Prompt injection in insurance claims AI

Four adversarial injection surfaces in insurance claims AI

1. Property damage claim photo AI injection (CoreLogic Property Intelligence, Verisk Geomatics AI, Xactimate AI, EagleView AI)

Property insurance claims AI processes photographs submitted by policyholders, independent adjusters (IAs), and aerial imaging services to assess dwelling damage, estimate repair costs, and determine coverage triggers — particularly for weather events including hail, wind, and water damage claims that generate claim volumes exceeding the capacity of manual adjuster review. CoreLogic Property Intelligence AI processes aerial and satellite imagery alongside policyholder-submitted photographs to assess roof damage, structural damage, and property condition for claims and underwriting applications at insurers including Allstate, Farmers, and Nationwide. Verisk Geomatics AI processes aerial imaging for post-event property damage assessment through its Verisk 360Value and AIR Worldwide platforms, providing catastrophe modelling and damage assessment services to insurers and reinsurers that set reserve levels for storm, hurricane, and wildfire events affecting portfolios covering hundreds of thousands of insured properties simultaneously. Xactimate AI, operated by Verisk’s Symbility platform, processes contractor-submitted damage photographs to generate repair cost estimates for property claims adjudicated through carrier direct repair programmes and independent adjuster networks. EagleView AI processes aerial roof measurement imagery and damage assessment photographs used by carriers including Travelers, USAA, and Erie Insurance for hail and wind damage claims.

The adversarial injection surface is the photograph submission pathway: policyholder-submitted mobile phone photographs uploaded through carrier apps (Allstate’s QuickFoto Claim, Farmers’ Easy Claims), IA field adjuster photographs submitted through Xactimate or CoreLogic field apps, and aerial or satellite tile submissions through geospatial API ingestion pipelines. An adversarially crafted property damage photograph — in which pixel perturbations applied to the regions showing storm damage cause CoreLogic Property Intelligence AI or Xactimate AI to underestimate damage severity, misclassify structural damage as cosmetic damage, or suppress a coverage trigger corresponding to a covered peril — can reduce the AI-generated scope of loss estimate below the true covered repair cost, resulting in claim underpayment without triggering manual adjuster review. The adversarial perturbation operates at the sub-pixel level across the damage region — altering the spectral and spatial features that the AI uses to classify hail dents, wind-lifted shingles, water intrusion patterns, and structural deformation without altering the visual appearance of the photograph in a way that a human reviewer would notice during a routine quality control review of the claim file.

The regulatory consequence falls under state insurance unfair claims settlement practices acts, which in every US state incorporate provisions derived from the NAIC Unfair Claims Settlement Practices Act model law. Under these statutes, carriers are prohibited from failing to adopt and implement reasonable standards for the prompt investigation of claims, refusing to pay claims without conducting a reasonable investigation, and misrepresenting pertinent facts or insurance policy provisions related to coverage. An AI-generated scope of loss that understates covered damage as a result of adversarial image manipulation is not distinguishable from a scope of loss produced by a biased adjuster who minimised damage documentation — from the regulatory perspective, the outcome is an unreasonably low offer that the carrier cannot defend by reference to the AI’s assessment once the adversarial manipulation of the submitted photograph is established. In states with bad faith liability statutes — including California (Brandt fees), Florida (prevailing party attorneys’ fees for hurricane claims), and Texas (Prompt Payment Act penalties) — a carrier whose AI adjudication system produces systematically low estimates as a result of undetected adversarial manipulation of policyholder-submitted photographs faces exposure beyond the claim underpayment itself: consequential damages for delays in covered repair, statutory penalties, and attorneys’ fee awards. Threshold: 55 for property damage claims AI (consumer financial harm, NAIC unfair claims settlement practices).

2. Auto damage claim photo AI injection (Tractable AI, CCC Intelligent Solutions AI, Mitchell ClaimXperience AI, Solera/Audatex AI)

Auto physical damage claims AI processes vehicle damage photographs submitted by policyholders through carrier mobile apps and by body shops through direct repair programme (DRP) submission portals to generate repair cost estimates, total loss determinations, and salvage valuations. CCC Intelligent Solutions AI processes more than 150 million auto claims events annually and is integrated with the claims platforms of more than 300 insurance carriers in the United States, providing AI-generated repair cost estimates, total loss decisions, and parts pricing for auto physical damage claims. Mitchell ClaimXperience AI is integrated with carrier claims platforms at Allstate, Progressive, GEICO, and State Farm through Mitchell’s WorkCenter platform, processing vehicle damage photographs to generate AI damage severity scores and line-item repair cost estimates. Tractable AI is deployed by 50+ insurers in the US, UK, Japan, and Europe, processing vehicle damage photographs to generate AI repair cost estimates that accelerate cycle time on the majority of auto physical damage claims processed through digital first notice of loss (FNOL) pathways. Solera’s Audatex platform, following Solera’s acquisitions of Audatex and Hollander, processes auto claims data and damage photographs for European carriers and is integrated with body shop management systems across Germany, France, and the UK.

The adversarial injection surface operates in two directions with opposing financial motives. First-party fraud direction: a policyholder submits an adversarially crafted vehicle damage photograph through the carrier’s mobile FNOL app — a photograph of a vehicle with minor cosmetic damage where pixel perturbations have been applied to the damage region to cause CCC AI, Mitchell AI, or Tractable AI to overestimate damage severity, producing an inflated repair cost estimate or a total loss determination on a vehicle that is economically repairable. This produces an insurance fraud outcome — the policyholder receives a settlement payment exceeding the actual covered damage — that is financially motivated and operationally simple: adversarial perturbation tools capable of targeting specific AI damage classification models can be packaged as mobile applications and distributed to organised fraud rings that apply the technique systematically across multiple FNOL submissions. Carrier cost reduction direction: a body shop or independent appraiser submits an adversarially crafted vehicle damage photograph through a DRP portal where pixel perturbations applied to supplemental damage regions cause Mitchell AI or Audatex AI to underestimate total repair scope, suppressing line items that the body shop has legitimately identified during teardown — reducing the AI-approved estimate below the actual repair cost and creating a financial incentive for the carrier to deny supplement requests.

The combined adversarial injection exposure creates a systemic integrity problem for AI-based auto claims adjudication: the same technique that enables policyholder fraud in the first direction enables carrier claim manipulation in the second direction, and the AI platform cannot distinguish between an adversarially manipulated photograph and a legitimately submitted photograph without a pre-scan integrity check. The financial scale of auto insurance fraud in the United States — estimated at $29–$34 billion annually by the Insurance Research Council and the Coalition Against Insurance Fraud — means that even a marginal improvement in the adversarial manipulation success rate against AI triage systems produces statistically significant fraud volume. The Coalition Against Insurance Fraud’s 2024 survey identified AI-assisted claims fraud as an emerging priority concern for the P&C insurance industry, with organised fraud rings specifically targeting AI FNOL photo assessment tools. Threshold: 55 for auto claims AI (insurance fraud, carrier cost accuracy, NAIC unfair claims settlement practices).

3. Workers’ compensation injury claim photo AI injection (Carisk Partners AI, Paradigm AI, CorVel AI)

Workers’ compensation claims AI processes medical imaging photographs, injury documentation photographs, and functional capacity evaluation (FCE) documentation submitted through claims management platforms to triage claim severity, validate treatment plans, and flag claims for case management intervention. Carisk Partners AI processes medical imaging — including MRI films, X-ray images, and clinical photograph documentation — submitted through workers’ comp claims platforms at carriers including Zurich North America, Travelers, and CNA Financial to assess injury severity and treatment appropriateness for musculoskeletal injury claims. Paradigm AI processes complex injury claims — catastrophic injury, spinal cord injury, traumatic brain injury, and severe burns — through an AI triage and case management platform that classifies submitted injury documentation photographs and medical imaging to identify claims requiring early intervention and specialised managed care. CorVel AI processes utilisation review (UR) documentation and treatment records submitted through its CareSmart managed care platform, processing injury photographs and diagnostic imaging to generate AI-assisted treatment appropriateness determinations for workers’ comp claims at self-insured employers and state fund carriers.

The adversarial injection surface is the medical imaging and injury documentation submission pathway: treating physicians submitting MRI or X-ray images through carrier claim portals, injured workers submitting injury photographs through claimant apps, and independent medical examination (IME) providers submitting examination photographs through UR platform APIs. An adversarially crafted injury photograph — where pixel perturbations applied to the region showing soft tissue swelling, wound severity, or functional impairment cause Carisk Partners AI or CorVel AI to underestimate injury severity, downgrade the claim from a case management intervention trigger to a routine medical-only claim, or suppress a referral trigger for catastrophic injury case management — can result in inadequate early medical intervention on a claim where prompt case management is associated with significantly better medical outcomes and lower ultimate claim costs. The adversarial suppression of injury severity in workers’ comp AI creates a dual adverse consequence: the injured worker receives inadequate medical management and experiences worse health outcomes, while the carrier accumulates reserve deficiency and late claim development as the inadequately managed injury worsens over the claim duration.

Workers’ compensation regulatory frameworks in all US jurisdictions impose affirmative obligations on carriers and self-insured employers to provide prompt and adequate medical treatment for work-related injuries under state workers’ comp acts. Denial or delay of medical treatment based on AI utilisation review determinations that have been compromised by adversarial manipulation of submitted documentation would expose the carrier or self-insured employer to bad faith liability under state workers’ comp bad faith statutes — which exist in California (Cal. Lab. Code § 5814), Texas (Tex. Lab. Code § 415.001), and approximately 30 other states — as well as to penalties under state workers’ comp commissioner regulations governing UR timeliness and documentation requirements. The IME and FCE adversarial injection surface has additional regulatory exposure under HIPAA, since adversarially manipulated medical imaging submitted through covered entity claim platforms involves the potential compromise of protected health information integrity — a HIPAA Security Rule (45 CFR § 164.312(c)) data integrity obligation on covered entities and business associates. Threshold: 55 for workers’ comp claims AI (injured worker medical access, state workers’ comp bad faith exposure).

4. Catastrophe event satellite AI injection (Verisk AIR Worldwide, CoreLogic, EagleView catastrophe portfolio AI)

Catastrophe event AI processes satellite and aerial imagery tiles submitted through geospatial ingestion pipelines to assess event-wide property damage for catastrophe reserve setting, reinsurance treaty recovery triggering, and portfolio re-pricing. Following a major catastrophe event — a Category 4 hurricane, a Midwest convective storm outbreak, a California wildfire — carriers and reinsurers depend on AI-processed satellite and aerial imagery to estimate aggregate covered losses across policy portfolios covering hundreds of thousands or millions of insured properties simultaneously. Verisk’s AIR Worldwide catastrophe modelling platform combines satellite imagery analysis with stochastic loss models to generate industry loss estimates and carrier-specific estimates of covered losses, which are used by carriers to set initial catastrophe loss reserves, trigger reinsurance recoveries under excess-of-loss (XOL) and quota share treaties, and report preliminary catastrophe loss estimates to investors and regulators under GAAP and STAT financial reporting frameworks. CoreLogic’s Property Intelligence platform processes post-event aerial and satellite imagery to generate parcel-level damage assessments for the carrier’s claims intake and priority assignment, enabling carriers to dispatch IA adjusters to the highest-severity claims first in the days following a large event. EagleView processes aerial imagery following convective storm events (hail, wind, tornado) to generate roof damage assessments used for claims prioritisation and total-loss preliminary identification.

The adversarial injection surface is the satellite and aerial tile ingestion pipeline: the API or batch upload pathway through which post-event satellite imagery tiles are submitted to Verisk AIR, CoreLogic, or EagleView processing systems. In the context of post-catastrophe satellite imagery, the parties with access to the tile ingestion pathway include satellite imagery providers (Maxar, Planet, Airbus Defence and Space), aerial imaging service providers that fly post-event missions for carriers, and geospatial data aggregators that supply pre- and post-event imagery to multiple catastrophe modelling platforms simultaneously. An adversarially crafted satellite tile — in which pixel perturbations applied to the damaged property regions cause CoreLogic Property Intelligence AI or EagleView AI to underestimate the proportion of roof surfaces at total-replacement severity — can reduce the AI-generated preliminary damage assessment across the affected event footprint by a percentage that, at portfolio scale, translates to reserve deficiency in the hundreds of millions of dollars.

The financial consequence of catastrophe reserve deficiency is not merely a carrier balance sheet issue: under NAIC Model Regulation 785 (Property and Casualty Insurance Loss Reserve Adequacy Requirements) and the equivalent state insurance department reserve adequacy regulations, carriers are required to maintain loss reserves at adequate levels and to report reserve estimates accurately on NAIC statutory financial statements. Reserve deficiency driven by systematically biased AI damage assessments — whether the bias is introduced by adversarial manipulation of the satellite tile input or by other AI calibration failures — results in materially understated loss reserves on statutory financial statements filed with state insurance regulators, which is a category of financial impairment that triggers regulatory intervention under state insurance solvency framework. Reinsurance treaty recovery consequences are equally significant: a carrier whose catastrophe loss reserve is adversarially deflated by manipulated satellite AI assessments may delay or fail to trigger XOL reinsurance recoveries for which it is entitled — providing a mechanism by which a reinsurer with access to the satellite tile submission pipeline could adversarially reduce their recovery obligation. Threshold: 50 for catastrophe portfolio AI (systemic financial consequence, statutory reserve adequacy, NAIC regulatory exposure).

Integration: insurance claims AI image ingestion with Glyphward pre-scan

Insurance claims AI image ingestion flows from policyholder mobile apps, IA field adjuster APIs, body shop DRP portals, and satellite tile ingestion pipelines into AI damage assessment queues. Insert Glyphward’s pre-scan at the ingestion boundary — particularly for externally submitted photographs and satellite tiles where the submitting party has a financial interest in the AI’s severity assessment outcome:

import asyncio
import base64
import hashlib
import os
import uuid
from enum import Enum
from pathlib import Path

import httpx

GLYPHWARD_API_KEY = os.environ["GLYPHWARD_API_KEY"]
GLYPHWARD_SCAN_URL = "https://glyphward.com/v1/scan"

# Insurance claims AI — financial harm from manipulated severity assessments
# and systemic reserve impact from catastrophe portfolio AI injection.
# 55 for standard claims AI; 50 for CAT portfolio AI (systemic financial consequence).
THRESHOLD_CLAIMS_AI = 55
THRESHOLD_CAT_PORTFOLIO_AI = 50


class InsuranceClaimsAIContext(str, Enum):
    PROPERTY_DAMAGE        = "property_damage"        # CoreLogic, Verisk, Xactimate, EagleView
    AUTO_DAMAGE            = "auto_damage"             # Tractable, CCC, Mitchell, Audatex
    WORKERS_COMP_INJURY    = "workers_comp_injury"     # Carisk, Paradigm, CorVel
    CAT_SATELLITE          = "cat_satellite"           # Verisk AIR, CoreLogic CAT, EagleView CAT


def _threshold_for(context: InsuranceClaimsAIContext) -> int:
    if context == InsuranceClaimsAIContext.CAT_SATELLITE:
        return THRESHOLD_CAT_PORTFOLIO_AI
    return THRESHOLD_CLAIMS_AI


async def scan_claims_image(
    image_path: str | Path,
    context: InsuranceClaimsAIContext,
    claim_id_hash: str,     # SHA-256 of claim number — no PII
    policy_id_hash: str,    # SHA-256 of policy number — no PII
    event_code: str,        # e.g. "WIND_2026_06", "CAT_HURRICANE_HELENE"
    client: httpx.AsyncClient,
) -> dict:
    """
    Scan an insurance claims AI image for adversarial injection payloads
    before forwarding to a property damage assessment platform, auto claims
    AI adjudication system, workers' comp injury triage platform, or
    catastrophe event satellite tile ingestion pipeline.

    Raises AdversarialClaimsImageError if the Glyphward score meets or exceeds
    the threshold for the given claims AI context.
    """
    image_bytes = Path(image_path).read_bytes()
    image_b64 = base64.b64encode(image_bytes).decode()
    image_sha256 = hashlib.sha256(image_bytes).hexdigest()
    scan_id = str(uuid.uuid4())
    threshold = _threshold_for(context)

    resp = await client.post(
        GLYPHWARD_SCAN_URL,
        headers={"Authorization": f"Bearer {GLYPHWARD_API_KEY}"},
        json={
            "image": image_b64,
            "source": context.value,
            "metadata": {
                "claims_context": context.value,
                "claim_id": claim_id_hash,
                "policy_id": policy_id_hash,
                "event_code": event_code,
                "client_scan_id": scan_id,
                "image_sha256": image_sha256,
            },
        },
        timeout=8.0,
    )
    resp.raise_for_status()
    result = resp.json()

    audit_record = {
        "claim_id": claim_id_hash,
        "policy_id": policy_id_hash,
        "event_code": event_code,
        "claims_context": context.value,
        "scan_id": result["scan_id"],
        "client_scan_id": scan_id,
        "image_sha256": image_sha256,
        "score": result["score"],
        "flagged_region": result.get("flagged_region"),
        "threshold": threshold,
        "action": "blocked" if result["score"] >= threshold else "allowed",
    }
    await write_claims_audit_record(audit_record)

    if result["score"] >= threshold:
        raise AdversarialClaimsImageError(
            f"Claims AI image blocked [{context.value}]: "
            f"scan_id={result['scan_id']} score={result['score']} "
            f"claim={claim_id_hash} event={event_code}"
        )
    return result


async def scan_cat_event_tile_batch(
    tile_paths: list[Path],
    claim_id_hash: str,
    policy_id_hash: str,
    event_code: str,
) -> dict:
    """
    Scan a batch of post-event satellite tiles before forwarding to catastrophe
    portfolio AI (Verisk AIR, CoreLogic CAT, EagleView CAT) ingestion pipelines.
    Uses CAT_SATELLITE context with the lower 50-threshold for systemic reserve impact.
    """
    allowed, blocked, errors = [], [], []
    async with httpx.AsyncClient() as client:
        tasks = [
            scan_claims_image(
                p, InsuranceClaimsAIContext.CAT_SATELLITE,
                claim_id_hash, policy_id_hash, event_code, client,
            )
            for p in tile_paths
        ]
        results = await asyncio.gather(*tasks, return_exceptions=True)

    for path, result in zip(tile_paths, results):
        if isinstance(result, AdversarialClaimsImageError):
            blocked.append({"path": str(path), "error": str(result)})
        elif isinstance(result, Exception):
            errors.append({"path": str(path), "error": str(result)})
        else:
            allowed.append({"path": str(path), "scan_id": result["scan_id"]})

    return {
        "event_code": event_code,
        "context": "cat_satellite",
        "total": len(tile_paths),
        "allowed": len(allowed),
        "blocked": len(blocked),
        "errors": len(errors),
        "blocked_tiles": blocked,
    }


async def write_claims_audit_record(record: dict) -> None:
    """Persist audit record to claims management system audit store (stub)."""
    import json, sys
    print(json.dumps(record), file=sys.stderr)


class AdversarialClaimsImageError(Exception):
    """Raised when a claims AI image exceeds the adversarial injection threshold."""
    pass

Call scan_claims_image() before forwarding individual policyholder damage photographs, IA field adjuster photographs, body shop DRP submission images, and workers’ compensation medical documentation images to their respective AI assessment platforms. Call scan_cat_event_tile_batch() for post-event satellite tile batch ingestion pipelines where the tile set feeds catastrophe portfolio AI. The claim_id_hash and policy_id_hash fields use SHA-256 hashes of internal identifiers — not policyholder-identifiable claim or policy numbers — to maintain audit correlation without transmitting PII to the API boundary. The event_code parameter uses internal event identifiers (not policyholder location data) to allow event-level batch analysis of flagged images. Get early access

Coverage matrix

Frequently asked questions

Further reading

• Indirect prompt injection via image — foundational attack pattern underlying all four insurance claims AI injection surfaces; covers how adversarial pixel-level perturbations deliver manipulated AI instructions through image content rather than direct text input.
• Prompt injection in fintech and payments AI — financial services AI covering cheque MICR line injection, KYC identity document injection, expense receipt injection, and trade finance document injection — overlapping financial fraud attack vectors relevant to insurance fraud scenarios.
• Prompt injection in real estate AI — property technology AI with overlapping property damage assessment and valuation AI attack vectors relevant to property claims AI platforms.
• Prompt injection in government and border control AI — identity document AI covering passport MRZ injection and I-9 document injection, with overlapping document authentication attack vectors relevant to workers’ comp IME and fraud investigation documentation.
• Free tier — 10 scans/day, no card required — start scanning insurance claims AI images at development volumes before committing to a production plan.