Confidential Computing for Secure Agentic AI Systems

A recent study conducted by arXiv delves into confidential computing as a hardware-based security approach for LLM-driven agentic AI systems. These agents, capable of planning, utilizing tools, preserving persistent memory, and assigning tasks through protocols such as MCP and A2A, encounter specific risks like prompt injection, context exfiltration, credential theft, and message poisoning among agents. Existing software-only defenses can be circumvented by privileged attackers, such as compromised cloud operators. Confidential computing employs Trusted Execution Environments (TEEs) to safeguard agent code and data, with remote attestation providing verifiable trust in distributed settings. The survey outlines the design landscape in four sections, beginning with threat modeling and progressing to hardware-centric protections.