Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture

Source

arXiv

arxiv.org/abs/2608.06130v1

Read the source

Source

Plain-Language Brief

Researchers propose a system to store AI agent's private keys in hardware-confined devices, improving key confidentiality and authorization. They replace software-stored keys with ones stored in HSMs, TPMs, or smart cards, which execute cryptographic operations on the device. The system includes a five-layer Zero-Trust enforcement stack for increased security. The study found that this method successfully prevented 19.3% of injection attacks and had no false positives in benign scenarios.

What the Document Says

  • AI agents currently store private keys in software-accessible locations.
  • Private keys were exfiltrated from a widely deployed framework via email injection.
  • The researchers aim to enforce both key confidentiality and content-aware authorization for key use.
  • They replace software-resident keys with hardware-confined keys accessible through a PKCS#11 interface.
  • A hardware keystore executes cryptographic operations on-device.
  • The study includes a five-layer Zero-Trust enforcement stack.
  • The study evaluates against 12 injection scenarios.

Key Concepts Mentioned

  • AI agents
  • private keys
  • software-accessible locations
  • email injection
  • hardware-confined keys
  • PKCS#11 interface
  • hardware keystore
  • HSM
  • TPM
  • smart card
  • cryptographic operations
  • Zero-Trust enforcement stack
  • injection scenarios

Claims Made by the Document

  • The current method of storing AI agent's private keys is insecure.
  • The proposed method improves key confidentiality and authorization.
  • The study found that the proposed method successfully prevented 19.3% of injection attacks.

Evidence Used

  • Any process with sufficient read privileges can extract the raw key material
  • private keys were exfiltrated from a widely deployed framework via email injection
  • Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%)

Methods / Approach

  • Replacing software-stored keys with hardware-confined keys
  • Using a five-layer Zero-Trust enforcement stack

Limitations Stated by the Authors

The study only evaluates against 12 injection scenarios.

Limitations Noted by the Agent

Agent interpretation — not from the source.

The text does not specify if the study tested the system in various real-world conditions or against different types of attacks.

Open Questions

  • Is the proposed method effective against all types of attacks?
  • How scalable is the proposed system in large-scale AI deployments?

Notes for Future Q&A

May include interpretation. Labeled where it does.

  • The study focuses on injection scenarios derived from AgentDojo's ImportantInstructionsAttack template.
  • The text mentions four LLM models, but it does not specify their specific roles or limitations.

Raw Abstract / Excerpt

AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.