AI agents can turn untrusted content into real-world actions, creating security risks even when no software vulnerability is involved. Research from Gen Threat Labs shows that an agent reading an email could be manipulated into running system commands, sending data outside its environment, or performing destructive file operations. As agents gain the ability to run code, connect to services, manage files, and make decisions for users, layered safeguards are needed to validate their tools, secure their connections, control execution, clarify data practices, and independently test their protections.
Headlines often warn that AI could threaten humanity, making the issue seem like science fiction. The more immediate danger is more ordinary—and is already present.
A study published by Gen Threat Labs demonstrates how quickly an AI agent’s autonomy can become a liability. In a control experiment, researchers manipulated an agent through content it encountered while reading an email. The content prompted the agent to execute system commands, send data outside its environment, and perform destructive file operations.
No software vulnerabilities were required. The agent simply treated untrusted content as an instruction.
That autonomy is expanding. Agents are moving beyond answering questions to running code, connecting to services, managing files, and making decisions on behalf of users.
Tools such as OpenClaw are helping move AI from developer-focused environments into personal assistants such as Muse. Delegating work across platforms is becoming a common way for people to interact with AI.
The risks also extend beyond what agents do. In October, Gen Threat Labs documented Warden Stealer, malware that targets configuration files and local data associated with AI assistants and coding tools. It could expose credentials, access tokens, and conversation history.
If software can act with a user’s permissions, trust cannot be reduced to whether a model produces answers that appear safe. Users need to know what agents can access, which services they connect to, what they are doing, and whether the protections around them are working.
Gen’s Agent Trust Hub is designed as a trust layer covering the agent lifecycle, from validation and visibility to runtime safety and enforcement.
Trust begins before the agent acts
Agent systems gain functionality through skills, plugins, tools, and other integrations. These additions make agents more useful, but they can also introduce hidden instructions, excessive privileges, and malicious code.
Earlier this year, Gen researchers reported that 12% of the skills available on ClawHub were malicious at the time. Many masqueraded as legitimate extensions and included instructions intended to trick agents into downloading malware.
Agent Trust Hub helps assess these risks before features are installed or used. It brings together Skill Scan and a curated marketplace of trusted skills, along with a mechanism intended to help agents protect themselves. Through Gen’s partnership with Vercel, the company is also introducing validation and visible risk assessments to the Skills.sh ecosystem, where developers discover and install new features.
Secure how agents connect
Agents communicate across services, regions, and websites, often at a speed and scale that traditional, human-oriented controls cannot manage.
Agent VPN, part of Agent Trust Hub, is an AI-native VPN designed for autonomous agents. It uses Norton VPN infrastructure to provide private, encrypted connectivity without requiring users to install a traditional client.
Its multi-tunnel design allows multiple agents to operate simultaneously through separate, secured connections across different countries.
This architecture gives users greater control over how agents communicate and helps protect an agent’s identity and location while it operates.
AI agents can install skills and perform actions on a user’s behalf, making a single compromised skill a security risk.
Gen’s Agent Trust Hub provides free tools to scan skills before installation and control what agents can access.
Put guardrails between decision-making and execution
A secure connection is necessary but not sufficient. Agents can encounter malicious web pages, poisoned skills, prompt injections, and hallucinated packages after they have been trusted and connected.
Gen’s Sage is designed as a cross-agent safety layer for AI coding assistants. Its deterministic hook API can intercept shell commands, file operations, and web requests before they are executed, rather than relying only on instructions that the model is expected to follow.
Sage evaluates actions through multiple detection layers, including URL reputation, threat heuristics, prompt-injection detection, and supply-chain checks. Depending on the result, it can allow an action, ask the user to decide, or decline it.
For example, if an agent configuring a project decides to download a script and run it immediately, Sage can inspect the command before execution. The approach provides a safety layer across supported agents such as Claude Code, Cursor, VS Code, OpenClaw, and OpenCode.
Sage is also open source, allowing developers to inspect its behavior, extend detection rules, and build common interfaces across agent platforms. No single layer can catch every risk, and Sage is not a replacement for endpoint protection. Its focus is the moment when an agent’s autonomy is exercised.
This runtime approach also extends to consumers through Norton AI Agent protection for Norton 360, which monitors supported agent activity and adds security controls between an agent’s decisions and execution.
Coverage depends on integration because security engines need visibility into an agent’s actions and a way to stop them.
This practical limitation also led Gen to publish AARTS, the AI Agent Runtime Safety Standard, an open specification for how agent platforms expose security events and enforce decisions from security engines.
Make data practices easier to understand
An assistant that organizes calendars needs calendar information, while an agent that manages an inbox needs access to messages. The question is whether users can understand and control what they share.
AI Data Checker adds a visibility layer to Agent Trust Hub. When users submit an email address or username, they can determine where that information appears across AI services and connected accounts. They can then explore how each service describes data collection, retention, personalization, advertising, and model training.
The tool can also analyze AI app URLs and terms pages, translating dense policy language into more accessible information.
Trust requires independent standards
The final part of the trust layer is measurement. Security providers should not ask people to rely on claims that cannot be independently checked.
Gen’s collaboration with the Anti-Malware Testing Standards Organization (AMTSO) focuses on developing guidelines for testing products that protect agent systems.
Published in September 2026, the guidelines establish a framework for reproducible and comparable assessments across consumer and corporate environments.
Agent attacks do not necessarily involve dropping files into a scanner. They can involve multi-turn prompt injection, tool misuse, malicious skills, plugins, or MCP servers. Agents can also cause damage without an attacker being present, such as deleting the wrong files or leaking data after misunderstanding a task.
The methodology therefore separates questions that are often blurred together: Did the protection detect a threat? Did it prevent the action? Did the underlying model reject the request itself? Did the protection block legitimate activity?
It also requires reproducible test cases, documented model versions, false-positive testing, and empirical validation of vendor claims.
Build confidence without slowing progress
In the age of AI agents, users do not need a magic shield. They need layers of protection that validate functionality, secure connections, enforce guardrails, clarify data practices, and demonstrate effectiveness through independent testing.
If someone asks an agent to read an inbox, the sender of an email should not be able to decide what the agent does next. The trust layer’s job is to protect that boundary, so the agent continues to serve the person who granted it access even when someone else is trying to issue commands.
Before installing skills or plugins, visit the Gen Agent Trust Hub and make sure your agents accept orders only from you.
Sponsored and written by Gen Digital.
Source: www.bleepingcomputer.com