When Agents Handle Secrets: A Survey of Confidential Computing for Agentic AI

arXiv 2605.03213 ↗First posted 4 May 2026cs.CR cs.AIcited by 0

On the map: LLM agents and tool use → Agent threats, guardrails and governance

Abstract (arXiv)

Agentic AI systems, specifically LLM-driven agents that plan, invoke tools, maintain persistent memory, and delegate tasks to peer agents via protocols such as MCP and A2A, introduce a threat surface that differs materially from standalone model inference. Agents accumulate sensitive context, hold credentials, and operate across pipelines no single party fully controls, enabling prompt injection, context exfiltration, credential theft, and inter-agent message poisoning. Current defenses operate entirely within the software stack and can be silently bypassed by a sufficiently privileged adversary such as a compromised cloud operator. Confidential computing (CC) offers a hardware-rooted alternative: Trusted Execution Environments (TEEs) isolate agent code and data from privileged system software, while remote attestation enables verifiable trust across distributed deployments. This survey synthesizes the design space in four parts: (i) a unified taxonomy of six TEE platforms (Intel SGX, Intel TDX, AMD SEV-SNP, ARM TrustZone, ARM CCA, and NVIDIA H100 CC) covering deployment roles and performance tradeoffs; (ii) an agent-centric threat model spanning perception, planning, memory, action, and coordination layers mapped to nine security goals; (iii) a comparative survey of CC-based defenses distinguishing findings that transfer from single-call inference versus what requires new agentic designs; and (iv) six open challenges including compound attestation for multi-hop agent chains and GPU-TEE performance at LLM scale. While several hardware trust primitives appear mature enough for targeted deployments, no broadly established end-to-end framework yet binds them into a coherent security substrate for production agentic AI.

Key facts. No citing papers in the map yet (data through 14 Oct 2026). Placed in Agent threats, guardrails and governance, one of 16 directions in LLM agents and tool use. Builds on 56 of its 111 references that are in the map. First posted on arXiv 4 May 2026.

Builds on

56 of 111 references.

Closest ancestors · 12

Same direction, newest first

Other references · 44

2022Chain-of-Thought Prompting Elicits Reasoning in Large Language Modelscited by 12,459
2022ReAct: Synergizing Reasoning and Acting in Language Modelscited by 8,695
2017Billion-scale similarity search with GPUscited by 2,497
2023Not what you've signed up for: Compromising Real-World LLM-Integrated Applications with Indirect Prompt Injectioncited by 1,443
2022Ignore Previous Prompt: Attack Techniques For Language Modelscited by 832
2024A Survey on RAG Meeting LLMs: Towards Retrieval-Augmented Large Language Modelscited by 452
2025Multi-Agent Collaboration Mechanisms: A Survey of LLMscited by 431
2023A Survey on Large Language Model (LLM) Security and Privacy: The Good, the Bad, and the Uglycited by 387
2020FLTrust: Byzantine-robust Federated Learning via Trust Bootstrappingcited by 346
2024ToolSandbox: A Stateful, Conversational, Interactive Evaluation Benchmark for LLM Tool Use Capabilitiescited by 295
2025Agentic Retrieval-Augmented Generation: A Survey on Agentic RAGcited by 249
2018Gazelle: A Low Latency Framework for Secure Neural Network Inferencecited by 193

32 more

2024Security and Privacy Challenges of Large Language Models: A Surveycited by 186
2021CrypTen: Secure Multi-Party Computation Meets Machine Learningcited by 131
2024AI Agents Under Threat: A Survey of Key Security Challenges and Future Pathwayscited by 127
2018Slalom: Fast, Verifiable and Private Execution of Neural Networks in Trusted Hardwarecited by 102
2020CrypTFlow2: Practical 2-Party Secure Inferencecited by 82
2025Collaborative Memory: Multi-User Memory Sharing in LLM Agents with Dynamic Access Controlcited by 61
2020DarkneTZ: Towards Model Privacy at the Edge using Trusted Execution Environmentscited by 58
2018Chiron: Privacy-preserving Machine Learning as a Servicecited by 40
2025Multi-Agent Coordination across Diverse Applications: A Surveycited by 37
2025EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM Systemcited by 29
2020ShadowNet: A Secure and Efficient On-device Model Inference System for Convolutional Neural Networkscited by 21
2018SgxPectre Attacks: Stealing Intel Secrets from SGX Enclaves via Speculative Executioncited by 14
2024PermLLM: Private Inference of Large Language Models within 3 Seconds under WANcited by 14
2024No Free Lunch Theorem for Privacy-Preserving LLM Inferencecited by 13
2024A First Look At Efficient And Secure On-Device LLM Inference Against KV Leakagecited by 8
2024MPC-Minimized Secure LLM Inferencecited by 6
2024LeftoverLocals: Listening to LLM Responses Through Leaked GPU Local Memorycited by 5
2025Confidential LLM Inference: Performance and Cost Across CPU and GPU TEEscited by 5
2023ACAI: Protecting Accelerator Execution with Arm Confidential Computing Architecturecited by 4
2024GuaranTEE: Towards Attestable and Private ML with CCAcited by 3
2024TEESlice: Protecting Sensitive Neural Network Models in Trusted Execution Environments When Attackers have Pre-Trained Modelscited by 3
2024A Survey on Private Transformer Inferencecited by 3
2025GuardNet: Graph-Attention Filtering for Jailbreak Defense in Large Language Modelscited by 3
2017StealthDB: a Scalable Encrypted Database with Full SQL Query Supportcited by 2
2025An Early Experience with Confidential Computing Architecture for On-Device Model Protectioncited by 2
2025OpenCCA: An Open Framework to Enable Arm CCA Researchcited by 2
2025Blueprint, Bootstrap, and Bridge: A Security Look at NVIDIA GPU Confidential Computingcited by 2
2025CAEC: Confidential, Attestable, and Efficient Inter-CVM Communication with Arm CCAcited by 2
2023Confidential Computing across Edge-to-Cloud for Machine Learning: A Survey Studycited by 1
2025Dynamic Probabilistic Noise Injection for Membership Inference Defensecited by 1
2025Towards Confidential and Efficient LLM Inference with Dual Privacy Protectioncited by 1
2026Vulnerabilities in Partial TEE-Shielded LLM Inference with Precomputed Noisecited by 1

Built on by

Not cited yet.

Similar, not cited

Close in wording, no citation either way