Researchers steered an AI agent into harmful actions through email content alone
The attack needed no software bug, and the agent's own permissions were enough to run commands, send data out and delete files.
Gen's research shows how an AI agent can be steered into harmful actions just by reading manipulated email content, with no software bug needed: it ran system commands, sent data out, and deleted files. Gen also flagged Warden Stealer malware that targets the config files and tokens used by AI assistants, and reported that 12% of the skills on ClawHub were malicious when checked. In response, Gen is building an Agent Trust Hub that vets skills before install, offers an AI-native VPN for agent connections, and includes Sage, an open-source hook layer that can inspect and block shell, file and web actions before they execute. Gen is also publishing AARTS, an open spec for how agent platforms expose security events and accept enforcement decisions.
Why it matters
The findings show that anyone who can get text in front of an AI agent may be able to direct its actions, so the risk sits in what agents read as much as in what they are allowed to do. Malicious skills and malware aimed at assistant config files add further routes in. Gen's responses, a pre-install skill check, action inspection before execution and an open spec for security events, all point at controlling what an agent does rather than trusting its input.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.