Researchers got an AI agent to run commands, send out data and delete files just by having it read an email. Anyone who gives an assistant access should know why.
Security researchers at Gen Threat Labs showed that an AI agent can be pushed into harmful acts by the content it reads, including a single email. In a controlled test, the agent read a message and then ran system commands, sent data out of its environment and deleted files. It used the permissions its owner had already given it.
No software flaw was needed. The agent treated untrusted content as an instruction. An AI agent is an assistant that does not just answer questions. It takes action for you, such as running code, managing files and connecting to services. If it cannot tell your orders from text in an email, whoever writes that text can steer it.
Agents gain abilities through add-ons, called skills or plugins. Earlier this year, Gen found that 12% of the skills on ClawHub were malicious at the time. Many posed as real ones and carried instructions meant to trick agents into downloading malware.
A separate threat came up in October. Gen documented Warden Stealer, malware that goes after files holding settings and local data for AI assistants and coding tools. That could expose logins, access tokens and chat histories. The material does not say how widespread it is.
The warning applies to people and businesses using AI agents or coding assistants, such as OpenClaw, Claude Code, Cursor and VS Code. It also covers anyone who installs agent add-ons. If an assistant only answers questions and cannot touch your email, files or accounts, the risk described here is smaller. The more access an agent has, the more a trick can cost.
Gen sells and promotes tools for this problem, so its claims come from a company with a product. Its Agent Trust Hub includes free scanners that check a skill before installation. Sage, an open source tool, can inspect shell commands, file actions and web requests before an agent runs them. Norton 360 now includes AI agent protection for consumers.
Gen admits the limits. No single layer catches every risk, and Sage does not replace regular endpoint protection. Coverage also depends on whether a tool can see and stop an agent's action in each program.
The steps in the alert box above come down to a few habits: limit what an agent can reach, be picky about add-ons, and approve risky actions yourself. These work whether or not a security product is involved.
Agents are taking on more tasks across more platforms, and that is likely to draw more attention from attackers. Gen has also published an open standard, called AARTS, for how agent platforms can share security events with security tools. Whether other platforms adopt it is not yet known.
Give an AI agent only the access it needs, install add-ons only from trusted sources, and approve risky actions yourself.
A viral ChatGPT prompt turns what the chatbot remembers about you into a room image. Posting it publicly could give scammers clues to target you.
Read more: Viral ChatGPT room image could hand scammers clues about youDARPA wants AI to hunt for design flaws in stock, bond, energy and cloud markets, so enemies cannot use them to cause economic damage that reaches households.
Read more: Pentagon wants AI to find weak spots in stock and energy marketsTuring Award winner Richard Sutton says more computing power alone will not make AI truly smart. Big AI companies disagree, which matters for anyone betting on AI.
Read more: AI pioneer says piling on computing power won't make machines smart
