Gen Builds Trust Layer to Secure AI Agents from Hidden Threats

"When someone asks an agent to read their inbox, an email sender should have no authority over what it does next," Gen Digital wrote — and its researchers have shown exactly how that boundary can be broken.

Gen Threat Labs experiment: agents treated untrusted content as instruction

In a controlled experiment, Gen Threat Labs demonstrated how quickly an AI agent’s autonomy can become a liability. Researchers manipulated an agent through content it encountered while reading email, prompting it to execute system commands, transmit data outside its environment and perform destructive file operations. No software vulnerability was required: the agent simply treated untrusted content as instruction, the report says.

Warden Stealer and the problem of compromised configuration

Gen Threat Labs also documented Warden Stealer in October — malware that targets configuration files and local data associated with AI assistants and coding tools. According to the write-up, Warden Stealer can expose credentials, access tokens and conversation histories, turning a compromised local file into a broader access problem for any agent that uses those artifacts.

Skills, plugins, and the 12% problem on ClawHub

Agentic systems gain capability through skills, plugins and other integrations — and those same extensions can hide instructions, excessive permissions or malicious code. Gen reported that earlier this year roughly 12% of skills available on ClawHub were malicious, with many impersonating legitimate extensions while introducing instructions designed to trick agents into downloading malware. To address that surface area, Gen’s Agent Trust Hub (ATH) bundles skill scanning, a curated marketplace of trusted skills and mechanisms that let agents check themselves for safety before a capability is installed or used.

Sage, VPN for Agents, and Norton AI protections: runtime guardrails and connectivity

Verification and pre-install scanning are necessary but not sufficient. Gen describes Sage as a cross-agent safety layer for AI coding assistants that uses deterministic hook APIs to intercept shell commands, file operations and web requests before they run. Sage evaluates actions with URL reputation, threat heuristics, prompt-injection detection and supply‑chain checks and can allow an action, ask the user to decide, or deny it. Gen says Sage is open source and supports platforms including Claude Code, Cursor, VS Code, OpenClaw and OpenCode.

Complementing runtime inspection, Gen’s Agent Trust Hub includes an AI-native "VPN for Agents," built on Norton VPN infrastructure. The design provides encrypted, private connectivity without a conventional client installation and uses a multi-tunnel architecture so multiple agents can operate simultaneously through separate protected connections — including across different countries. For consumer coverage, Gen points to Norton AI Agent Protection in Norton 360, which monitors supported agent activity and adds security controls between an agent’s decision and its execution.

AMTSO collaboration, AARTS (September 2026), and what developers, security teams, and consumers should watch

• Developers and skill maintainers: The Agent Trust Hub and the skills.sh ecosystem now surface verification and visible risk ratings through a partnership with Vercel; developers can inspect Sage’s open-source code and extend detection rules, Gen says. Using those tools at development time reduces the chance that a malicious or poorly scoped skill reaches end users.
• Security teams and procurement leaders: Gen initiated a collaboration with the Anti‑Malware Testing Standards Organization (AMTSO) that produced the AI Agent Runtime Safety Standard (AARTS) in September 2026. The AARTS guidance separates detection from prevention, model behavior and protection blocking legitimate actions, and calls for reproducible test cases, documented model versions, false‑positive testing and empirical validation of vendor claims — a framework security teams can use when evaluating agent protections.
• Consumers and end users: The AI Data Checker in the Agent Trust Hub allows someone to submit an email address or username to locate where that information may appear across AI services and connected accounts and to translate dense policy language. Gen positions that tool as a way for users to understand which services collect, retain or use data for personalization, advertising or model training before granting an agent access.

Gen’s prescription is layered: verify capabilities before installation, secure how agents connect, place guardrails between decision and execution, clarify data practices and measure protections through independent testing. The goal, as Gen frames it, is to keep an agent working for the person who gave it access — even when someone else is trying to give it orders.

Read the original report: https://www.bleepingcomputer.com/news/security/you-gave-your-ai-agent-access-but-who-is-giving-it-orders/