Global Privacy Compliance Program Manager

Explore Gen™ leadership perspectives and hear from industry experts talking about trending topics, the digital landscape, and the latest cybersecurity news.

Corporate Manager

Leadership Perspectives

There’s a quiet shift happening with money right now. Gen Z isn’t just earning, spending and saving differently; they’re doing it in a world where your financial life is fully online, constantly moving and, frankly, a little chaotic. One minute it’s budgeting tips on TikTok, the next it’s a “too good to be true” investment ad sliding into your feed.So let’s strip it back. Financial safety isn’t about being perfect. It’s about being prepared before something goes sideways.&nbsp;<h4>Start with this: safety beats strategy</h4>There’s a lot of noise around investing early, building passive income or chasing the next big thing. And yes, Gen Z is already jumping into investing earlier than previous generations, often using digital platforms to take control of their finances.But here’s the part that gets skipped: none of that works if your foundation isn’t solid.Financial safety starts with three basics: • Cash buffer (even a small one) • Controlled spending • Awareness of risk (scams, debt, bad advice)Because right now? A lot of Gen Z doesn’t have that safety net. Around 62% don’t have emergency savings, and many rely on credit cards to get through unexpected expenses.That’s not a personal failure. It’s the reality of higher costs, unstable income and a system that wasn’t exactly designed to be easy.But it does mean one thing: building your own safety net matters more than ever.&nbsp;<h4>The smartest move: know where your money is going</h4>You don’t need a complicated system. You just need visibility.Call it budgeting, call it tracking, call it not being surprised at the end of the month. It’s all the same thing.A simple framework like 50/30/20 (needs, wants, savings) still works. But Gen Z is remixing it into something more real: intentional spending. Think “loud budgeting,” being honest about what you’re prioritizing and what you’re not.Translation: You’re not broke. You’re choosing where your money goes.That mindset shift alone is powerful.&nbsp;<h4>Build a buffer before you build wealth</h4>It’s tempting to jump straight into investing. But if one unexpected expense can wipe you out, you’re building on shaky ground.Start smaller: • Aim for $500 to $1,000 in emergency savings • Then grow toward 3 to 6 months of expensesIt doesn’t happen overnight. That’s fine. Consistency beats intensity here.Because when something goes wrong, and it will, you won’t have to rely on high interest debt to survive it.&nbsp;<h4>Watch the digital traps</h4>This is where financial safety gets very real.Gen Z lives online. That means your money does too. And that’s exactly where scammers operate.Fake ads. Impersonation. “Investment opportunities” that look just legitimate enough. These aren’t edge cases. They are designed to blend in with everything else you scroll past.And it works.There’s also a gap worth calling out: confidence doesn’t always equal protection.Gen Z is one of the most confident generations when it comes to spotting scams, but they’re also engaging with them at significantly higher rates than older generations, in some cases nearly double. (<a href="https://dataconomy.com/2025/08/11/gen-z-fall-for-online-scams-more-than-twice-as-often-as-older-ones/?utm_source=chatgpt.com">dataconomy.com</a>)And when scams work, they don’t just take money. They take identity.According to the Identity Theft Resource Center, many of today’s scams are designed to get people to willingly share personal information, including login details, Social Security numbers or verification codes. That information is then used to open new accounts or take over existing ones. (<a href="https://www.prweb.com/releases/identity-theft-resource-center-2025-trends-in-identity-report-impersonation-scams-rise-148-percent--become-top-reported-scam-302477300.html?utm_source=chatgpt.com">prweb.com</a>)That shift matters. Because identity theft isn’t a future problem. It is often the next step after a single click, message or seemingly harmless interaction.As Eva Velasquez, CEO of the Identity Theft Resource Center (ITRC), puts it: “We have to stop looking at identity theft and financial loss as two separate problems. Your identity is the ‘key’ to your entire financial house. If a scammer gets your login or your Social Security number, they don’t just take your money; they take your ability to build a future. Protecting your personal data is the most foundational investment you can make in your financial health.”If your financial life lives online, your identity is part of your financial safety net. Protecting it isn’t optional anymore. It is foundational.A few rules that hold up:<ul><li data-list-item-id="e68f7e0771c4abf542347cf3d63d577c2">If it creates urgency, pause</li><li data-list-item-id="eb8ea324e46df96adbfd24483ec6a98f6">If it promises easy money, question it</li><li data-list-item-id="e74a7beb276a369d3825446def9da1a64">If it looks legit but feels off, trust that instinct</li></ul>Being skeptical isn’t negativity. It’s protection.If you want to go deeper, the&nbsp;<a href="https://www.idtheftcenter.org/reports/?utm_source=chatgpt.com">Identity Theft Resource Center’s latest reports and resources</a> break down how these scams are evolving and what to watch for.

<h4>Use tools that actually help you move forward</h4>This part matters more than ever: you don’t have to figure all of this out alone.The line between financial health and digital safety is disappearing. That’s why platforms are starting to bring both together.MoneyLion, now part of Gen, is a good example of that shift. It’s built to help people not just manage money, but actually move forward with it: tracking spending, building credit, accessing tools that make financial progress feel doable.Because financial safety isn’t just about avoiding risk. It’s about having the confidence to act.&nbsp;<h4>You’re not behind. You’re early</h4>It’s easy to feel like you’re late with money. Like you should already have it figured out.You’re not. You’re early.Gen Z is already reshaping how money works. There are more open conversations, earlier investing and more willingness to question the system.The goal isn’t perfection. It’s momentum.Start with:<ul><li data-list-item-id="e25fe3be553f9c23cfc8ba4ecd87a05ae">Knowing your numbers</li><li data-list-item-id="e947fbae986f88ac1b2176531fd700260">Building a small safety net</li><li data-list-item-id="e1072ff692e39775a264cf450c494ccb5">Staying sharp online</li><li data-list-item-id="eaa82b9c8751df887da9a64a66a4100ff">Using tools that actually support you</li></ul>That’s Financial Safety 101.Not flashy. Not viral. But it works.And once that foundation is there, everything else, investing, growing, building real wealth, gets a whole lot easier.

From budgeting to scams to identity theft, here’s how Gen Z can build a financial foundation that actually holds up online

Financial Safety 101 for Gen Z: Build It Before You Need It

Security Evangelist at Gen

“Is this a scam?” has become one of the defining questions of the digital era.&nbsp;What is changing is not just the volume of these messages. It is how people respond to them. Only now, instead of asking a friend this question, they’re turning to ChatGPT. This shift marks a profound inflection point in human technology interaction. AI is no longer just a productivity tool or a content assistant. It is becoming a decision layer. A reasoning partner. A first checkpoint before action.&nbsp;At Gen, we see this as more than a trend. It signals the emergence of a new trust architecture for the internet.&nbsp;<h2>AI is becoming the first line of defense&nbsp;</h2>According to the <a href="https://www.gendigital.com/blog/insights/reports/threat-report-q4-2025" target="_blank" rel="noreferrer noopener">Gen Threat Report</a>, more than 90 percent of threats targeting people in 2025 stemmed from scams, phishing and deceptive advertising. The dominant risk online today is not malware quietly infecting a system. It is manipulation persuading a person.&nbsp;In parallel, AI tools like ChatGPT are becoming deeply embedded in everyday workflows. People use them to draft emails, compare products, research decisions and increasingly to validate suspicious messages.&nbsp;That convergence creates both opportunity and responsibility. If AI is where decisions are being shaped, then security intelligence must live there too.&nbsp;<h2>From reactive security to decision-centric protection&nbsp;</h2>In the <a href="https://us.norton.com/blog/ai/how-to-spot-scams-before-you-click" target="_blank" rel="noreferrer noopener">Norton integration within ChatGPT</a>, AI evaluates patterns such as impersonation tactics, urgency cues, requests for sensitive information and domain anomalies. Norton Genie, the world’s first AI-powered scam detector, pairs technical signals with behavioral indicators because modern fraud operates on both layers.&nbsp;But this product moment sits within a much larger transformation.&nbsp;<h2>The rise of autonomous AI and the trust imperative&nbsp;</h2>Our <a href="https://www.gendigital.com/blog/insights/research/openclaw-autonomy-risks" target="_blank" rel="noreferrer noopener">OpenClaw</a> research on autonomy risks explores how AI agents with increasing independence can introduce new security challenges. When AI begins to act on our behalf, make decisions or initiate actions, trust can no longer be assumed. It must be engineered.&nbsp;Autonomy without guardrails amplifies risk. Autonomy with transparency amplifies trust.&nbsp;That is why Gen has introduced the <a href="https://ai.gendigital.com/" target="_blank" rel="noreferrer noopener">AI Agent Trust Hub</a>, a framework and resource center focused on building responsible AI ecosystems. The Trust Hub emphasizes governance, explainability, accountability and human oversight as core design principles. This is not theoretical. As AI agents begin handling financial transactions, personal data and operational workflows, they will inevitably become targets themselves. The next phase of cybersecurity will not only protect humans from malicious actors. It will protect AI systems from manipulation and misuse. And it will protect humans from over-reliance on AI without understanding its limitations.&nbsp;<h2>Designing AI that augments human judgment&nbsp;</h2>The future of AI interaction is not about replacing decision-making. It is about strengthening it.&nbsp;When someone pastes a suspicious message into ChatGPT and asks “Is this legit?” they are not outsourcing responsibility. They are seeking clarity. They are extending their cognitive reach.&nbsp;That balance between automation and empowerment is critical.&nbsp;AI must be capable enough to identify emerging global scam patterns, including fake delivery notifications, banking impersonation attempts and AI generated voice phishing. But it must also remain interpretable. Transparent. Accountable. The Norton app, within ChatGPT, can be that.&nbsp;&nbsp;<h2>Building the next trust layer of the internet&nbsp;</h2>We are entering an era where AI will mediate much of our online experience. It will draft our communications. Curate our information. Screen our interactions. Execute transactions. The question is not whether AI will become part of our security posture. It already is.&nbsp;The real question is whether we build it with trust at the core.&nbsp;At Gen, our approach is grounded in three ideas:&nbsp;<ul type="disc"><li data-list-item-id="e965bc2f74345432db64ab84b0e13580d">Innovation must move at the speed of AI growth.&nbsp;</li><li data-list-item-id="ea2d5c939c934043a266b4f4c41bf1f08">Security must integrate into the environments where decisions happen.&nbsp;</li><li data-list-item-id="ec0f44d4a8b7612a7b70893f9bbe16d34">Trust must scale alongside autonomy.&nbsp;</li></ul>The integration of AI-powered scam detection into conversational platforms is one step in a broader journey. It reflects a belief that protection should not sit on the sidelines. It should sit inside the interaction.&nbsp;“Is this a scam?” may have been a common question in 2025. But tomorrow the more important question will be: Can we trust the AI systems helping us answer it?&nbsp;The future of cybersecurity will be defined by how well we design trust into every layer of AI interaction.&nbsp;And that future is being built now.&nbsp;

Why protecting people now means embedding security intelligence directly into AI tools like ChatGPT

The future of cybersecurity lives inside AI conversations 

Cyber Safety Chief Technology Officer

Threat research has always been a strange mix: part intuition, part pattern recognition, part tedious grind. You develop a sense for spotting dangerous patterns, but you spend most of your time on work that doesn't require that sense at all.&nbsp;&nbsp;Agentic AI is about to change that ratio. Not by replacing researchers, but by shifting where human judgment actually matters.&nbsp;<h5>&nbsp;The Work Today&nbsp;</h5>&nbsp;If you've spent time in threat research, you know the rhythm. You find something suspicious. You pull it apart in a disassembler or sandbox. You cross-reference&nbsp;&nbsp;indicators across half a dozen threat intel feeds. You document your findings in a format that looks remarkably similar to your last report.&nbsp;It's skilled work. It requires real expertise. But a significant portion of it is repetitive, manual, and frankly, boring. The kind of work that has to happen but doesn't benefit from your best thinking.&nbsp;That's where agents come in.&nbsp;<h5>Agents as a Junior Researcher &nbsp;</h5>The useful mental model isn't "AI replaces researchers." It's "AI becomes the junior researcher you never had enough of."&nbsp;Imagine pointing an agent at a malware sample and getting back: an initial behavioral analysis, a list of IOCs extracted and cross-referenced, similar samples identified from public repositories, and a draft report you can refine. Not perfect work. But solid first-pass work done in minutes instead of hours.&nbsp;Your job shifts from doing the analysis to directing and validating it. You focus on the anomalies the agent flagged but couldn't explain. You make the judgment calls about what's actually significant. You connect the dots that require broader context than any model has.&nbsp;The craft doesn't disappear. It moves up the stack.&nbsp;<h5>The Real Opportunity: Scope&nbsp;</h5>Speed is the obvious benefit. But the real transformation is scope.&nbsp;Right now, most threat research is reactive. Something happens, you investigate. You're always responding to what's already in front of you. The backlog of things you'd like to look into never gets shorter.&nbsp;When the grind gets automated, you can finally ask bigger questions:&nbsp;<ul><li data-list-item-id="e18eedd1bd2120f2a988307cfd9d59746">What patterns exist across six months of data that you never had time to analyze?&nbsp;</li><li data-list-item-id="ea2aaecd6fefaf03c9333d555fdbacbea">What connections might emerge if you could hunt across datasets simultaneously?</li><li data-list-item-id="e2cf856897b93fd5b0c70f22ab68ebc10">What's happening at the edges of your visibility that deserves a closer look?&nbsp;</li></ul>Agents don't just make you faster. They make exploration possible in ways it wasn't before.&nbsp;<h5>The Other Side of the Equation&nbsp;</h5>Here's the part we have to be honest about: attackers get agents too.&nbsp;Faster reconnaissance. Automated vulnerability discovery. Malware that adapts based on the environment it lands in. Phishing at scale with personalization that used to require manual effort.&nbsp;This isn't a one-sided advantage for defenders. It's an escalation. The ceiling rises for everyone. &nbsp;That doesn't make agentic AI a net negative for security. But it does mean we can't assume the technology automatically favors defense. The advantage goes to whoever learns to use these tools more effectively, faster.&nbsp;<h5>What Changes for Researchers&nbsp;</h5>The researchers who thrive in this shift will share a few traits:&nbsp;Comfort with direction over execution. Your value increasingly comes from knowing what questions to ask, not manually answering them. You guide agents, validate their outputs, and catch their mistakes.&nbsp;Judgment about signal and noise. Agents will surface more information than ever. Knowing what matters, what's a false positive, what's worth pursuing – that becomes the core skill.&nbsp;Adaptability. The tools will keep changing. The researchers who stay effective will be the ones who continuously experiment.<h5>The Craft Evolves&nbsp;</h5>There's a version of this story that sounds like loss. Less hands-on analysis. Less time in the weeds. The work that defined the field becoming automated.&nbsp;I don't see it that way.&nbsp;The craft of threat research has always been about finding what others miss and understanding what it means. That doesn't go away when agents handle the mechanical parts. If anything, it becomes more important.&nbsp;We're not losing the craft. We're changing where it lives. Less time on repetitive triage. More time on the problems that actually require human insight.&nbsp;That's not a loss. That's what progress in a field looks like.&nbsp;

Why the future of threat research isn’t automation replacing analysts—but elevating human judgment where it matters most.

How Agentic AI Will Transform Threat Research 

In 2026, the search for connection increasingly begins online. People are matching on dating apps, meeting partners through social platforms and sliding into DMs in ways that feel casual, normal, even expected.As Valentine’s Day approaches, dating app usage spikes and so do romance scams. Cybercriminals know February is peak season for emotional outreach, when millions are looking for connection.But as technology reshapes how we meet and connect, it’s also reshaping how trust can be manipulated.The latest Norton Insights Report,&nbsp;<a href="https://us.norton.com/blog/research/romance-scams-insights-report-2026">Artificial Intimacy</a>, reveals just how deeply artificial intelligence is transforming digital intimacy — and how scammers are adapting just as quickly.Romance scams are no longer just about fake profiles and poorly written messages. They’re powered by tools that can generate convincing conversations, realistic images and even synthetic audio or video. The deception is more immersive and more personal than ever before.<h2>What are AI romance scams?</h2>AI romance scams are online dating scams that use artificial intelligence to create convincing fake personas and emotionally persuasive conversations.Instead of sending generic scripts, scammers can now generate personalized messages, mirror someone’s tone and interests and create realistic profile images that don’t belong to real people. In some cases, AI can even be used to simulate voice or video, making interactions feel authentic.The result: deception that feels tailored, attentive and very real.<h2>How is AI changing online dating and digital trust?</h2>According to the&nbsp;<a href="https://us.norton.com/blog/online-scams/ai-online-dating-scams">Norton report</a>, 67% of current online daters globally say they would consider dating an AI chatbot, and 37% believe it’s possible to develop romantic feelings for an AI partner.At the same time, 81% of respondents report experiencing loneliness, with younger generations reporting even higher levels.This signals something bigger than curiosity. It reflects how normalized AI-mediated emotional connection has become.AI systems are designed to respond instantly and empathetically. When someone feels heard, understood and supported, trust can form quickly … even if the interaction is partially or fully AI-assisted.That shift changes how emotional bonds are built online. And scammers are paying attention.<h2>How Do AI Romance Scams Work?</h2>Romance scams follow a predictable pattern:<ol><li data-list-item-id="e15b54f3f1891914b76c7f2b112553efd">Establish emotional intimacy through frequent messaging</li><li data-list-item-id="e3f4a4acb2174b6e32e9c4d90aa234409">Build exclusivity and trust</li><li data-list-item-id="e68eaad06a25b11222019390d84b51a46">Introduce urgency (often financial)</li><li data-list-item-id="ed2dee4d5894af5043ca3a2d38fc5b3df">Request money, gift cards, wire transfers or cryptocurrency</li></ol>The Norton report finds that 34% of online daters say they have been targeted by a scam, and 36% say they’ve been pressured to send money to someone they met online.Globally, romance scams already account for billions in losses each year. As AI improves realism and scalability, the risk compounds.What makes 2026 different is the sophistication. AI allows scammers to:<ul type="disc"><li data-list-item-id="ecc7a56af3d1c511ecb226fae848ce25d">Generate highly personalized messages at scale</li><li data-list-item-id="ef3522862fd80d90065bb6aaf53f79807">Mirror tone, interests and emotional language</li><li data-list-item-id="ea8e255924a34794d69957640758be77c">Create realistic profile images</li><li data-list-item-id="e07d58e752a23579800ea69afabdb5495">Maintain constant, attentive communication</li><li data-list-item-id="efc37264727695b754710430c867c302c">Use emotional (and artificial) intelligence to commit fraud</li></ul><h2>What are the signs of an AI romance scam?</h2>Even with advanced tools, warning signs still exist. Red flags may include:<ul type="disc"><li data-list-item-id="e9bd1bfea4dc993103ef6f502445b5cb0">Rapid emotional escalation (“I’ve never felt this way before”)</li><li data-list-item-id="ee516559d6cbd3d61872dc53519894dc7">Requests to move conversations off dating platforms quickly</li><li data-list-item-id="ed6144398f1813335534d6d23f34a06c8">Refusal to meet in person or join a live video call</li><li data-list-item-id="e4fdd790944f08ccbc99836a358cbe4fc">Financial requests tied to emergencies or investments</li><li data-list-item-id="e3ce51b500038cb1cea5571e934d24251">Pressure to send cryptocurrency, gift cards or wire transfers</li></ul>If emotional intensity rises faster than real-world verification, it’s time to pause.

<h2>Why do romance scams increase around Valentine’s Day?</h2>Valentine’s Day amplifies emotional vulnerability. More people are actively dating, messaging and seeking companionship. That surge in activity creates opportunity.Scammers exploit heightened emotion and urgency. A romantic gesture, a crisis before a planned visit, a promise of future plans — these tactics become more effective when expectations are already emotionally charged.“We all want to be seen and understood, and there’s no shame in believing in a new connection that feels special,” says Eva Velasquez, CEO of the Identity Theft Resource Center. “That’s why romance scams are so heart-wrenching; they use our own kindness and hope against us. Even if you consider yourself tech-savvy, that emotional spark can easily blur a red flag. If a new light in your life suddenly asks for money or your private details, please, hit the pause button. It’s not about being cynical; it’s about protecting your heart and your future from someone who doesn't deserve your trustWhen loneliness intersects with seasonal pressure and AI-powered persuasion, risk increases.<h2>How can you protect yourself from romance scams?</h2>Awareness remains one of the strongest defenses.Practical safeguards include:<ul type="disc"><li data-list-item-id="ec8306c6ee68c216ad93743f299af3daa">Slowing down when emotional intensity escalates quickly</li><li data-list-item-id="ef3f0d66137848293989767e402197c72">Verifying identities through live, unscripted video conversations</li><li data-list-item-id="e1fcc4932b7df4df726703f09944678bf">Being cautious of financial requests involving wire transfers, gift cards or cryptocurrency</li><li data-list-item-id="ea01d7dd6ab6a67ae95cc50738b754696">Keeping personal and financial information private</li><li data-list-item-id="e4f27f8218e4b09bfa1c685e34496f107">Using identity protection and fraud monitoring tools, like&nbsp;<a href="https://lifelock.norton.com/">LifeLock</a></li></ul>Healthy skepticism does not mean rejecting connection. It means layering trust with verification.<h2>Can you fall in love with AI?</h2>The data suggests many people believe it’s possible.In a world where artificial intimacy can feel indistinguishable from the real thing, protecting both your heart and your finances demands a new kind of digital awareness; one grounded in curiosity, caution and informed trust.

Why do romance scams increase around Valentine’s Day? Understanding the emotional triggers and practical steps to prevent online dating fraud

Valentine’s Day 2026: How AI is fueling the rise of romance scams

OpenClaw, a new AI agent, has already amassed over 160,000 stars and 25,000 forks on&nbsp;<a href="https://github.com/openclaw/openclaw">GitHub</a> since its launch in late 2025. A powerful and exciting new tool, OpenClaw also introduces serious security risks. This article explains how OpenClaw works, the associated risks, and how the Gen Agent Trust Hub can help you use it more safely.<h2>What is OpenClaw and what does it do?</h2>OpenClaw (formerly known as Clawdbot and Moltbot) is an open-source autonomous AI agent that runs locally on your own device. Connecting LLMs to your data and apps, OpenClaw can work across your files, browsers, and messaging platforms like WhatsApp, Slack, Discord, and Telegram.&nbsp;OpenClaw can perform tasks like managing your calendar, sending messages, and automating workflows. To teach OpenClaw how to perform a task, users can download a preconfigured, community-contributed folder called a skill&nbsp;— basically a set of instructions that tells OpenClaw what to do and how to do it.&nbsp;For example, if you want your fitness app to create a personalized, optimized workout routine, you can install a skill that gives OpenClaw the logic and access it needs to do exactly that.But OpenClaw goes far beyond prepackaged features: it can also write its own skills. When prompted by a user, OpenClaw can create&nbsp;entirely new capabilities on the fly, extending its functionality in real time. That means it can adapt to new tasks as they arise, rather than being locked into a fixed set of features.

<h2>OpenClaw is transformative, but is it secure?</h2>Unlike traditional AI chatbots that operate within a limited conversational interface, OpenClaw is an autonomous agent, meaning it can act independently. And, through the ClawHub marketplace, you can add third-party plugins to enhance its capabilities. Combining that independence with add-on flexibility creates powerful opportunities. But it also&nbsp;<a href="https://www.gendigital.com/blog/insights/research/openclaw-autonomy-risks">introduces significant risks</a>.As OpenClaw connects to more parts of your system and integrates additional third-party skills, it gains access to emails, files, and chats, as well as websites and external sources you don’t control. While these additional skills and broader system access can help it complete complex tasks, it also increases the potential for malicious activity.A compromised or poorly designed skill could misuse its permissions, expose private data, or carry out actions you never intended. In short, the more third-party connections an agent has, and the more deeply it’s embedded into your digital life, the higher the stakes if something goes wrong.<h3>How AI agents are changing the rules of security</h3>Using an AI agent means delegating responsibility to software with extensive access to your system and limited risk controls. Instead of approving each action yourself, you’re authorizing the agent to act on your behalf. That presents an opportunity for threat actors: if they compromise your AI agent, they inherit all the data and permissions you’ve given it and could even commandeer the agent to take actions for their own purposes.&nbsp;By putting so much authority in one place, autonomous AI agents like OpenClaw introduce what researchers like Simon Willison have called a potential&nbsp;<a href="https://simonwillison.net/2025/Jun/16/the-lethal-trifecta/">“lethal trifecta”</a> of security risks:<ul type="disc"><li data-list-item-id="e4fca606bedbd6d9f48f918a03f9af53f">Access to private data: The agent can see your files, login credentials, and personal information.&nbsp;</li><li data-list-item-id="ecf3a565dd59d91bd98732e5db397a3b0">Exposure to untrusted content: The agent can process and interact with messages, emails, websites, prompts, and third-party integrations.</li><li data-list-item-id="eecca7e258f9c3ab0e8ef4aa8bfdfcb46">The ability to communicate externally: The agent can send messages, call APIs, and run commands on your behalf.</li></ul>Some agents also have persistent memory, allowing malicious code or instructions to lie dormant rather than execute immediately, only to trigger later — much like a logic bomb.<h2>What are the core security risks of OpenClaw?</h2>AI agents like OpenClaw that can read information, make decisions, and act across systems present the risk of hallucinating authority — taking actions beyond their intended scope. Unlike traditional chatbots that can hallucinate text, AI agents can act as an&nbsp;<a href="https://www.gendigital.com/blog/insights/research/ai-gone-wild">“artificial mindless intelligence”</a>: a system that appears justified and authoritative but lacks true understanding and responsibility.&nbsp;Here are some of the main risks that AI agents like OpenClaw introduce:<ul type="disc"><li data-list-item-id="e7f1f8c06c1fb4bba4ae7ae46658102f6">Larger attack surface: An agent that can read messages, browse the web, and execute commands creates more opportunities for exploitation, misuse, or unintended actions.</li><li data-list-item-id="e03b344ca933a6f3f4cf9d3c45c4d0f0c">Prompt injection attacks: The messages and websites that OpenClaw processes and visits can contain hidden, malicious instructions that can cause real damage.</li><li data-list-item-id="e3a2d1cb3963a720b2a9badaba390afc6">Malicious skills and plugins:&nbsp;Skills are community-built, meaning they may not be vetted by security experts. Like installing malware, a skill with compromised instructions can collect information, steal credentials, or exfiltrate data.</li><li data-list-item-id="e01678b0e92ccc2957c2f6f671f6bac43">System-wide impact: When OpenClaw runs with extended permissions, mistakes or compromises can affect your entire system.</li><li data-list-item-id="e45a537af168a7d6ebe7de9cfd9c41209">Illusion of judgment: Autonomous systems can seem trustworthy, even if they’re not truly reasoning. This can lead users to delegate too much authority to systems with no accountability or real judgement.</li></ul><h3>Why OpenClaw skills are the biggest risk</h3>Gen Threat Labs has identified OpenClaw skills as one of the&nbsp;first large-scale threat vectors in autonomous AI agents built for consumers.&nbsp;In a recent analysis, Gen security researchers discovered that nearly 15% of OpenClaw skills contained malicious instructions, including prompts created to download malware or steal data. And even as malicious skills were identified and removed, many quickly reappeared, often seemingly indistinguishable from legitimate plugins.When you set up OpenClaw, you can add community-developed skills to expand its capabilities, a bit like adding apps to your phone. The problem is that skills can be added to the community and installed before they're reviewed by security experts. That creates an opening for seemingly helpful skills that are actually deliberately designed to abuse their permissions and carry out malicious behavior.For example, a “Spotify music skill” might compile playlists as expected, while also containing hidden instructions to search your files for tax documents, extract Social Security numbers, and send that data to an external email address.&nbsp;The OpenClaw skills risk that Gen researchers have identified is called delegated compromise, which is when an attack targets an agent and thereby exploits all the permissions the agent has been given.&nbsp;<h2>How to use OpenClaw more safely</h2>Using any AI agent, including OpenClaw, always involves risk. There’s no setup that makes an autonomous agent completely safe, especially one like OpenClaw that relies on external plugins from potentially unvetted developers. But you can take steps to mitigate the chances that a mistake, bug, or malicious skill turns into a serious problem.&nbsp;If you want to experiment with OpenClaw, here’s how to do it more safely:<ul type="disc"><li data-list-item-id="e908f0fbadded99d4c5344d6f31eee365">Run OpenClaw in a secure environment: Don’t install it on your main computer with all your personal data and saved credentials. A safer approach is to run it on a spare computer, inside a virtual machine, or in a Docker container. That way, if something bad happens, the fallout is contained.</li><li data-list-item-id="e621c07b6dec88b09e48deb4cd23dcc7a">Don’t connect OpenClaw to the internet: Make sure that the local service OpenClaw runs isn’t publicly accessible, and don’t forward its default port (18789) to the open web.</li><li data-list-item-id="e3ab30722b3de6f154f809d8df6ebe749">Start with limited permissions and expand slowly: To begin, give OpenClaw read-only access or limited folders. As you gain more familiarity, you can gradually grant more permissions.</li><li data-list-item-id="ef2295f0759a958f775f183a6c37e6796">Don’t connect sensitive accounts: When testing, use secondary or dummy accounts. If personal accounts are required, isolate the agent and limit its permissions. Be very careful before you extend access to any accounts that contain personal information.</li><li data-list-item-id="ecd123d753dc702f7ee9c16947d3e3720">Keep your human judgement at the center: OpenClaw is autonomous, but you need to carefully oversee it as you get going. Review activity logs and outputs, especially for actions like sending messages or modifying files. Regular reviews can help catch unusual activity early.</li><li data-list-item-id="e5aff28537f6c3b829737703ce8b6f1b9">Use safe communication channels: Keep conversations one-on-one or within trusted groups. Interacting with unknown or public participants increases the risk that malicious actors can inject hidden instructions to manipulate the agent’s behavior.</li><li data-list-item-id="ef766e9b02432ec63a5253f28bb7d6b12">Be careful with third-party skills and plugins: Treat skills like software installs. Review developers and descriptions and stick to well-known, well-reviewed sources whenever possible.</li><li data-list-item-id="ecc9999d1ffff35ee833df84672ff280c">Scan new skills before installing them: Paste the ClawHub skill URL into <a href="https://ai.gendigital.com/" target="_blank">Agent Trust Hub</a> to help find out if the skill you're installing is safe.</li></ul><h2>How Gen helps you use OpenClaw more safely</h2>Gen is committed to helping users understand the opportunities and risks that new digital tools present so they can make safer choices. OpenClaw is a powerful example of emerging AI technology, but one of its biggest risks is that it’s difficult for consumers to tell whether an OpenClaw skill is trustworthy before installing it.To address this, Gen Threat Labs has launched the&nbsp;<a href="https://ai.gendigital.com/agent-trust-hub">Gen Agent Trust Hub</a>, which includes free tools to help people stay safer in the agentic AI era. Within the hub is an AI Skills Scanner, a free diagnostic tool that analyzes OpenClaw skills looking for hidden patterns associated with data theft, suspicious instructions, and malicious script techniques.&nbsp;Before installing a skill, go to the Gen Agent Trust Hub and paste the ClawHub or GitHub skill URL into the AI Skills Scanner tool to find out if your system or personal information could be at risk.The Gen Agent Trust Hub also includes the AI Skills Marketplace, a curated and closely audited repository of agent skills that have been vetted by Gen’s threat-detection engine. Taken together, the Gen Agent Trust Hub is a powerful resource to help you avoid installing a malicious tool with broad system access. Visit the&nbsp;<a href="https://ai.gendigital.com/agent-trust-hub">Gen Agent Trust Hub</a> to learn more.

OpenClaw connects AI models to your files, apps, and messages. Here’s how it works, the hidden risks of autonomous agents and how Gen helps you reduce potential compromise.

How to use OpenClaw safely

<h2>What is Data Privacy Week? &nbsp;</h2>Data Protection Day originated in Europe to commemorate the first legally binding international treaty dealing with privacy and data protection. Now, the celebration has expanded to an entire week and is recognized worldwide. The mission of <a href="https://staysafeonline.org/programs/data-privacy-week/">Data Privacy Week</a>, observed January 21-27 this year, is to inspire dialogue and empower individuals and companies to respect privacy, safeguard data and enable trust.&nbsp;&nbsp;Data Privacy Week, which encourages people everywhere to take control of their digital footprints, is run by the <a href="https://nam04.safelinks.protection.outlook.com/?url=https%3A%2F%2Fstaysafeonline.org%2Fprograms%2Fdata-privacy-week%2F&amp;data=05%7C02%7CAlisha.Robinson%40gendigital.com%7C6a003a179aef40725ccf08dc16b91ab6%7C94986b1d466f4fc0ab4b5c725603deab%7C0%7C0%7C638410231503836756%7CUnknown%7CTWFpbGZsb3d8eyJWIjoiMC4wLjAwMDAiLCJQIjoiV2luMzIiLCJBTiI6Ik1haWwiLCJXVCI6Mn0%3D%7C3000%7C%7C%7C&amp;sdata=E3%2BMt372PJpwhWRw5v6FwZ1nCsxBCaH2fv6H1u0BOu4%3D&amp;reserved=0%22%20\o%20%22Original%20URL:%20https://staysafeonline.org/programs/data-privacy-week/%20%20Click%20to%20follow%20link.%22%20\t%20%22_blank">National Cybersecurity Alliance</a> (NCA). NCA advocates for the safe use of technology and helps governments and corporations work together to foster digital good.&nbsp;Everything you do online generates data. Every time you shop, click, scroll, like, message, play and more, you are generating data. This personal information has tremendous value to businesses. The landscape of privacy and data protection laws and regulations continues to grow more complex. Companies with global operations that wish to advance the privacy rights of individuals and enable innovative products and services must comply with these laws and deliver meaningful data security to their customers; this can be challenging for many companies and difficult for people when trying to figure out if the apps and companies that hold their data are keeping it safe.  &nbsp;

<h2>How We Help People Protect Their Digital Lives &nbsp;</h2>For Gen, empowering people to take control of their digital lives is in our DNA. Security, transparency, and accountability are built into everything we do, and products like <a href="https://us.norton.com/products/norton-secure-vpn%22%20/t%20%22_blank">Norton Secure VPN</a> protect a person’s online privacy by hiding the computer’s address from websites visited from any device. Norton, a part of Gen, also offers <a href="https://us.norton.com/products/norton-360-deluxe%22%20/t%20%22_blank">Norton 360 Deluxe</a>, which can prevent activity or location tracking, as well as information theft, installation of malicious programs and uninvited changes to devices. We recently <a href="https://www.gendigital.com/blog/impact/community/product-donations-domestic-violence">launched a product donation pilot program</a>, donating up to 5,000 of these free product licenses to survivors of domestic violence to help them recover from financial or technological abuse. These products are also donated or discounted to nonprofits through our partnership with <a href="https://www.techsoup.org/search/products/norton/%22%20/t%20%22_blank">TechSoup</a>. &nbsp;In addition to product donations, we work regularly with nonprofits like <a href="https://www.gendigital.com/blog/impact/community/my-digital-life%22%20/t%20%22_blank">Discovery Education</a> and the <a href="https://www.gendigital.com/blog/impact/community/the-smart-talk-2023%22%20/t%20%22_blank">National PTA</a> to help children and families learn about keeping their information private.  &nbsp;<h2>Five Ways We Help Keep Customer Data Safe&nbsp;</h2>We focus on five essential elements to help keep customer data safe. Check for these key practices: &nbsp;<ol><li>Accountability. At Gen, we hold ourselves accountable by defining our principles, conducting internal and external audits, empowering employees at all levels of the company to proactively consider privacy and data protection, engaging in continuous improvement processes, and constantly scanning for new risks and opportunities. For more details on Gen’s Privacy Operating Model, see page 34 of our <a href="https://s201.q4cdn.com/771113172/files/doc_downloads/2023/07/gen-2023-social-impact-report.pdf">2023 ESG Report</a>. &nbsp;</li><li>Security. We secure personal data using appropriate technical and organizational measures to protect integrity, confidentiality, and availability. Our security monitoring alerts us to suspicious activity, and we have a robust incident response program. &nbsp;</li><li>Essential rights. We take a principles-based approach, going beyond regional data protection laws to provide essential rights to our customers, such as access and deletion, regardless of whether there is a law requiring it. &nbsp;</li><li>Transparency. Privacy policies are often difficult to read and understand. We work to make our policies as clear and detailed as possible. We provide additional support articles and easy access to contact information to make it easy for customers to exercise their privacy rights and get their questions answered. &nbsp;</li><li>Customer-First Privacy by Design. In everything we do, we strive to anticipate, identify, and prevent invasive events before they happen. Privacy measures should not be add-ons, but fully integrated components of the system. We only collect personal data for specified, clear and legitimate purposes. And, we only collect as much personal data as we need to achieve those purposes.&nbsp;&nbsp;</li></ol>This Data Privacy Week, we encourage you to do a quick review of the companies and apps that have your information. Do they have systems and policies in place to keep your data secure? Will they let you delete your data? Are they explaining what personal data is collected and why? Do they respect your rights to control how your data is used? Remember, it’s your data and it has value. Be selective about who you choose to do business with and thoughtful about what information you are providing. And, no matter where you are in your data security journey, we hope Data Privacy Week serves as an important reminder to exercise your rights to safety and privacy.

Kirsten McMullen

Posts by Kirsten McMullen

Helping to Keep Personal Data Safe