Estimated reading time: 6 minutes
Shufti launched a product to verify AI agents and what they may do. Its product chief told CINI where verification stops. A stolen token can still fool it. A selfie check alone won’t beat a deepfake. An authorized payment can still be one the owner never intended.
AI agents now log in, shop and move money for people. A new set of products promises to check them. Shufti’s product is called Know Your Agent, or KYA. It launched on Oct. 28.
Shufti is a London-based identity verification and fraud prevention company. KYA recognizes an agent and links it to a verified person or business. It then checks each action against what that owner approved. Anything outside the mandate goes back to the owner for a fresh check.
CINI put four questions to Shufti. Raja Hassan Fayyaz, its vice president of product development, answered. The answers were candid about what the product doesn’t do.
Authorized Is Not The Same As Intended
Fayyaz offered a worked example. An AI agent is authorized to manage payments up to $5,000. It sends $4,000. The transfer sits within its permissions. The account owner never intended that payment.
“The transaction may be authenticated and within the agent’s mandate, yet still result in a financial loss,” Fayyaz said. “Technical authorization and genuine customer intent are not always the same thing.”
So who carries the loss?
“Who ultimately bears that loss depends on the contractual relationship, applicable payment regulations, the circumstances of the transaction, and the relevant insurance policy,” Fayyaz said. “It could involve the account holder, financial institution, agent operator, or another responsible party.”
“We would not suggest that agent verification alone determines liability or insurance coverage,” Fayyaz said.
That fits what CINI has heard elsewhere. Arkose Labs CEO Kevin Gosschalk said the loss “usually sits with the business” today, with the legal position unsettled. The same question hangs over AI agents that shop for insurance.
The distinction matters to insurers. An agent’s payment can be both authorized and unwanted.
Fayyaz drew a line between standing authorization and consent to a specific transaction. “A payment can fall within an agent’s general permissions without reflecting the owner’s intention at that moment,” Fayyaz said.
A Stolen Token Can Still Pass
CINI asked how KYA tells a real agent from a fake one holding a stolen token.
“A valid token proves that a credential has been presented,” Fayyaz said. “It does not necessarily prove that the legitimate agent is behind the request.”
A stolen bearer token alone “may not distinguish the attacker from the legitimate agent,” Fayyaz said. Stronger protection means binding the credential to the agent’s cryptographic identity. Fayyaz named two methods, proof-of-possession and mutual TLS, alongside runtime authorization controls.
Shufti’s approach asks three questions, Fayyaz said. Is this a recognized agent? Is it acting under a valid authorization? And is the action consistent with its permissions?
An agent that authenticates and then tries something outside its mandate should be blocked or escalated, Fayyaz said. “A trusted agent does not mean every action it performs should automatically be trusted.”
Stolen tokens already cost insurers. Travelers’ business email compromise claims ran 57% higher in the first half of 2026. Session token theft drove much of that, CINI reported.
Get The Cyber Insurance News Upload Delivered
Subscribe to our weekly newsletter!
The Selfie Check Meets The Deepfake
When an agent steps outside its mandate, KYA sends the request to the owner. Shufti’s launch pitch described a quick selfie check. CINI asked how that holds up against deepfakes.
“A selfie on its own is not sufficient protection against sophisticated deepfake attacks,” Fayyaz said.
Shufti’s face verification includes liveness and presentation attack detection, Fayyaz said. Shufti says it is the first European identity verification provider with iBeta PAD Level 3 certification. That is an independent test of spoofing defenses.
“We do not claim that any single biometric check can defeat every possible deepfake or injection attack,” Fayyaz said.
For sensitive actions, Fayyaz recommends layers. Those include moving large sums, changing beneficiaries, or widening an agent’s permissions. Facial verification can combine with a trusted device and a confirmation tied to the specific transaction.
“The objective is not merely to verify the human, but to verify human intent at the point where the agent’s authority needs to be extended,” Fayyaz said.
Shufti knows the threat. It projects a roughly 40-fold rise in document deepfakes this year, as its CTO told CINI for an earlier report.
How Insurers Could Use “Know Your Agent“
CINI asked whether any insurer or broker uses KYA. Fayyaz named none. “We are not publicly naming any insurer or broker as a Know Your Agent customer, and I would not want to imply an established deployment that we cannot substantiate,” Fayyaz said.
Fayyaz sees two uses. Insurers are exploring agents for policy servicing, claims administration and payments. Those agents need controls on who authorized them and what they can touch. The second use is evidence.
After a disputed transaction, an insurer needs four facts, Fayyaz said. Those are “which agent acted, under whose authority, what permissions existed, and whether the transaction complied with those permissions.”
KYA keeps records that link agent activity to a verified owner, along with authorization decisions and permission changes. Whether those records count as evidence “will depend on the circumstances and applicable requirements,” Fayyaz said.
“Know Your Agent is not an insurance policy or a guarantee against financial loss,” Fayyaz said. “It is a way to make delegated authority more controlled, traceable, and accountable.”
Few agents identify themselves at all today. Only 2.3% of legitimate AI agent sessions carried a verified signature in Arkose Labs’ third-quarter data, CINI reported.
Erin Kenneally sorts AI harm into misuse, mistake, and misalignment, as she explained on the CINI podcast. A stolen token is misuse. The $4,000 payment nobody wanted is one of the other two.
Get Our Podcast
Agentic AI and Cyber Insurance: The Authorization Gap – Get it Here.
FAQ – Know Your Agent
What is Know Your Agent?
Know Your Agent, or KYA, is a Shufti product launched Oct. 28, 2026. It verifies AI agents, links them to a verified owner and checks their actions against that owner’s permissions.
Can a stolen token fool Know Your Agent checks?
A stolen bearer token alone may not distinguish an attacker from the real agent, Shufti says. It recommends binding credentials to the agent’s cryptographic identity.
Who pays when an AI agent makes an unwanted payment?
It depends on contracts, payment regulations, the circumstances and the insurance policy, Shufti says. Agent verification alone doesn’t decide liability.
Does a selfie check stop deepfakes?
Shufti says a selfie alone is not enough. It recommends layered checks for sensitive actions, including liveness detection and a trusted device.
Are insurers using Know Your Agent?
Shufti is not naming any insurer or broker as a customer for the product.
How could Know Your Agent help insurers?
Its records show which agent acted, under whose authority and within what permissions. That could support claims investigations.
Related Cyber Insurance Posts
- Agentic AI: 98% Have Already Had An Incident. Few Can Prove What Happened(Opens in a new browser tab)
- Credential Theft Cyber Insurance: What 2.86 Billion Stolen Credentials Mean For Underwriters(Opens in a new browser tab)
- Sophos And Spektrum Labs Launch FastTrack Program Linking MDR To Cyber Insurance Policy Approval(Opens in a new browser tab)
- 6lock Puts A Lloyd’s Policy Behind The Wire Transfer(Opens in a new browser tab)
- Card Skimmers Sat On Online Checkouts For Weeks. Almost None Had Script Controls, Guardio Tells CINI.