Capability Overview
Confidential computing — the use of hardware-enforced Trusted Execution Environments (TEEs) and secure enclaves to protect data in use — has been steadily maturing, with adoption barriers like performance overhead and developer complexity beginning to fall. However, the emergence of agentic AI systems is introducing a new category of challenge that the threat models underpinning TEEs were never designed to address.
Agentic AI operates with degrees of autonomy, tool access, and multi-step reasoning that fundamentally differ from the static workloads confidential compute was built around. As organisations begin co-locating or integrating LLM agents with sensitive data vaults and enclave-protected pipelines, the attack surface is shifting in ways that defenders are only beginning to map.
Attack Surface Analysis
The core problem is a mismatch between the trust assumptions of confidential computing and the operational reality of agentic AI:
Attestation vs. runtime behaviour: TEE attestation verifies that a workload starts in an expected state, but agentic systems are inherently dynamic. An agent that behaves correctly at attestation time may receive malicious instructions via prompt injection during runtime, undermining the enclave’s integrity guarantee without ever triggering hardware-level alerts.
Cross-boundary tool use: Agents equipped with tool-calling capabilities can bridge confidential and non-confidential compute zones. A single tool call to an external API, file system, or memory store can create a covert channel through which sensitive enclave data is exfiltrated — a vector that traditional enclave exit controls were not designed to evaluate semantically.
Multi-agent orchestration: Orchestrated agent pipelines introduce trust delegation problems. A compromised orchestrator agent can issue instructions to sub-agents operating inside secure environments, effectively laundering malicious commands through a chain of otherwise-trusted components.
Persistent insider foothold: Because agents maintain session state and can be long-running, a successfully injected agent becomes a persistent threat actor with valid credentials and enclave access — functionally equivalent to an insider threat.
Framework Mapping
MITRE ATLAS:
- AML.T0051 (LLM Prompt Injection): The primary vector for subverting agentic behaviour inside or adjacent to confidential environments.
- AML.T0057 (LLM Data Leakage): Agents reasoning over sensitive enclave data may inadvertently or deliberately surface it through outputs.
- AML.T0047 (ML-Enabled Product or Service): The confidential compute + agentic AI stack is itself a new attack surface category.
- AML.T0056 (LLM Meta Prompt Extraction): System prompts encoding enclave access logic become exfiltration targets.
OWASP LLM Top 10:
- LLM08 (Excessive Agency): Agents with broad tool permissions inside secure environments represent the canonical excessive-agency scenario.
- LLM06 (Sensitive Information Disclosure): The proximity of agents to high-value data vaults amplifies leakage risk.
- LLM01 (Prompt Injection): External inputs processed by enclave-resident agents become injection vectors into trusted hardware contexts.
Threat Scenarios
Scenario 1 — Enclave Data Exfiltration via Injection: An attacker embeds a prompt injection payload in a document processed by an LLM agent running inside a TEE. The agent, following injected instructions, encodes sensitive records in a tool call response that is logged outside the enclave boundary.
Scenario 2 — Attestation Bypass through Deferred Malice: A supply-chain-compromised model weights package behaves correctly during TEE attestation but activates adversarial behaviour once a specific trigger phrase appears in runtime data, defeating the enclave’s integrity assurances.
Scenario 3 — Orchestrator Privilege Escalation: A public-facing orchestrator agent is jailbroken to issue elevated instructions to a sub-agent operating within a confidential compute environment, gaining indirect access to enclave-protected secrets without ever entering the enclave directly.
Defender Checklist
- Map all data flows between agentic AI components and TEE-protected workloads; treat every interface as a potential trust boundary violation.
- Apply semantic egress inspection to agent outputs leaving confidential boundaries — content-level, not just volume-based.
- Enforce minimal tool permissions for agents operating near sensitive data; block unrestricted external API calls from enclave-adjacent agents.
- Extend runtime monitoring inside enclaves to capture agent reasoning traces, not just system calls.
- Re-run threat modelling exercises specifically for multi-agent orchestration topologies that span confidential and non-confidential compute zones.
- Require continuous behavioural attestation mechanisms, not just point-in-time launch verification, for long-running agentic workloads.