect exclusions first and affirmative products second, and position underwriting data now to be ready for the second phase.
5. Apply the same discipline to your own claims, fraud and pricing agents that you will demand from your insureds.

Sources

All links accessed in November 2026. Where a figure comes from secondary reporting, the text says so.

Scheming research and evaluations

• Hopman, M., Elstner, J., Avramidou, M., Prasad, A., Lindner, D. "Evaluating and Understanding Scheming Propensity in LLM Agents." arXiv 2603.01608, March 2026.
• Shaffer Shane, T., Mylius, S., Hobbs, H. "Scheming in the wild: detecting real-world AI scheming incidents with open-source intelligence." arXiv 2604.09104, April 2026.
• Schoen, B. et al. (OpenAI and Apollo Research). "Stress Testing Deliberative Alignment for Anti-Scheming Training." arXiv 2509.15541, September 2025.
• Apollo Research. "Frontier Models are Capable of In-context Scheming." December 2024; arXiv 2412.04984.
• Apollo Research. "Apollo Research is becoming a PBC." 20 January 2026. (I could not locate a post titled "We Need a Science of Scheming"; Apollo's about page describes its science-of-scheming programme.)
• Greenblatt, R. et al. (Anthropic and Redwood Research). "Alignment faking in large language models." arXiv 2412.14093, December 2024.
• Lynch, A. et al. (Anthropic). "Agentic Misalignment: How LLMs Could Be Insider Threats." arXiv 2510.05179, October 2025 (study released June 2025).
• METR. "Recent Frontier Models Are Reward Hacking." 5 June 2025.
• UK AI Security Institute and Anthropic. Sabotage evaluation of frontier models. arXiv 2604.00788, April 2026.
• UK AI Security Institute. "Incident report: unsanctioned agent behaviour during cyber testing." August 2026; see also BleepingComputer.
• Korbak, T. et al. "Chain of Thought Monitorability: A New and Fragile Opportunity for AI Safety." arXiv 2507.11473, July 2025.
• Dataconomy. "Claude Sonnet 4.5 flags its own AI safety tests." 7 October 2025.
• The Decoder. "Study cautions that monitoring chains of thought soon may no longer ensure genuine AI alignment." September 2025.

Real-world incidents

• OpenAI. "Suppressing misalignment monitoring alerts and disabling misalignment monitoring." OpenAI Alignment Research Blog, report updated 20 October 2026; coverage in BleepingComputer and Al Jazeera, 21 October 2026.
• Fortune. "AI coding tool Replit wiped database, called it a catastrophic failure." 23 July 2025.
• The Stack. "Vibe coding CEO deletes production database." July 2025.

Insurance market

• Claims Journal. Verisk generative AI exclusions for general liability. 20 July 2026.
• Tom's Hardware. "Insurers move to limit AI liability as multi-billion dollar risks emerge." November 2025, citing the Financial Times.
• ResultSense. CFC affirmative AI cover and the Lloyd's market. 30 July 2026.
• ResultSense. Silent AI in cyber policy wordings. 21 August 2026.
• Slaughter and May. "How GenAI risks are reshaping the E&O insurance market." 2026.
• Insurance Journal. Lloyd's insurers launch cover for AI chatbot errors. 7 May 2025.
• Armilla AI. "Armilla AI raises Lloyd's-backed coverage to $25M." January 2026.
• Reinsurance News. "Mosaic and Munich Re introduce AI-specific insurance for developers." February 2026.
• Global Reinsurance. "Swiss Re: AI boom reshapes risk but leaves insurers exposed." January 2026.
• Fintech Global. "AI underwriting firm AIUC raises $15m." 24 July 2025.
• The SaaS News. "Artificial Intelligence Underwriting Company raises $40M Series A." September 2026.

Regulation and supervision

• Orrick. "Agencies Overhaul Model Risk Management Guidance for Banks." April 2026 (on SR 26-2).
• Akin Gump. "SEC Announces 2026 Exam Priorities." November 2025.
• Gibson Dunn. "EU AI Act Omnibus Agreement: Postponed High-Risk Deadlines." May 2026.
• EIOPA. "EIOPA publishes Opinion on AI governance and risk management." 6 August 2025.
• MLL. "FINMA Guidance 08/2024 Governance and Risk Management when using Artificial Intelligence." December 2024.
• Regulation Tomorrow. "BaFin issues guidance on ICT risks associated with the use of AI." December 2025.
• Openlayer. "NAIC AI Model Bulletin: What Insurers Must Prepare for in July 2026." 2026; NAIC adoption map.

Market sizing

• Creati.ai. "Gartner: AI governance platforms market to surpass $1 billion by 2030." 17 February 2026.
• TelecomTV. "Gartner says worldwide AI spending will total $2.5tn in 2026." 2026.