Autonomous AI Agents Lack Protections Against Manipulation

Research by Gen Threat Labs demonstrated that AI agents treating untrusted email content as instructions can be manipulated to execute system commands, exfiltrate data, and destroy files without triggering any underlying vulnerability. As agents evolve from answering questions to autonomous action—code execution, file management, cross-service integration—their attack surface expands. Parallel malware discoveries documented Warden Stealer targeting credential files and conversation histories from AI assistants and coding tools.

Gen is deploying the Agent Trust Hub with layered defenses. Pre-installation scanning identifies malicious skills and plugins before agents can use them; early analysis found 12% of available skills contained malicious code impersonating legitimate tools. For runtime protection, Sage is an open-source safety layer intercepting commands, file operations, and web requests before execution across multiple assistants. The framework also includes an AI-native VPN with multi-tunnel isolation and a data transparency tool showing users where their information flows across AI services and stated retention practices.

To operationalize trust, Gen published AARTS, an open standard specifying how agent platforms expose security events and enforce safety decisions. The company partnered with testing standards organizations to establish methodology for independently validating agent protection claims, addressing the reality that attacks often involve multi-turn prompt injection and tool misuse rather than traditional malware signatures.