Clarissa Hana
The looming specter of artificial intelligence threatening humanity, a staple of science fiction, often overshadows the more immediate and tangible dangers that are already permeating our digital lives. While headlines paint dramatic scenarios of rogue AI, the real peril lies in the mundane, everyday interactions with AI agents that are rapidly gaining autonomy and operating with user permissions. Recent research from Gen Threat Labs has starkly illuminated this evolving threat landscape, demonstrating how easily these autonomous agents can be manipulated, leading to unintended and potentially destructive actions, all without exploiting traditional software vulnerabilities.
The core of the problem, as highlighted by Gen Threat Labs’ controlled experiments, lies in the fundamental way these AI agents process information. Researchers were able to induce an AI agent to execute system commands, exfiltrate data, and perform destructive file operations simply by feeding it untrusted content within its email environment. The agent, designed to interpret and act upon information, treated this malicious content as legitimate instructions. This lack of inherent skepticism towards external data, coupled with expanding AI capabilities, creates a significant security blind spot.
This phenomenon is not confined to theoretical research. The rapid evolution of AI agents from specialized developer tools like OpenClaw to ubiquitous personal assistants such as Muse underscores the swift transition from isolated applications to deeply integrated digital companions. As these agents become more adept at performing tasks on our behalf – executing code, connecting to services, managing files, and making decisions – the delegation of work across platforms becomes increasingly commonplace. This shift necessitates a fundamental re-evaluation of trust in our digital interactions.
Beyond the direct manipulation of agent behavior, the security risks extend to the very data these AI systems process. Gen Threat Labs’ recent discovery of Warden Stealer, a type of malware specifically targeting configuration files and local data associated with AI assistants and coding tools, serves as a chilling reminder of the vulnerabilities present. This malware is designed to pilfer sensitive information like credentials, access tokens, and even entire conversation histories, exposing users to a wide range of cyber threats.
The implications of AI agents acting with user permissions are profound. Trust can no longer be solely based on the perceived safety of an AI’s output; it must extend to understanding the agent’s operational parameters. This includes knowing precisely what data an agent can access, where it is connecting, what actions it is performing, and whether robust security measures are in place to govern these operations.
Recognizing this critical need, Gen Digital has developed the Agent Trust Hub (ATH). This initiative aims to establish a comprehensive trust layer designed to provide protection across the entire lifecycle of an AI agent, encompassing verification, visibility, runtime safety, and enforcement.
The Pre-Action Imperative: Verifying Agent Capabilities
The power of agentic systems is largely derived from their ability to integrate with various skills, plugins, and tools. While these extensions significantly enhance an agent’s utility, they also introduce new vectors for risk. Hidden instructions, excessive permissions, and the potential for malicious code are inherent concerns.
Earlier this year, Gen researchers uncovered a disturbing trend: approximately 12% of skills available on ClawHub at the time were found to be malicious. These deceptive extensions often impersonated legitimate tools while embedding instructions designed to trick agents into downloading and executing malware. This underscores the critical importance of vetting these capabilities before they are deployed.
The Agent Trust Hub directly addresses this pre-action risk through its integrated skill scanning capabilities. It offers a curated marketplace of trusted skills, providing users with a more secure environment for discovering and integrating new functionalities. Furthermore, mechanisms are in place for agents to self-assess their safety before executing any task. Gen’s strategic partnership with Vercel further bolsters this initiative, embedding verification processes and visible risk ratings directly into the skills.sh ecosystem, a popular platform for developers to find and install AI capabilities.
Securing the Arteries: Ensuring Safe Agent Connectivity
AI agents operate in a dynamic and interconnected digital landscape, communicating across a multitude of services, geographical regions, and websites. The speed and scale of this communication often outpace the capabilities of traditional human-centric security controls.
To bridge this connectivity gap, the ATH introduces VPN for Agents. This AI-native VPN, powered by Norton’s robust infrastructure, provides encrypted and private connectivity for autonomous agents without the need for conventional client installations. Its sophisticated multi-tunnel design allows multiple agents to operate concurrently through separate, protected connections, even across different countries. This architecture empowers users with enhanced control over their agents’ communications, safeguarding their identity and location while they perform their designated tasks.
The Crucial Intermediary: Guardrails Between Decision and Execution
While secure connectivity is a fundamental requirement, it is not a panacea. Even with a secure connection, an agent can encounter malicious web pages, compromised skills, sophisticated prompt injection attacks, or even "hallucinated" packages after it has been authenticated and connected.
Gen’s open-source solution, Sage, acts as a cross-agent safety layer specifically for AI coding assistants. Utilizing deterministic hook APIs, Sage intercepts critical actions – including shell commands, file operations, and web requests – before they are executed. This proactive approach moves beyond simply instructing models to be cautious, instead providing a robust safety net.
Sage employs a multi-layered detection system that evaluates actions based on URL reputation, threat heuristics, prompt injection detection, and supply-chain integrity checks. Depending on the assessed risk, Sage can either allow the action, prompt the user for explicit approval, or deny it outright. For instance, if an agent tasked with setting up a new project attempts to download and immediately execute a script, Sage can scrutinize this command before it is run. This comprehensive approach offers protection across a range of supported agents, including Claude Code, Cursor, VS Code, OpenClaw, and OpenCode.
The open-source nature of Sage allows developers to inspect its inner workings, contribute to its detection rules, and foster the development of common interfaces across various agent platforms. While no single security layer can eliminate all risks, Sage focuses on the critical juncture where an agent’s autonomy transitions into tangible execution.
This runtime security philosophy also extends to consumers through Norton AI Agent Protection, integrated within Norton 360. This feature actively monitors supported agent activity, implementing security controls to act as a buffer between an agent’s decision and its execution. The effectiveness of such security engines is contingent on their ability to gain visibility into an agent’s actions and possess the capability to intervene.
This practical limitation has also driven Gen to publish AARTS, the AI Agent Runtime Safety Standard. This open specification outlines how agent platforms can expose security events and enforce decisions made by security engines, fostering interoperability and a more standardized approach to AI agent security.
Illuminating the Data Trail: Making Data Practices Transparent
The functionality of AI assistants often hinges on their access to personal information. An assistant organizing a calendar requires calendar data, and an agent managing an inbox needs access to messages. The critical question shifts from "Should they know anything about us?" to "Can users understand and control what they share?"
The AI Data Checker, a component of the Agent Trust Hub, provides this much-needed visibility. By submitting an email address or username, users can identify where their information might appear across various AI services and connected accounts. This allows them to explore how these services describe their data collection, retention policies, personalization strategies, advertising practices, and model training methodologies. The tool can also analyze AI app URLs or terms of service pages, translating dense policy language into more digestible information for the average user.
The Unseen Measure: The Need for an Independent Yardstick
The final, and perhaps most crucial, element of a robust trust layer is independent measurement. Security providers should not expect users to rely solely on unsubstantiated claims.
Gen Digital has proactively initiated a collaboration with the Anti-Malware Testing Standards Organization (AMTSO) to develop comprehensive guidelines for testing products designed to protect agentic systems. Published in September 2026, these guidelines establish a repeatable and comparable framework for evaluating the effectiveness of agentic security products across both consumer and enterprise environments.
The evolving nature of agentic attacks necessitates a nuanced testing methodology. These attacks are not always confined to traditional file-based threats; they can encompass multi-turn prompt injection, misuse of agent tools, malicious skills, plugins, or even compromised backend servers. Furthermore, agents can inadvertently cause harm without direct malicious intent, such as deleting incorrect files or exposing sensitive data due to misinterpreting a task.
The AMTSO methodology thoughtfully separates distinct evaluation criteria: Did the protection detect the threat? Did it successfully prevent the action? Did the underlying AI model autonomously refuse the action? Critically, did the protection mechanism inadvertently block legitimate user activity? The guidelines also emphasize the importance of reproducible test cases, documented model versions, thorough false-positive testing, and empirical validation of vendor claims.
Cultivating Confidence, Not Stifling Innovation
The dawn of the agentic era does not require a singular, miraculous solution. Instead, it demands a layered defense strategy that encompasses robust verification of capabilities, secure communication channels, enforceable guardrails, transparent data practices, and demonstrable effectiveness validated by independent testing.
When a user instructs an agent to access their inbox, the authority over the agent’s subsequent actions should reside solely with the user. Protecting this critical boundary is the fundamental role of a trust layer. It ensures that an AI agent remains a tool working for its designated user, even when external parties attempt to issue conflicting or malicious directives.
Before integrating any new skill or plugin into your AI workflow, it is paramount to visit the Gen Agent Trust Hub. By doing so, you can take a proactive step towards ensuring that your AI agents are exclusively taking orders from you.
This article was sponsored and written by Gen Digital.
