A toy catastrophe model
The AI Underwriting Company has proposed that frontier labs insure each other through a mutual: pooled capital, shared safety standards, audits with teeth. They sketch the structure; this page puts rough numbers on it. It starts from their mutual, and then asks whether the labs' own captives, a commercial insurer or a government backstop would carry the same losses better (who carries it). Move the levers and watch the premium, the capital a regulator would ask for, and how much of the harm would actually be paid.
The model
Three perils: an engineered epidemic a frontier model helped cause, a cyber catastrophe it enabled, and a lab's own agents running amok, as OpenAI's did at Hugging Face in July 2026. Each has a severity (a Pareto tail starting at the smallest event counted), a rate of events at least that big, and the share of the harm a court would pin on the lab. Each lab buys cover up to a limit per event and per year, as from any liability insurer. The first carrier, a mutual by default, backs it with premium and paid-in capital, and a mutual can also call on its members. Reinsurance, a cat bond or a government can take the losses above a point you choose. 100,000 simulated years per setting.
How often
The AIUC authors draw a line between two ways of pricing a catastrophe. An actuary works from the record: how often has this happened, and how bad was it? A catastrophe modeller maps the chain of events that leads to harm and puts a probability on each link. For AI the record is a handful of incidents, so the first method has little to work with. The second forces you to say what you believe about each step, which is useful in itself for deciding where safety work matters. The model can count either way, or use its default: rates set from expert forecasts and parallels with other industries. Severity, attribution and everything downstream stay the same; only how often events happen changes. The choice here drives the whole page.
Each chain starts from a count a year and multiplies down by the chance of each next step. Move a link to see what it does to the rate. The sliders change the rate only when the causal method is chosen.
Sensitivity
Each bar swings one parameter from the low to the high end of its range, with everything else at the central settings. The cover and capital levers have no range, so they are halved and doubled. Every run uses the same simulated years, so the bars show each parameter's effect, not noise. The answer hangs most on how much cyber harm a court would pin on a lab (the next chapter builds that up from case law), then on members' revenue and on how often AI cyber catastrophes happen. Bio dominates the harm in the world but hardly moves the premium: limits and near-zero attribution keep it off the mutual's books.
Who pays
When an attacker uses a frontier model to take down a payment system, the attacker is the obvious wrongdoer, but the attacker will never pay: it is a state, or a gang beyond reach. What the mutual owes depends on how much a court would put on the lab instead. That is a chain of three legal questions, each with case law behind it.
Multiplied together, the central reading puts about 7% of an AI-enabled cyber catastrophe on the lab. Move the links below and the cyber attribution on the levers board moves with them.
Each row changes some links and keeps everything else at the central settings. Computed by the Python model over 60,000 simulated years. Use a row to set the links above.
Capability over time
The rates above describe today. How fast they grow depends on how fast AI gets more capable. Capability here is METR's time horizon: the length of software task, timed by how long it takes a human, that an AI agent can finish half the time. The best model METR has measured, in April 2026, manages about 17 hours. Four paths from there: AI 2027's speeding-up trend at the pace its authors say reality is running; METR's fitted trend since 2023; its slower trend since 2019; and a plateau that flattens towards a ceiling you choose. METR's data show no flattening yet, so the plateau is an assumption, not a finding.
Each peril's rate rises with the horizon at its own elasticity, up to a cap. Bio barely moves, because most of the uplift has already happened. A lab's own agents scale roughly with how long they can run unsupervised. Labs' revenue grows too, so the premium can shrink as a share of revenue even while claims rise. The projection stops when the horizon reaches the stop level. Past that, the AI 2027 authors expect AGI within about a year, and loss of control is out of scope, so the model has nothing useful to say. How many years come before the stop is itself the result.
Uses every setting from the levers above, re-simulated each year (20,000 years each). A plateau is not necessarily good news for the mutual: if capability saturates, it spreads to small open models (Fogelson et al.), misuse moves to non-members' models, and more of the harm goes uninsured.
The market lens
Prediction markets price some of the same events. Few questions match the model's perils exactly, so each one below says how we read it. A question about an incident before some year covers a window in which, on the central capability path, risk is growing. We take that growth out before comparing with today's rate, since the Over time chapter adds it back. Read that way, the markets agree with the model's central rates more than they disagree. The Markets preset, beside Optimistic and Pessimistic above, uses their numbers: the agent and cyber rates, the stop horizon set where the central path is at the markets' median date for AGI, and member calls trimmed by the bankruptcy risk the markets price.
Snapshot taken ; refreshed with python -m catmodel.markets --fetch. Manifold is play money, and its AI-incident markets have 13 to 74 traders. Long-dated Polymarket prices lean towards "yes", because betting "no" ties up money for years. Metaculus forecasts are read by hand from the question pages.
Capital in two languages
The same simulated losses, read the American way and the European way. The biggest difference for a mutual: under Solvency II, members' promises to pay more later can count as capital (up to half the requirement); under US statutory accounting, they don't.
The US formula has a blind spot. NAIC risk-based capital charges reserves and premium by line of business at industry factors, and charges catastrophe only for earthquake and hurricane. As written, it never sees the tail of an AI catastrophe, so the mutual's ratio is in the tens of thousands of percent. The second ratio adds the mutual's 1-in-100 year loss as if regulators charged it like a hurricane. A domicile would more likely ask for that through its own review than through the formula.
Simplified on purpose: one catastrophe-and-premium risk module and a run-off risk margin for Solvency II; for the US, reserve, premium and operational risk without asset or credit risk. The Solvency II and NAIC factors are checked against the rules (see the model's own constants). See the model's notes in catmodel/capital_s2.py and capital_us.py.
Who carries it
Most of what is written about insuring frontier AI starts from AIUC's mutual. But nothing in the losses above depends on who holds them. The same simulated years can be carried by the labs together, by each lab alone, by a commercial insurer or reinsurer, or in layers. The structure decides three things: what capital costs, whether pooling cuts how much is needed, and who has a reason to watch the labs.
Pooling matters more than the mutual form. A lab insuring itself through its own captive pays about four times what it pays in a pool, because it must hold capital for its own bad year alone. A diversified insurer is cheapest, because an AI catastrophe does not coincide with a hurricane, so it asks less for its capital. That flatters it, though: the same event would hit its cyber and technology books, which is the correlation Leung et al. single out as AI's genuinely new insurance problem. Members' callable capital lifts the Solvency II ratio but does not change the premium.
Each row changes a few settings from the central mutual and keeps everything else. Computed by the Python model over 60,000 simulated years. Use a row to load its settings into the levers.
An insurer's case as a check on the labs rests on independence and on having its own money at stake. A mutual scores worst on independence; its case is different: members pay for each other's losses, so they have reason to police each other, as the mill owners of Factory Mutual did from 1835. Both are fair arguments, but they are different ones. A plausible answer is not one carrier but a stack: the labs pool the frequent losses, reinsurers price the layer above from outside, and government takes the far tail.
The qualitative columns are judgement. Today's standalone AI liability cover runs to about $25m per insured (Armilla), against AIUC's $1bn minimum per member.
Capital markets
The same distribution, sold to investors: a bond that loses principal when the mutual's annual claims pass the attachment, and is wiped out at exhaustion. The first cyber cat bonds priced at about ten times their expected loss, against about three times for natural catastrophe: investors charge heavily for a peril nobody can model. An AI cat bond would sit at least as far out. And unlike hurricanes, an AI catastrophe is plausibly correlated with the rest of an investor's portfolio.
Spreads three ways: a multiple of expected loss (the lever above), Lane's (2000) power law, and a Wang transform. Both of the last two are re-fitted to 58 natural catastrophe and 9 cyber bonds from 2023–26 (see the re-fit). Cyber bonds price at about twice the natural catastrophe curve; we price an AI bond like cyber, which is a judgement and arguably generous.
The hard case
Usually asserted, rarely shown. Here are nine tests, run on the bio peril alone with the central parameters. The verdict: bio risk can be held as a small, incentive-bearing slice (which is what the mutual proposal asks for) but cannot be insured as compensation.
Provenance
Every parameter traces to an entry here, from one of four viewpoints: built up from first principles, a parallel from another fat-tailed industry, a market price or forecast, or an expert elicitation. Each says how far it has been checked.
Besides the levers, the model hard-codes a few numbers taken from regulation and the pricing literature. Each was checked against the text it came from. Two needed correcting: Lane's pricing formula had been fed percentages where his paper uses decimals, which overstated its spreads by about a third, and the Solvency II own-funds rule carried a cap that the regulation doesn't have. The two cat bond pricing constants have since been re-fitted to 2023–26 bonds.
About
A personal project, vibe-coded with Claude Code, responding to the AI Underwriting Company's proposal for a frontier AI mutual (Trout, Kvist and Dattani, Lawfare, September 2026). The name nods to MAIM, Mutual Assured AI Malfunction, from Hendrycks, Schmidt and Wang's Superintelligence Strategy.
It is not a price, a recommendation, or a view on any real company. Loss of control is out of scope by construction: nobody would be left to pay or receive a claim. Parameters marked as judgement are there to be argued with; the model's Python source and the parameter registry sit beside an earlier project, an LLM benchmark in which models run an AI-liability insurer.