Gen Digital pitches a trust layer for AI agents that follow orders

Gen Digital has set out its case for a control layer around AI agents, in a piece published by BleepingComputer on 23 October 2026. The company said AI agents can be manipulated through malicious emails, websites and plugins into executing commands, stealing data or deleting files, and that they do so using the legitimate permissions their owners granted them.

That last point is the heart of the problem the vendor describes. An agent that has been given access to a mailbox, a file store or a shell is not breaking in when it misbehaves. It is doing what it was told, by whoever managed to get text in front of it. The distinction matters for defenders, because traditional controls that ask whether an account is allowed to perform an action will answer yes.

According to Gen Digital, its Agent Trust Hub is intended to close that gap in three ways. The first is skill verification, meaning checks on the tools and plugins an agent is allowed to use. The second is secure connectivity between the agent and the systems it reaches. The third is runtime controls that intercept dangerous actions as they are attempted, rather than relying on policy set in advance.

The framing matches a theme that has become common in agent security over the past year. Once an agent can read untrusted content and then act, the content becomes a potential source of instructions. Emails, web pages and third-party plugins are all channels where an attacker can place text that the agent may treat as a command. Gen Digital names all three as manipulation routes.

Buyers should read the claims carefully. The published material describes the product's goals rather than measured results, and does not set out independent testing, detection rates or the conditions under which interception succeeds or fails. Nor does it describe how the hub decides that an action is dangerous, which is the hard part of any runtime control. Organisations evaluating this class of product will want that detail before assuming coverage.

The underlying advice does not depend on any one vendor. Agents should hold the narrowest permissions that let them do their job. Actions with real consequences, such as sending money, deleting data or changing access, are better placed behind a human confirmation step. Logs should record what the agent did and what input prompted it, so that an incident can be reconstructed afterwards. Gen Digital's pitch is that these controls belong in one place, enforced as the agent runs.

The company's question in the headline of its piece remains the useful one for any team deploying agents at work. Access is the part organisations decide deliberately. Instructions are the part they often do not control at all.