Gen outlines layered security protections for AI agents
Summary
Gen describes a controlled test in which an AI agent followed malicious email instructions, alongside tools and testing guidelines intended to help secure agents. The sponsored article also reports malware and malicious skills targeting AI tools.
Key points
- Gen Threat Labs says a controlled experiment manipulated an email-reading agent into running system commands, sending data outside its environment and performing destructive file operations; the agent treated untrusted content as instructions.
- Gen documented Warden Stealer targeting configuration files and local data associated with AI assistants and coding tools, potentially exposing credentials, access tokens and conversation histories.
- Gen researchers reported that 12% of skills available on ClawHub at the time were malicious; some impersonated legitimate extensions and included instructions to download malware.
- Gen’s Agent Trust Hub combines skill scanning, a curated skills marketplace and agent self-checks; a partnership with Vercel adds verification and risk ratings to the skills[.]sh ecosystem.
- Gen says Sage uses deterministic hooks to inspect shell commands, file operations and web requests before execution, applying URL-reputation, heuristic, prompt-injection and supply-chain checks to allow, question or deny actions.
- Gen published AARTS, an open specification for agent security events and enforcement. Testing guidelines developed with AMTSO call for repeatable tests, documented model versions, false-positive testing and empirical validation of vendor claims.
Article Details
- Event Type
- Gen Digital security research and announcement of protections for AI agents.
- Impact
- Gen Threat Labs reported that, in a controlled experiment, untrusted email content manipulated an AI agent into executing system commands, transmitting data outside its environment, and performing destructive file operations, without requiring a software vulnerability. Gen also reported that 12% of skills available on ClawHub were malicious at the time of its earlier research, and documented Warden Stealer targeting configuration files and local data associated with AI assistants and coding tools, potentially exposing credentials, access tokens, and conversation histories. Gen describes the Agent Trust Hub and related protections as ways to assess agent capabilities, secure connections, and mediate actions.
Malware
Vendors
Products
Agent Trust HubThat is why Gen is building the Agent Trust Hub: a trust layer designed to extend protection across the agent lifecycle, from verification and visibility to runtime safety and enforcement.AI Data CheckerThe AI Data Checker adds that visibility layer to the Agent Trust Hub.ClawHubEarlier this year, Gen researchers identified that 12% of skills available on ClawHub – at the time – were malicious.Norton 360That runtime approach also extends to consumers through Norton AI Agent Protection in Norton 360, which monitors supported agent activity and adds security controls between an agent’s decision and its execution.Norton AI Agent ProtectionThat runtime approach also extends to consumers through Norton AI Agent Protection in Norton 360, which monitors supported agent activity and adds security controls between an agent’s decision and its execution.Norton VPNPowered by Norton VPN infrastructure, it provides encrypted, private connectivity without requiring a conventional client installation.SageGen’s Sage is designed as a cross-agent safety layer for AI coding assistants.VPN for AgentsVPN for Agents, a part of the ATH, addresses that connectivity gap with an AI-native VPN built for autonomous agents.