Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture

• URL: http://arxiv.org/abs/2608.06130v1
• Date: Thu, 06 Aug 2026 15:04:26 GMT
• Title: Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
• Abstract summary: Hardware-confined keys are accessible through a vendor-neutral PKCS interface.<n> Hardware confinement is the primary contribution.<n>We evaluate against 12 injection scenarios derived from AgentDojo's ImportantAttack template.
• Score: 0.0
• License: http://arxiv.org/licenses/nonexclusive-distrib/1.0/
• Abstract: AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.

Related papers

• SIR: Self-improving Red-teaming for Compute Use Agents [71.71987044117371]
  Computer use agents (CUAs) are vision-language models that perceive a screen and act on a real operating system through mouse, keyboard, and terminal.<n>Because they can be exposed to untrusted content while operating, they are vulnerable to indirect prompt injection (IPI)<n>We present SIR, a black box IPI attack that composes stealthy injections from a small library of reusable principles stated in plain language.
  arXiv  Detail & Related papers  (2026-08-31T03:39:43Z)
• LMSM: LLM Security Framework Inspired by Linux Security Modules [56.93644694627783]
  Large language models (LLMs) are increasingly deployed with layered defenses, yet malicious prompts can still bypass them.<n>We present Language Model Security Modules (LMSM), a security framework that adapts the separation behind Linux Security Modules (LSM) to LLM serving.
  arXiv  Detail & Related papers  (2026-08-26T12:13:05Z)
• Stealing Reasoning Traces from Proprietary LLM APIs [84.58379404903394]
  We develop a scalable decryption jailbreak for encrypted reasoning traces.<n>It circumvents anti-distillation mechanisms, allowing adversaries to extract a proprietary model's reasoning.<n>It inadvertently reveals hazardous information hidden within the reasoning process.
  arXiv  Detail & Related papers  (2026-08-10T17:24:50Z)
• SkillGate: Cost Efficient Runtime Malicious Skill File Detection in Coding Agents [9.553517006800913]
  Software engineering teams now deploy AI coding agents as first-class productivity tools.<n>Malicious skill files can silently reprogram agent behavior, exfiltrating credentials, injecting backdoors into generated code, or redirecting agent actions to attacker-controlled endpoints.<n>We present SkillGate, a deployable security gateway that screens AI skill packages before coding agent installation.
  arXiv  Detail & Related papers  (2026-07-28T11:50:19Z)
• Buzz to Boom: Detecting Message Progression Vulnerabilities in Electron Applications via Segmented Directed Fuzzing [26.33861052551835]
  Electron is a popular framework for building cross-platform desktop applications.<n>Message propagation behavior is characterized as Message Vulnerabilities (MPVs)<n>We present Proton, a framework for detecting cross-process exploits via message passing.
  arXiv  Detail & Related papers  (2026-07-22T20:11:33Z)
• Understanding and Evaluating Claw-like Agent Security Through a Computer-Systems Lens [65.53494487819053]
  Claw-like AI agents (e.g., OpenClaw) are always-on processes with persistent access to credentials, files, tools, and external services.<n>We adopt a computer-system analogy: treating a Claw-like agent as an agentic computer system whose gateway runtime plays an OS-like mediation role.<n>We develop SafeClawArena, a benchmark of 406 adversarial tasks across four attack surfaces.
  arXiv  Detail & Related papers  (2026-06-29T18:00:45Z)
• Overeager Coding Agents: Measuring Out-of-Scope Actions on Benign Tasks [40.270213696031625]
  OverEager-Gen is a benchmark dedicated to overeager behavior on benign tasks.<n>On Claude Code, stripping the consent declaration alone raises the overeager rate from 0.0% to 17.1%.<n>OverEager-Gen therefore certifies each scenario's discriminative power before admission.
  arXiv  Detail & Related papers  (2026-05-18T16:00:41Z)
• LivePI: More Realistic Benchmarking of Agents Against Indirect Prompt Injection [18.354880541606004]
  LivePI is a structured benchmark for IPI risk in a production-like but test-controlled environment.<n>LivePI covers seven input surfaces, twelve attack/rendering families, and five malicious goals.<n>Group-chat injection is uniformly successful across the evaluated backbones in our deployment.
  arXiv  Detail & Related papers  (2026-05-18T07:41:35Z)
• CapSeal: Capability-Sealed Secret Mediation for Secure Agent Execution [1.9473631530390483]
  CapSeal is a capability-sealed secret mediation architecture that replaces direct secret access with constrained invocations through a local trusted broker.<n>We describe a Rust prototype integrated with an MCP-facing adapter, formulate conditional security goals for non-disclosure, constrained use, replay resistance, and auditability.
  arXiv  Detail & Related papers  (2026-04-18T00:23:32Z)
• Compiling Activation Steering into Weights via Null-Space Constraints for Stealthy Backdoors [48.881343993730844]
  Safety-aligned large language models (LLMs) are increasingly deployed in real-world pipelines.<n> adversaries can distribute backdoored checkpoints that behave normally under standard evaluation but jailbreak when a hidden trigger is present.<n>Recent post-hoc weight-editing methods offer an efficient approach to injecting such backdoors.
  arXiv  Detail & Related papers  (2026-04-14T06:48:33Z)
• Your Agent Is Mine: Measuring Malicious Intermediary Attacks on the LLM Supply Chain [6.142057368768942]
  Large language model (LLM) agents increasingly rely on third-party API routers to dispatch tool-calling requests.<n>We present the first systematic study of this attack surface.
  arXiv  Detail & Related papers  (2026-04-09T16:06:41Z)
• SecCodeBench-V2 Technical Report [43.10947096543533]
  We introduce SecCodeBench-V2, a benchmark for evaluating Large Language Model (LLM) copilots' capabilities of generating secure code.<n>SecCodeBench-V2 comprises 98 generation and fix scenarios derived from Alibaba Group's industrial productions.<n>For each scenario, SecCodeBench-V2 provides executable proof-of-concept (PoC) test cases for both functional validation and security verification.
  arXiv  Detail & Related papers  (2026-02-17T10:47:06Z)
• Trace: Securing Smart Contract Repository Against Access Control Vulnerability [58.02691083789239]
  GitHub hosts numerous smart contract repositories containing source code, documentation, and configuration files.<n>Third-party developers often reference, reuse, or fork code from these repositories during custom development.<n>Existing tools for detecting smart contract vulnerabilities are limited in their ability to handle complex repositories.
  arXiv  Detail & Related papers  (2025-10-22T05:18:28Z)

This list is automatically generated from the titles and abstracts of the papers in this site.

This site does not guarantee the quality of this site (including all information) and is not responsible for any consequences.