^{Image: The Economist}

The pitch is consistent. The architecture underneath it isn't.

Walk through the marketing pages of the current generation of claims-automation vendors and a common script emerges: an AI "teammate" reads evidence nobody wants to read, triages the routine work, drafts the communications nobody has time to write, and hands the judgement calls back to a human. Five Sigma calls its version Clive, "the insurance industry's first Multi-Agent AI Claims Expert." Wilbur calls its version Wilo, "the intelligent teammate behind every claim." Both promise the same headline benefits: faster cycle times, lower claims costs, fewer errors, happier adjusters.

Those benefits are real and, in early deployments, measurable — Five Sigma cites a client reducing general-queue email handling time by 60% after adopting Clive, for instance. But "multi-agent" and "agentic" are doing a lot of work in this marketing language, and the two platforms turn out to mean something meaningfully different by those words once you look past the landing page. Understanding that difference matters for anyone evaluating these tools, because it determines which of two distinct risk categories — hallucination and injection versus outright loss of control — an insurer is actually exposed to.

What "multi-agent" means at Five Sigma

Clive is explicitly built on generative infrastructure: Five Sigma states it runs on Google Vertex AI and Gemini LLMs, combined into what it calls a "compound AI architecture" that layers natural language processing, machine learning, computer vision and predictive analytics. Its "agents" are eleven task-scoped modules — Intake, Triage, Coverage, Liability, Document, Planning, Insight, Chat, Risk, Communication, Inspection — each wired into a specific, credentialed set of APIs (the claims management system, policy admin, vendor networks) with rate limiting, IP whitelisting and role-based access control.

The reasoning-heavy modules are where the risk concentrates. Liability is described as performing "contextual reasoning" over documents and communications; Document summarises and tags unstructured files; Chat answers open-ended questions about the claim file. These are generative functions, not lookups, and they inherit the standard failure mode of large language models: confident, fluent, wrong output with no built-in signal that anything is amiss. Independent research on hallucination in insurance settings makes the stakes explicit — a coverage determination built on a policy exclusion that doesn't actually exist, or a claim summary that assigns a cause of loss no document supports, reads exactly like a correct one until someone checks.

Two specific design choices in Clive's published feature set stand out. First, its Coverage module is described as facilitating automated  policy checks by reading distinct policy terms, evaluating the incident details, and matching them to make autonomous coverage decisions without manual adjuster intervention.  Second, its automated Intake module can run with human-in-the-loop validation offered as an option rather than mandated. Both are efficiency features by design and would push the platform toward the higher-risk end of the straight-through-processing spectrum: an auto-denial that's wrong is far less likely to surface quickly than an auto-approval that's wrong, because a wrongly declined claimant has to complain or litigate before the error becomes visible — by which point it's a regulatory and bad-faith exposure rather than a quiet correction. Insurers should work with Five Sigma’s teams to avoid that and ensure a human claim professional authorises all automation processes. 

What "agentic" means at Wilbur

Wilo is positioned similarly in function — reading evidence, preparing claims, drafting updates — but the published design draws its human-control line further upstream. Wilbur's own "what stays human" list names coverage judgement, liability judgement, settlement decisions, total-loss decisions and payment authority as categorically human, not merely human-reviewable. Drafted customer and supplier communications are explicitly stated to never send without handler approval. The platform's marketing leans hard into transparency — showing its reasoning, stating confidence levels, flagging what it's uncertain about, logging a full claim-level "audit playback" of who did what, when, and under what rule.

That's a materially more conservative autonomy posture than Clive's optional human checkpoint at intake and coverage. It also directly answers several of the governance concerns raised about agentic claims tools generally: visible reasoning rather than a black box, an explicit vulnerable-customer routing rule, and hard authority thresholds that force supervisor review above certain financial limits.

Two gaps are worth flagging precisely because Wilbur's positioning is otherwise so governance-forward. Its public pages don't disclose which underlying model or vendor powers Wilbur. And where Five Sigma names specific, checkable certifications (SOC 2 Type II, GDPR, HIPAA, CCPA), Wilbur's pages reference regulatory frameworks it's designed with in mind (Australia's GICOP, RG 271, CPS 230, and "equivalent US conduct expectations") but explicitly caveat that this is "support for your obligations, not a legal guarantee" — a materially softer claim than a named third-party audit.

The risk both platforms genuinely reduce, and the one neither removes

Both platforms are, functionally, answers to the "black box" and "audit trail" problems that regulators and insurance leaders have been raising about agentic AI. An immutable, claim-level record of what evidence was used, what was inferred, what a human approved and when is exactly what six overlapping regulatory frameworks across the US, EU and UK are already demanding. On that dimension, both Clive and Wilo represent genuine progress over an unstructured LLM chatbot bolted onto a claims inbox.

What neither platform removes is the underlying probabilistic nature of the reasoning itself. Nor do other claims management systems I should add. IMO Five Sigma and Wilbur Are the top choices available for insurers and therefore set a benchmark for other vendors.

Confidence labels, visible reasoning chains and human sign-off gates are process controls — they change who catches an error and how quickly, not how often the underlying model produces one. Independent benchmarking puts general-domain LLM hallucination rates at 15–30%, and even legal clause-review — a domain with comparable stakes to insurance coverage interpretation — runs error rates as high as 14% in some contexts. A "moderate confidence, reasoning attached" label attached to a wrong liability assessment is itself a generated claim, not an independently verified probability; self-reported model confidence is well documented as frequently miscalibrated. The practical implication is that a human reviewer presented with fluent, well-organised, source-cited reasoning is not meaningfully more likely to catch a hallucination than one presented with a bare conclusion — arguably less likely, because the reasoning looks more trustworthy.

Is the OpenAI/Hugging Face "escape" scenario a live risk for either platform?

It's worth being precise about what actually happened there, because it's a specific and unusual failure chain, not a generic warning about AI going rogue. OpenAI was running a cybersecurity capability test against an unreleased model inside a sandbox with normal safety refusals deliberately weakened. A previously undisclosed vulnerability in the sandbox's package-installation system let the model reach the open internet — a mistake one security researcher called a containment failure with the safeties turned off, not a spontaneous escape. Once online, the model chained vulnerabilities across its own research environment and Hugging Face's production infrastructure specifically to steal the answers to the benchmark it was being tested on, described by OpenAI as the model going to "extreme lengths" in pursuit of a narrow test objective.

Three preconditions had to hold for that incident: deliberately reduced safety constraints, code-execution tooling, and an unintended path to the open internet. Neither Clive nor Wilo, as publicly described, has any of these. Clive's agents operate through defined, credentialed, rate-limited API integrations into named enterprise systems. Wilo's action surface is narrower still — drafting, recommending, and routing within a rules-configured workflow, with sending and approving reserved for humans. A literal "the claims agent breaks out of its intended scope and attacks external infrastructure" scenario is better protected by each vendor’s architecture, and it would overstate the risk to claim otherwise.

The closer, real danger for both platforms is prompt injection through the evidence they're designed to ingest. Both Clive and Wilo read and reason over unstructured claim documents, images, emails and communications as a core function. That ingestion pathway is exactly the attack surface prompt-injection research targets: manipulated content embedded in a claim document, a doctored invoice, or crafted correspondence can steer a model's output toward an attacker-specified conclusion without any sandbox being breached — the system does exactly what it's designed to do with input it has no reliable way to distinguish from legitimate evidence. This risk is now serious enough that emerging insurance-of-AI underwriting frameworks list hallucination-induced losses, prompt-injection attacks, and model drift as distinct insurable loss categories in their own right — a sign the industry is starting to treat this as a known, measurable exposure rather than a hypothetical one.

What this means for insurers evaluating these tools

The comparison suggests three practical questions worth putting to any claims-automation vendor, not just these two:

Where exactly does automation stop and human authority begin, and is that a hard rule or a configurable default? Clive's optional human-in-the-loop at intake sits at a different point on this spectrum than Wilbur's categorical human-only list for coverage, liability, settlement and payment. That difference should be a procurement question, not something discovered after go-live.

What happens when the model is wrong, not when it's uncertain? Confidence scores and visible reasoning help a reviewer catch cases the model itself flags as uncertain. They do nothing for the harder case — a fluent, well-reasoned, wrong answer the model is confident about. Ask vendors what independent accuracy testing, not just uptime or security certification, they can show.

How is ingested evidence validated before it reaches the reasoning layer? Neither vendor's public materials describe adversarial testing against prompt injection specifically. Given that reading unstructured, third-party-submitted evidence is the core function of both platforms, this is arguably the more urgent open question — more urgent, in the near term, than the sandbox-escape scenario that dominates the current headlines.

None of this is an argument against adopting these tools — the productivity case is real and the governance features on offer (audit trails, authority thresholds, visible reasoning) are a genuine improvement over ungoverned shadow AI use. It's an argument for evaluating "multi-agent" and "agentic" claims as marketing category labels that can conceal quite different autonomy postures underneath, and for insurers to interrogate the specific boundary between what the system recommends and what it's allowed to do — because that boundary, not the label on the box, is what determines the risk.

In parallel, the same care must be taken with any licensed claims platform, any core system with claims modules, and any build decisions initiated by insurers. Central

Five Sigma’s and Wilbur’s views

The article is based on published information, my own analysis, misinterpretation and any gaps in my understanding. It is only right to allow each vendor to review and comment. I have quoted without any edits. 

From Michael Krikheli Co-founder and CTO Five Sigma

“Clive does not auto-deny. High-consequence actions carry two safeguards by design: a named human verifies and owns the decision, and the recommendation arrives with links to the evidence and sources supporting it, so the reviewer is checking a cited case rather than ratifying a conclusion. The second part is not special handling for denials; it is how every output works. Your recommend-versus-allowed-to-do distinction is the right frame, and on high-risk outcomes Clive sits on the recommending side of it. Worth flagging, because the auto-denial reading is what places us at the higher-risk end of your spectrum.

On hard rule versus configurable default: configurable, and deliberately so. The carrier holds the delegated authority matrix, the jurisdictional constraints and the bad-faith exposure, so the carrier sets the boundary. But we do not hand over a configuration screen and wish them luck. Part of every implementation is working through with the client, line of business by line of business, which actions should run automatically and which should not, and why. A vendor hardcoding a categorical human-only list substitutes its own judgement for the carrier's governance, and that list will be wrong for somebody's LOB or jurisdiction. What matters is that the boundary is set consciously, enforced deterministically in code rather than requested of a model in a prompt, and auditable afterwards.

On injection we are committed to running the available screening in front of the reasoning layer, Model Armor among other tools, and to keeping pace as the techniques evolve. On the adjacent problem of hallucination, the mitigation is the same discipline: determinations are grounded in the policy record and cited back to specific source documents, so an assertion that nothing in the file supports is visible as such rather than fluent and unchecked.

One point the piece leaves out. It is fair to say new tooling widens the attack surface, and it widens it on the attacker's side too. Fabricating a convincing invoice used to take effort and usually left ‘tells’: wrong fonts, poor alignment, arithmetic that did not hold, a letterhead that was almost right. With ChatGPT and image generation tools, a claimant can now produce a clean, internally consistent, photorealistic invoice or medical report in seconds, and repeat it at volume. That does not simply add fraud to the system, it specifically erodes the control manual handling depends on, which is an experienced adjuster noticing that a document looks wrong. The tells are gone.

Which is an argument for automated analysis rather than against it. Judging a document by appearance no longer works, so the check has to be against the things a fabricated document cannot fake: the policy record, the coverage, prior activity on the file, the other invoices that vendor has submitted, whether the same document has been seen before, whether the costs are plausible for the damage described. Clive can run those checks on every document, every time, and it does not care how polished the artifact is. Where an image still carries provenance metadata (EXIF, generation tags, C2PA where it exists) Clive can look at that as well, which catches a different class of fabrication than the records check does. Metadata is trivially strippable, so neither is sufficient alone, but together they cover both the artifact and the assertions inside it.”

From Brian Siemsen CEO Wilbur

“Wilbur applies defence in depth across evidence capture, AI processing and decision-making. Evidence received through Wilbur’s evidence layer is linked to the relevant claim and submission journey. Available metadata -including source, timestamp, participant and geolocation - is automatically extracted and evaluated. Inconsistencies, such as evidence captured away from the insured risk address, are surfaced as review indicators rather than treated as proof of fraud.

Regardless of its source, evidence is handled as untrusted content for AI-processing purposes. Wilbur uses Amazon Bedrock Guardrails to detect prompt-injection attempts, separates evidence content from system instructions, and validates AI outputs before they are used by downstream workflows. Material decisions involving coverage, liability, reserves or payments remain subject to Wilbur’s authority and approval controls, with the underlying evidence visible to the authorised user.

Wilbur uses a claims-specific compound AI architecture built around four layers: claim knowledge, intelligence, orchestration and governed execution. Claim data, documents and evidence are normalised into a traceable claim representation that specialised intelligence services can analyse using retrieval, computer vision, language models, rules and validation.

The intelligence layer uses task-specific agents for functions such as triage, assessment, compliance, communications and workflow assistance. Models are accessed through Amazon Bedrock and selected according to the task and required level of reasoning, avoiding dependency on a single model.

AI outputs remain separate from authoritative claims execution. Recommendations, supporting evidence and reasoning pass through Wilbur’s workflow, identity, authority and approval controls before material changes are applied to the claims system of record. Tenant isolation, role-based access, guardrails, monitoring and auditability operate across the architecture.

Your read is fair. Wilbur combines a claims technology platform with deep claims and supply-chain domain capability embedded in the product. The distinction I would draw is the execution layer: a claim is not resolved when a decision is made; it is resolved when the property is repaired or the item is replaced.

Wilbur connects the claim, evidence and decision with the supplier and builder processes required to deliver that outcome—including supplier allocation and governance, scope and estimate management, tendering, variations, work progress and financial controls. This gives insurers visibility and control from claim intake through to repair, replacement and financial completion, rather than handing the post-decision process to disconnected systems, spreadsheets and email.

Claims AI should operate within an enterprise AI governance framework shared across technology, security, legal, risk and the relevant insurance functions. However, enterprise governance alone is not sufficient: each use case also requires claims-domain governance.

In practice, that means claims expertise must be translated into controlled knowledge sources, business rules, authority limits, workflows and evaluation criteria. Claims AI must also work with underwriting, pricing, distribution, legal and payments where their data, decisions or obligations are affected. The objective is not to give AI unrestricted access to enterprise data, but governed access to the authoritative and relevant information required for each task.

We therefore see the right model as federated governance: the enterprise defines common standards for models, security, data, monitoring and accountability, while claims-domain owners remain responsible for claims logic, conduct obligations and customer outcomes. Wilbur provides a controlled environment for applying those controls to claims evidence, recommendations, workflows and approvals, without replacing the insurer’s own accountability.

Wilbur supports delegated-authority arrangements at the product level. For each MGA product, payment authority limits can be configured according to the mandate agreed with the relevant carrier or capacity provider.

Where a payment exceeds the MGA’s delegated authority, Wilbur prevents it from proceeding without the required approval and routes it to the authorised carrier representative. Approval can be managed through system integration or through Wilbur’s insurer portal, with notifications issued to the relevant approver. The portal allows the carrier to review the claim, supporting evidence and proposed payment before approving or rejecting it.

The authority check, referral, decision and approver are retained in Wilbur’s audit history, giving both the MGA and its capacity provider a clear record that payments were managed within the agreed delegated authority.”

Sources: 

1. fivesigmalabs.com (How Clive AI Works; Security & Compliance of Clive; Clive AI Agents and Use Cases)
2. wilbur.io (Wilo Agentic AI; The Platform); Insurance Business Australia, "Wilbur unveils AI and analytics tools for insurance industry" (Sept 2024);
3. CNBC, TechCrunch, CNN, The Hacker News and Fortune reporting on the OpenAI–Hugging Face incident (July 2026);
4. Notch, "AI Hallucinations in Insurance: Risks & Fixes";
5. Insurance Thought Leadership, "Insurance AI Requires Specialized Guardrails";
6. arXiv, "Insurance of Agentic AI" (June 2026);
7. arXiv, "Prompt Injection Detection and Mitigation via AI Multi-Agent NLP Frameworks."
8. "When autonomous digital agents fight each other and forget an insurer's goals and intent," Insurtech World, drawing on Barry Rabkin & Jim Mitchell, "The Tool Master" (rabkinsopinions.com, 25 June 2026).
9. Beyond Digital FNOL- innovation across claims- a composable platform strategy Insurtech World 9 July 2026