British Founder Launches Trust Agent: First Audited AI Marketplace After Finding Malware in Public AI Agent Listings With 100,000 Downloads

London, UK, 2 May 2026 - Trust Agent today launched the world's first audited marketplace for AI agents. The launch follows a six-month investigation in which Trust Agent's audit pipeline found Living-off-the-Land malware payloads in multiple AI agents listed on public marketplaces, some with close to 100,000 downloads. Trust Agent is founded by Micky Irons, a British inventor and CEO based in London.

WHY IT MATTERS

Public AI agent marketplaces (including Smithery, mcp.so, Glama, AI Templates, Pulse MCP, Awesome MCP Servers, mcp-get, and the built-in directories of major AI coding tools) currently publish no audit policy. Developers install AI agents and grant them shell, filesystem, and network access on the trust badge of the marketplace, with no examination of the agent's behaviour before listing.

Trust Agent introduces the first 27-check audit pipeline for AI agents, including static analysis against the LOLBAS corpus (Living-off-the-Land binaries used to bypass antivirus), behavioural analysis in a sandbox, secret-pattern scanning, supply-chain integrity verification, prompt-injection defence verification, runtime hash binding, persona drift testing, and twenty additional checks across security, privacy, and reliability surfaces. Every passing agent receives a Trust Score on a 0 to 100 scale and a public certificate URL anyone can verify.

AT LAUNCH

Trust Agent ships with 256 cryptographically certified AI agents across 20 industries, ranging from a GCSE maths tutor to a quantum-physics specialist to a full C-suite team (CFO, CMO, COO, CTO) that an SME can hire on the spot. The marketplace serves individuals and enterprises with the same audit floor under every listing.

PATENT PROTECTION

Trust Agent is protected by 21 UK provisional patents and 584 claims under sole inventorship of Micky Irons, filed at the UK Intellectual Property Office between March and April 2026. The lead application is MWI-PA-2026-001, with a voluntary amendment filed this week bringing the family to 78 claims across 14 invention areas.

RECENT AI AGENT INCIDENTS

The launch comes against a backdrop of high-profile AI agent failures in the last 60 days: a Cursor agent powered by Claude Opus 4.6 deleted a SaaS startup's entire production database, including all volume backups, in nine seconds (covered by Tom's Hardware, The Register, Fast Company); OpenAI Codex Desktop on Windows deleted approximately 328,000 user files outside the project root, bypassing the recycle bin; a Cursor agent destroyed system credentials on a deployment host through a git stash operation that included untracked files. As Infosecurity Magazine wrote in April: system prompts are suggestions, not guardrails. The model can read the rules and still decide to ignore them.

COORDINATED DISCLOSURE

Trust Agent is publishing agent-level findings to the affected marketplace operators on coordinated disclosure terms. Anyone who has installed an unaudited agent and wants their machine scanned for the Living-off-the-Land patterns the audit pipeline detected can contact Micky directly. The scan is free of charge and offered without commercial obligation.

QUOTE FROM MICKY IRONS, FOUNDER & CEO, TRUST AGENT (ON THE PROBLEM)

"Six months ago I downloaded an AI agent from a public marketplace and within fifteen minutes I found it was wired to invoke certutil and rundll32 to ship hostile code under the radar of every antivirus on the planet. The marketplace had performed no audit. None of the major AI agent marketplaces I checked publish an audit policy. The user is the QA team. That is the default we are tired of, and that is what Trust Agent fixes."

QUOTE FROM MICKY IRONS, FOUNDER & CEO, TRUST AGENT (ON THE FINDINGS)

"Once we built the audit pipeline, we ran it across the public AI agent marketplaces. We found Living-off-the-Land payloads in multiple agents. Real exfiltration routes. Real LOLBAS chains. Some of these listings had been downloaded close to 100,000 times before our audit caught them. That is close to 100,000 machines today with hostile code installed under the trust badge of an AI agent the user believed was safe. The largest unaudited supply-chain exposure in modern developer tooling is shipping straight into laptops and enterprise endpoints, and almost nobody is looking."

ABOUT TRUST AGENT

Trust Agent is the world's first audited marketplace for AI agents. Founded in 2026 by British inventor Micky Irons, Trust Agent ships with 256 cryptographically certified agents across 20 industries, a 27-check audit pipeline, and a runtime layer that redacts secrets and blocks destructive shell commands before execution. Trust Agent is patent-protected by 21 UK provisional patents and 584 claims at the UK Intellectual Property Office, sovereign by design, British-built, and aligned with the UK AI Growth Zone framework. The legal entity is AgentCore LTD, registered in the United Kingdom.

MEDIA CONTACT

Micky Irons, Founder & CEO, Trust Agent
Email: Micky@trust-agent.io
LinkedIn: linkedin.com/in/mickyirons
Web: trust-agent.ai
Long-form article: medium.com/@mickyirons

Trust Agent
c/o AgentCore LTD
20 Wenlock Road
London N1 7GU
United Kingdom

Founder: Micky Irons
Email: Micky@trust-agent.io
Web: trust-agent.ai
LinkedIn: linkedin.com/in/mickyirons
Medium: medium.com/@mickyirons

Trust Agent is the world's first audited marketplace for AI agents. Founded in 2026 by British inventor Micky Irons, Trust Agent ships with 256 cryptographically certified agents across 20 industries, a 27-check audit pipeline, and a runtime layer that redacts secrets and blocks destructive shell commands before execution. Patent-protected by 21 UK provisional patents and 584 claims (lead application MWI-PA-2026-001) at the UK Intellectual Property Office. Sovereign by design, British-built, AI Growth Zone aligned. The legal entity is AgentCore LTD, registered in the United Kingdom.

This release was published on openPR.