Search papers, labs, and topics across Lattice.
This paper addresses the critical vulnerability of AI agents storing private keys in software-accessible locations, which can be easily exploited, as demonstrated by a recent incident involving key exfiltration. The authors introduce a hardware keystore solution that enforces key confidentiality and content-aware authorization through a five-layer Zero-Trust enforcement architecture, replacing software-resident keys with hardware-confined keys accessed via a vendor-neutral PKCS#11 interface. Evaluation against 12 injection scenarios reveals that while baseline models had a 19.3% attack success rate, the proposed solution achieved a 0% attack success rate, ensuring robust protection without false positives.
Hardware confinement of cryptographic keys eliminates key exfiltration risks, achieving zero successful attacks in a rigorous evaluation against AI agent vulnerabilities.
AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.
