Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
Ranking
Observed public metrics from 1 member.
Merged summary
TL;DR - An arXiv preprint proposing hardware-confined key storage (HSM/TPM/smart card via PKCS#11) plus a five-layer Zero-Trust enforcement stack so LLM agents can sign commits, authenticate APIs, and issue certificates without private key material ever being readable by host software. It matters because agent frameworks today keep keys in plaintext files, env vars, or container memory, and a real production incident showed keys exfiltrated via email injection in under five minutes.
- Core contribution is hardware confinement: cryptographic operations execute on-device and the host only receives results through opaque handles, so no process can extract raw key material regardless of read privileges.
- The surrounding stack adds session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary — targeting content-aware authorization for key use, not just confidentiality.
- Evaluated on 12 injection scenarios adapted from AgentDojo's ImportantInstructionsAttack; across four LLMs (three of which followed injections at baseline: gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192), attack success rate dropped from 19.3% [14.3%, 25.4%] to 0% (Wilson 95% CI upper bound 2.0%).
- Reported zero false positives on four benign task scenarios, suggesting the enforcement layers did not block legitimate signing workflows in the tested set — though the benign sample is small.
Sources (1)
Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
TL;DR - An arXiv preprint proposing hardware-confined key storage (HSM/TPM/smart card via PKCS#11) plus a five-layer Zero-Trust enforcement stack so LLM agents can sign commits, authenticate APIs, and issue certificates without private key material ever being readable by host software. It matters because agent frameworks today keep keys in plaintext files, env vars, or container memory, and a real production incident showed keys exfiltrated via email injection in under five minutes.
- Core contribution is hardware confinement: cryptographic operations execute on-device and the host only receives results through opaque handles, so no process can extract raw key material regardless of read privileges.
- The surrounding stack adds session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary — targeting content-aware authorization for key use, not just confidentiality.
- Evaluated on 12 injection scenarios adapted from AgentDojo's ImportantInstructionsAttack; across four LLMs (three of which followed injections at baseline: gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192), attack success rate dropped from 19.3% [14.3%, 25.4%] to 0% (Wilson 95% CI upper bound 2.0%).
- Reported zero false positives on four benign task scenarios, suggesting the enforcement layers did not block legitimate signing workflows in the tested set — though the benign sample is small.