mlsanityData to 7 Oct 2026

Trusted AI Agents in the Cloud

arXiv 2512.05951 ↗First posted 5 Dec 2025cs.CR cs.AI cs.MAcited by 4

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

AI agents powered by large language models are increasingly deployed as cloud services that autonomously access sensitive data, invoke external tools, and interact with other agents. However, these agents run within a complex multi-party ecosystem, where untrusted components can lead to data leakage, tampering, or unintended behavior. Existing Confidential Virtual Machines (CVMs) provide only per binary protection and offer no guarantees for cross-principal trust, accelerator-level isolation, or supervised agent behavior. We present Omega, a system that enables trusted AI agents by enforcing end-to-end isolation, establishing verifiable trust across all contributing principals, and supervising every external interaction with accountable provenance. Omega builds on Confidential VMs and Confidential GPUs to create a Trusted Agent Platform that hosts many agents within a single CVM using nested isolation. It also provides efficient multi-agent orchestration with cross-principal trust establishment via differential attestation, and a policy specification and enforcement framework that governs data access, tool usage, and inter-agent communication for data protection and regulatory compliance. Implemented on AMD SEV-SNP and NVIDIA H100, Omega fully secures agent state across CVM-GPU, and achieves high performance while enabling high-density, policy-compliant multi-agent deployments at cloud scale.

Key facts. Cited by 4 papers in the map (data through 7 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 43 of its 119 references that are in the map. First posted on arXiv 5 Dec 2025.

Builds on

43 of 119 references.

Closest ancestors · 12

Same direction, newest first

  1. 2025AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents9 Sep
  2. 2025MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols17 Aug
  3. 2025MCP-Guard: A Multi-Stage Defense-in-Depth Framework for Securing Model Context Protocol in Agentic AI14 Aug
  4. 2025From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows29 Jun
  5. 2025LlamaFirewall: An open source guardrail system for building secure AI agents6 May
  6. 2025MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits2 Apr
  7. 2025Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents17 Mar
  8. 2025A Survey on Trustworthy LLM Agents: Threats and Countermeasures12 Mar
  9. 2025MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents7 Feb
  10. 2024GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning13 Jun
  11. 2024AirGapAgent: Protecting Privacy-Conscious Conversational Agents8 May
  12. 2024IsolateGPT: An Execution Isolation Architecture for LLM-Based Agentic Systems8 Mar

Other references · 31

  1. 2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,355
  2. 2025DeepSeek-R1: Incentivizing Reasoning Capability in LLMs via Reinforcement Learningcited by 6,146
  3. 2023Generative Agents: Interactive Simulacra of Human Behaviorcited by 3,500
  4. 2023A Survey on Large Language Model based Autonomous Agentscited by 2,203
  5. 2023WebArena: A Realistic Web Environment for Building Autonomous Agentscited by 1,908
  6. 2023A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questionscited by 1,582
  7. 2023The Rise and Potential of Large Language Model Based Agents: A Surveycited by 1,422
  8. 2023Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversationscited by 1,124
  9. 2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 760
  10. 2023A Prompt Pattern Catalog to Enhance Prompt Engineering with ChatGPTcited by 612
  11. 2023MemoryBank: Enhancing Large Language Models with Long-Term Memorycited by 539
  12. 2023NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Railscited by 347
19 more
  1. 2025Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directionscited by 257
  2. 2023Poisoning Language Models During Instruction Tuningcited by 254
  3. 2023Efficient Large Language Models: A Surveycited by 183
  4. 2024DynamoLLM: Designing LLM Inference Clusters for Performance and Energy Efficiencycited by 106
  5. 2024AIOS: LLM Agent Operating Systemcited by 94
  6. 2020Serverless in the Wild: Characterizing and Optimizing the Serverless Workload at a Large Cloud Providercited by 65
  7. 2025ACE: A Security Architecture for LLM-Integrated App Systemscited by 52
  8. 2025MCIP: Protecting MCP Safety via Model Contextual Integrity Protocolcited by 33
  9. 2025EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM Systemcited by 26
  10. 2024Towards Effective GenAI Multi-Agent Collaboration: Design and Evaluation for Enterprise Applicationscited by 19
  11. 2024PipeLLM: Fast and Confidential Large Language Model Services with Speculative Pipelined Encryptioncited by 10
  12. 2025CipherPrune: Efficient and Scalable Private Transformer Inferencecited by 9
  13. 2021Following the Data, Not the Function: Rethinking Function Orchestration in Serverless Computingcited by 7
  14. 2023Intel TDX Demystified: A Top-Down Approachcited by 7
  15. 2023InferDPT: Privacy-Preserving Inference for Closed-box Large Language Modelcited by 6
  16. 2025Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Datacited by 6
  17. 2025Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing Systemcited by 3
  18. 2024The Road to Trust: Building Enclaves within Confidential VMscited by 2
  19. 2024Cabin: Confining Untrusted Programs within Confidential VMscited by 2

Built on by

Cited by year (2026 to 7 Oct)

Citing papers per year: 2026: 4.

4 papers.

  1. 2026AgentCgroup: Understanding and Controlling OS Resources of AI Agentscited by 13
  2. 2026Opal: Private Memory for Personal AIcited by 1
  3. 2026NEXUS: Structured Runtime Safety for Tool-Using LLM Agentscited by 1
  4. 2026When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AIcited by 0

Similar, not cited

Close in wording, no citation either way

  1. 2025From Cloud-Native to Trust-Native: A Protocol for Verifiable Multi-Agent Systems
  2. 2025BlockA2A: Towards Secure and Verifiable Agent-to-Agent Interoperability
  3. 2026Verifiable Agentic Infrastructure: Proof-Derived Authorization for Sovereign AI Systems
  4. 2026AgenTEE: Confidential LLM Agent Execution on Edge Devices
  5. 2026AgentKernel: The Trust-Native Agentic Operating System
  6. 2026Trustworthy Agentic AI: A Comprehensive Cybersecurity and Systems Survey on Threat Landscapes, Defense Architectures, and Open Challenges
  7. 2026TrustedARI: Towards Trust-Native Agentic Routing Infrastructure for Agentic AI
  8. 2025SAFEFLOW: A Principled Protocol for Trustworthy and Transactional Autonomous Agent Systems