Trusted AI Agents in the Cloud

2025/12/05 by Teofil Bodea, Bodea, Teofil, Masanori Misono +17
Computer Science · Social Sciences · #Access Control and Trust #Artificial Intelligence (cs.AI) #Cloud Data Security Solutions #Cryptography and Security (cs.CR) #FOS: Computer and information sciences #Multiagent Systems (cs.MA) #Security and Verification in Computing

paper · pdf · doi:10.48550/arxiv.2512.05951

openalex publication_date 2025/12/05 · openalex created_date 2025/12/09 · openalex updated_date 2026/07/28

Abstract

AI agents powered by large language models are increasingly deployed as cloud services that autonomously access sensitive data, invoke external tools, and interact with other agents. However, these agents run within a complex multi-party ecosystem, where untrusted components can lead to data leakage, tampering, or unintended behavior. Existing Confidential Virtual Machines (CVMs) provide only per binary protection and offer no guarantees for cross-principal trust, accelerator-level isolation, or supervised agent behavior. We present Omega, a system that enables trusted AI agents by enforcing end-to-end isolation, establishing verifiable trust across all contributing principals, and supervising every external interaction with accountable provenance. Omega builds on Confidential VMs and Confidential GPUs to create a Trusted Agent Platform that hosts many agents within a single CVM using nested isolation. It also provides efficient multi-agent orchestration with cross-principal trust establishment via differential attestation, and a policy specification and enforcement framework that governs data access, tool usage, and inter-agent communication for data protection and regulatory compliance. Implemented on AMD SEV-SNP and NVIDIA H100, Omega fully secures agent state across CVM-GPU, and achieves high performance while enabling high-density, policy-compliant multi-agent deployments at cloud scale.

Citations

• AgentSentinel: An End-to-End and Real-Time Security Defense Framework for Computer-Use Agents
• EchoLeak: The First Real-World Zero-Click Prompt Injection Exploit in a Production LLM System
• Rethinking Tamper-Evident Logging: A High-Performance, Co-Designed Auditing System
• MCPSecBench: A Systematic Security Benchmark and Playground for Testing Model Context Protocols
• MCP-Guard: A Defense Framework for Model Context Protocol Integrity in Large Language Model Applications
• Trivial Trojans: How Minimal MCP Servers Enable Cross-Tool Exfiltration of Sensitive Data
• From Prompt Injections to Protocol Exploits: Threats in LLM-Powered AI Agents Workflows
• MCIP: Protecting MCP Safety via Model Contextual Integrity Protocol
• LlamaFirewall: An open source guardrail system for building secure AI agents
• ACE: A Security Architecture for LLM-Integrated App Systems
• MCP Safety Audit: LLMs with the Model Context Protocol Allow Major Security Exploits
• Model Context Protocol (MCP): Landscape, Security Threats, and Future Research Directions
• Prompt Flow Integrity to Prevent Privilege Escalation in LLM Agents
• A Survey on Trustworthy LLM Agents: Threats and Countermeasures
• CipherPrune: Efficient and Scalable Private Transformer Inference
• MELON: Provable Defense Against Indirect Prompt Injection Attacks in AI Agents
• DeepSeek-R1 incentivizes reasoning in LLMs through reinforcement learning
• Towards Effective GenAI Multi-Agent Collaboration: Design and Evaluation for Enterprise Applications
• PipeLLM: Fast and Confidential Large Language Model Services with Speculative Pipelined Encryption
• DynamoLLM: Designing LLM Inference Clusters for Performance and Energy Efficiency
• Cabin: Confining Untrusted Programs within Confidential VMs
• GuardAgent: Safeguard LLM Agents by a Guard Agent via Knowledge-Enabled Reasoning
• AirGapAgent: Protecting Privacy-Conscious Conversational Agents
• AIOS: LLM Agent Operating System
• The Road to Trust: Building Enclaves within Confidential VMs
• Llama Guard: LLM-based Input-Output Safeguard for Human-AI Conversations
• Efficient Large Language Models: A Survey
• A Survey on Hallucination in Large Language Models: Principles, Taxonomy, Challenges, and Open Questions
• InferDPT: Privacy-Preserving Inference for Black-box Large Language Model
• NeMo Guardrails: A Toolkit for Controllable and Safe LLM Applications with Programmable Rails
• The Rise and Potential of Large Language Model Based Agents: A Survey
• Autonomous Tester Agent Benchmark
• MemoryBank: Enhancing Large Language Models with Long-Term Memory
• Poisoning Language Models During Instruction Tuning
• Generative Agents: Interactive Simulacra of Human Behavior
• Intel TDX Demystified: A Top-Down Approach
• A Prompt Pattern Catalog to Enhance Prompt Engineering with ChatGPT
• Ignore Previous Prompt: Attack Techniques For Language Models
• ReAct: Synergizing Reasoning and Acting in Language Models
• FlexOS: Towards Flexible OS Isolation
• Following the Data, Not the Function: Rethinking Function Orchestration in Serverless Computing
• Serverless in the Wild: Characterizing and Optimizing the Serverless Workload at a Large Cloud Provider
• On the security of public key protocols
• MindGuard: Intrinsic Decision Inspection for Securing LLM Agents Against Metadata Poisoning

Related

• From Cloud-Native to Trust-Native: A Protocol for Verifiable Multi-Agent Systems
• MVVM: Deploy Your AI Agents-Securely, Efficiently, Everywhere
• Decentralized Granular Access Control for Agentic AI Systems in Critical Infrastructure
• Decentralized Compute on Untrusted Hardware Using Intel TDX and Encrypted CVMs
• Trustworthy confidential virtual machines for the masses