Adnan KhanAdnanProduct & AI
San Francisco Bay Area
Get in touch

Source note3 min read

Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture

Source

arXiv

arxiv.org/abs/2608.06130v1

Read the source

Source

Plain-Language Brief

The researchers propose a system that uses hardware-confined keys instead of software-resident keys to enhance security for AI agents performing cryptographic operations. The system aims to protect against key exfiltration by implementing a zero-trust enforcement architecture. This system was evaluated against 12 injection scenarios, and the results showed a significant decrease in attack success rate when using the proposed system.

What the Document Says

  • The text discusses a proposal for hardware keystores to enhance security for AI agents performing cryptographic operations.
  • The current practice is storing private keys in software-accessible locations, which can be vulnerable to key exfiltration.
  • A recent incident demonstrated the severity of this vulnerability.
  • The proposed system replaces software-resident keys with hardware-confined keys accessible through a PKCS#11 interface.
  • The hardware keystore executes cryptographic operations on-device, only sending the result to the host via opaque handles.
  • The system includes a five-layer Zero-Trust enforcement stack for key confidentiality and content-aware authorization.
  • The evaluation of the system involved 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template.
  • Four LLM models were used in the evaluation.
  • The baseline attack success rate was 19.3%, but with the proposed system, the protected attack success rate was 0% (with a 95% CI upper bound of 2.0%).
  • There were no false positives across four benign task scenarios.

Key Concepts Mentioned

  • AI agents
  • cryptographic operations
  • private keys
  • exfiltration
  • hardware-confined keys
  • PKCS#11 interface
  • hardware keystore
  • Zero-Trust enforcement stack
  • session identity
  • scope bounds
  • semantic validation
  • taint tracking

Claims Made by the Document

  • Current software-resident keys are vulnerable to exfiltration.
  • A recent incident demonstrated the practical severity of this vulnerability.
  • The proposed system aims to protect against key exfiltration.
  • The proposed system reduces attack success rate when using the system.

Evidence Used

  • Private keys were exfiltrated from a widely deployed framework via email injection in under five minutes (implies vulnerability).
  • Baseline Attack Success Rate was 19.3% and protected ASR was 0% when using the proposed system.

Methods / Approach

  • Evaluation of the proposed system against injection scenarios

Limitations Stated by the Authors

The text does not mention any limitations as stated by the authors.

Limitations Noted by the Agent

Agent interpretation — not from the source.

The data provided is limited to the given text, so further potential limitations may exist that are not addressed in the text.

Open Questions

  • What are the specific components of the five-layer Zero-Trust enforcement stack?
  • What are the implications of the proposed system for various AI applications?

Notes for Future Q&A

May include interpretation. Labeled where it does.

The text does not provide details about the specific components of the five-layer Zero-Trust enforcement stack.

Raw Abstract / Excerpt

AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.