Headlines warn that AI could threaten humanity, and it’s easy to wave that off as science fiction. But the real danger is more ordinary and already here.
Research published by Gen Threat Labs demonstrated how quickly an AI agent’s autonomy can become a liability. In a controlled experiment, researchers manipulated an agent through content it encountered while reading email, prompting it to execute system commands, transmit data outside its environment and perform destructive file operations.
No software vulnerability was required. The agent simply treated untrusted content as instruction.
That autonomy is expanding daily. Agents are moving from answering questions to taking action doing everything from executing code, connecting to services, managing files and making decisions on a user’s behalf.
The shift from developer-focused tools like OpenClaw to widespread use of personal assistants like Muse, happened quickly. Delegating work across platforms is becoming commonplace and how people interact with AI.
The risks extend beyond manipulating agents. In October, Gen Threat Labs documented Warden Stealer, malware targeting configuration files and local data associated with AI assistants and coding tools, potentially exposing credentials, access tokens and conversation histories.
When software can act with a user’s permissions, trust can’t be reduced to whether a model produces a safe-sounding answer. People need to know what an agent can access, where it is connecting, what it is doing and whether the protection around it works.
That is why Gen is building the Agent Trust Hub: a trust layer designed to extend protection across the agent lifecycle, from verification and visibility to runtime safety and enforcement.
Trust starts before an agent acts
Agentic systems gain capabilities through skills, plugins, tools and other integrations. These extensions make agents more useful, but they also expand risk by introducing hidden instructions, excessive permissions, and malicious code.
Earlier this year, Gen researchers identified that 12% of skills available on ClawHub – at the time – were malicious. Many impersonated legitimate extensions while introducing instructions designed to trick agents into downloading malware.
The Agent Trust Hub (ATH) helps assess these risks before a capability is installed or used. It brings together skill scanning, a curated marketplace of trusted skills and mechanisms that allow agents to check themselves for safety. Gen’s partnership with Vercel also brings verification and visible risk ratings into the skills.sh ecosystem, where developers discover and install new capabilities.
Securing how agents connect
Agents communicate across services, regions and websites, often at a speed and scale that traditional human-oriented controls were not designed to manage.
VPN for Agents, a part of the ATH, addresses that connectivity gap with an AI-native VPN built for autonomous agents. Powered by Norton VPN infrastructure, it provides encrypted, private connectivity without requiring a conventional client installation.
Its multi-tunnel design allows multiple agents to operate simultaneously through separate protected connections, including across different countries.
The architecture gives people greater control over how agents communicate and helps protect an agent’s identity and location while it works.
AI agents can install skills and take action on your behalf, which makes a single compromised skill a security risk.
Gen’s Agent Trust Hub provides free tools that scan skills before installation and let you control what your agents can access.
Putting guardrails between decision and execution
Secure connectivity is necessary, but insufficient on its own. An agent may encounter a malicious web page, poisoned skill, prompt injection or hallucinated package after it has already been trusted and connected.
Gen’s Sage is designed as a cross-agent safety layer for AI coding assistants. Using deterministic hook APIs, it can intercept shell commands, file operations and web requests before they run, rather than relying solely on instructions asking the model to be careful.
Sage evaluates actions through multiple detection layers, including URL reputation, threat heuristics, prompt-injection detection and supply-chain checks. Depending on the result, it can allow an action, ask the user to decide or deny it.
For example, if an agent setting up a project decides to download a script and immediately execute it, Sage can inspect that command before it runs. The approach provides a safety net across supported agents, including Claude Code, Cursor, VS Code, OpenClaw and OpenCode.
Sage is also open source, allowing developers to inspect its operation, extend detection rules and build common interfaces across agent platforms. No single layer can catch every risk, and Sage doesn’t replace endpoint protection. Its focus is on the moment an agent’s autonomy becomes execution.
That runtime approach also extends to consumers through Norton AI Agent Protection in Norton 360, which monitors supported agent activity and adds security controls between an agent’s decision and its execution.
Coverage depends on the integration, because a security engine needs visibility into an action and a way to stop it.
That practical limitation also led Gen to publish AARTS, the AI Agent Runtime Safety Standard, an open specification for how agent platforms can expose security events and enforce decisions from security engines.
Making data practices easier to understand
An assistant organizing a calendar needs calendar information. An agent managing an inbox needs access to messages. We’ve framed the question around agents: “Should they know anything about us,” when we should be asking whether users can understand and control what they share.
The AI Data Checker adds that visibility layer to the Agent Trust Hub. People can submit an email address or username to help identify where that information may appear across AI services and connected accounts. They can then explore how services describe data collection, retention, personalization, advertising and model training.
The tool can also analyze an AI app’s URL or terms page, translating dense policy language into more accessible information.
Trust needs an independent yardstick
The final part of a trust layer is measurement. Security providers shouldn’t ask people to rely on claims that can’t be independently checked.
Gen initiated a collaboration with the Anti-Malware Testing Standards Organization (AMTSO) to develop guidelines for testing products that protect agentic systems.
Published in September 2026, the guidelines establish a framework for repeatable, comparable evaluation across consumer and enterprise environments.
Agentic attacks are not always files that can be dropped into a scanner. They can involve multi-turn prompt injection, tool misuse, malicious skills, plugins or MCP servers. Agents can also cause harm without an attacker, such as deleting the wrong files or exposing data after misunderstanding a task.
The methodology therefore separates questions often blurred together: Did protection detect the threat? Did it prevent the action? Did the underlying model refuse on its own? Did protection block legitimate activity?
It also calls for reproducible test cases, documented model versions, false-positive testing and empirical validation of vendor claims.
Building confidence without slowing progress
The agentic era does not need a single magic shield. It needs layered protection that can verify capabilities, secure connections, enforce guardrails, clarify data practices and demonstrate effectiveness through independent testing.
When someone asks an agent to read their inbox, an email sender should have no authority over what it does next. Protecting that boundary is the job of a trust layer: keeping an agent working for the person who gave it access, even when someone else is trying to give it orders.
Before you install your next skill or plugin, visit the Gen Agent Trust Hub and make sure your agent only takes orders from you.
Sponsored and written by Gen Digital.
