Threats from artificial intelligence often dominate headlines with apocalyptic scenarios, yet the immediate risks are far more mundane and already present. A controlled study by Gen Threat Labs revealed how rapidly an AI agent's autonomy transforms into a security problem. Without exploiting any software flaw, researchers showed how agents could be steered through malicious content in email to run system commands, move data outside their intended environment and destroy files.
Agent capabilities are expanding at a rapid pace. What began as question-answering systems has evolved into autonomous actors that execute code, interface with external services, manipulate files and make choices on behalf of users. The transition from specialized developer tools to mainstream consumer assistants occurred swiftly, making delegation across multiple platforms routine.
Threats go beyond simple agent manipulation. In October, Gen Threat Labs uncovered Warden Stealer, a malicious program designed to target configuration data and stored information from AI assistants and development tools, risking exposure of authentication credentials, API tokens and saved conversations.
When software operates using a user's credentials and permissions, security cannot depend solely on whether a model generates reassuring responses. Users must have clarity about what an agent can reach, where it sends requests, what actions it takes and whether protective measures function as intended.
To address these concerns, Gen is introducing the Agent Trust Hub: a protective framework spanning the entire agent lifecycle, encompassing authentication, observability, operational safeguards and policy enforcement.
Trust starts before an agent acts
Agents gain new abilities through skills, plugins, tools and other add-ons. While these extensions increase agent utility, they simultaneously introduce risk through concealed directives, overly broad access rights and harmful code.
Gen researchers found that 12% of skills on ClawHub at that time contained malicious code. Many mimicked authentic tools while embedding instructions meant to trick agents into fetching malware.
The Agent Trust Hub evaluates these dangers before installation or deployment. It combines skill analysis, a vetted collection of safe skills and self-assessment mechanisms for agents. A partnership with Vercel brings authentication checks and transparent threat assessments to the skills.sh platform, where developers find and add new capabilities.
Securing how agents connect
Agents communicate with services, geographic regions and web properties at speeds and volumes that conventional user-facing security controls were not engineered to handle.
VPN for Agents, included in the Agent Trust Hub, fills this gap with a purpose-built VPN for autonomous agents. Built on Norton VPN infrastructure, it delivers encrypted, isolated connectivity without requiring traditional client software.
Its multi-tunnel design enables numerous agents to work concurrently via separate encrypted channels, spanning multiple geographic locations. This design grants users greater command over agent communications while safeguarding the agent's identity and location during operation.
Putting guardrails between decision and execution
Encrypted connections alone are insufficient. An agent may encounter a harmful website, compromised skill, prompt injection attack or incorrect package recommendation after it has already received clearance and established connectivity.
Gen's Sage functions as a unified safety layer for AI coding assistants. Employing deterministic hook APIs, it can intercept shell commands, file operations and HTTP requests before execution, rather than depending only on model instructions to behave responsibly.
Sage examines actions via multiple detection pathways, including domain reputation analysis, threat pattern recognition, injection attack identification and dependency chain verification. Based on findings, it permits an action, requests user confirmation or prevents it.
As an example, if an agent preparing a project chooses to fetch a script and run it immediately, Sage can examine the command beforehand. This protection spans multiple agents, including Claude Code, Cursor, VS Code, OpenClaw and OpenCode.
Sage is released as open source, enabling developers to review its code, modify detection logic and establish uniform interfaces across agent systems. Since no single safeguard catches all risks and Sage does not substitute for endpoint security, its purpose is to intervene at the moment an agent's autonomy becomes action.
Consumer protection follows the same runtime approach through Norton AI Agent Protection in Norton 360, which tracks supported agent behavior and introduces security controls between an agent's decision and its action.
Effectiveness depends on integration depth, as a security system requires visibility into an action and the ability to stop it.
This practical constraint motivated Gen to release AARTS, the AI Agent Runtime Safety Standard, an open specification describing how agent platforms can report security events and apply restrictions from security systems.
Making data practices easier to understand
A calendar assistant requires access to calendar data. An inbox agent needs message access. The conversation has centered on agents: "What should they be allowed to know about us," but the actual question should be whether users grasp and manage what information they surrender.
The AI Data Checker brings this transparency to the Agent Trust Hub. Users can enter an email or username to find where that information appears across AI platforms and linked services. They can then examine how services explain data gathering, storage, customization, advertising and model training.
The tool can also review an AI application's web address or policy documents, converting complex legal language into clearer summaries.
Trust needs an independent yardstick
A complete trust layer requires measurement. Security vendors should not ask users to accept unverifiable claims.
Gen partnered with the Anti-Malware Testing Standards Organization (AMTSO) to create standards for evaluating products protecting agent systems.
Released in September 2026, these standards provide a repeatable, consistent evaluation framework for consumer and business settings.
Agent-based attacks differ from traditional malware. They can involve repeated prompt injection, tool misuse, malicious skills, plugins or MCP servers. Agents can also inflict damage without attacker involvement, such as removing the wrong files or leaking information due to task misinterpretation.
The methodology therefore separates overlapping concerns: Did protection identify the threat? Did it stop the action? Did the model itself decline? Did protection block legitimate operations?
The standard also demands repeatable test scenarios, recorded model versions, false-positive evaluation and proof of vendor assertions.
Building confidence without slowing progress
The era of agentic systems does not require a single universal solution. It demands layered defenses that authenticate capabilities, protect communications, enforce limits, illuminate data handling and demonstrate results through independent assessment.
When a user directs an agent to access their inbox, the sender of an email should have no power over the agent's subsequent behavior. A trust layer's purpose is maintaining this boundary: ensuring an agent serves the person who authorized it, not someone attempting to issue conflicting commands.