Hardware keystores lock agent keys, block prompt injections

Problem

This paper studies the risk that AI agents performing cryptographic operations store private keys in software-accessible memory (plaintext files, environment variables, container memory), making them extractable by any process with read privileges. A recent production incident demonstrated how quickly keys can be exfiltrated. The work targets two properties: key confidentiality and content-aware authorisation for every signing operation.

Approach

The authors replace software-resident keys with hardware-confined keys accessed via a vendor-neutral PKCS#11 adapter so private keys never exist in host memory; signatures are produced on-device and returned as opaque results. Hardware confinement is combined with a five-layer Zero-Trust enforcement stack: session identity (SAGA), deterministic scope bounds (Smax), semantic intent validation (RAV), taint tracking, and the hardware execution boundary. The Agent Kernel implements these layers, exposes MCP tools to an untrusted agent, and mediates PKCS#11 calls. The prototype uses SoftHSMv2 for reproducibility and validates drop-in behaviour on an embedded TPM 2.0. Evaluation uses 12 injection scenarios derived from the AgentDojo ImportantInstructionsAttack template across three injection-following LLMs (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash), with a combined n=192 trials and additional benign scenarios.

Key Findings

• The hardware-keystore plus enforcement stack reduces the protected Attack Success Rate to 0% across n=192 combined trials; the combined baseline ASR was 19.3% with a Wilson 95% CI of [14.3%, 25.4%], and the protected CI upper bound is reported as 2.0%.
• Deterministic blockers: a pre-armed SHA-256 commitment (Chist) prevents target-substitution attacks instantly; the hardware boundary architecturally prevents private-key exfiltration because no private key file exists in the HSM-backed deployment.
• The RAV (an LLM-based semantic judge) provides probabilistic semantic filtering when no commitment exists and reduces HITL escalations by blocking obvious injections before human notification; in an ablation the RAV reduced an otherwise high baseline ASR to 0% for a small sample.
• Zero false positives were observed on the four benign task scenarios in the evaluation.
• Performance: kernel fast path latency ≈10 ms (SoftHSM) and ≈350 ms (TPM2); secure warm path latencies ≈1,069 ms (SoftHSM) and ≈1,409 ms (TPM2). The design targets low-frequency, high-value signing operations, not high-rate API signing.

Limitations

The paper does not model a compromised OS kernel, physical HSM attacks, or PKCS#11 timing side-channels. SoftHSMv2 lacks tamper resistance and is used as a reproducibility proxy; real HSMs provide stronger physical guarantees. The RAV is probabilistic and its contribution is sample-limited; its judge runs in a network-isolated process but not a hardware-isolated environment. The prototype does not fully propagate taint to files written during a session, which could enable laundering unless deployments enforce filesystem-level taint. HITL approval fatigue is a recognised risk because the prototype does not rate-limit escalations.

Implications

An attacker cannot extract private keys from a properly configured HSM-backed MCP deployment, closing the key-exfiltration attack class structurally. However, if an agent is granted legitimate signing authority, abuse remains possible unless deterministic controls (commitment, scope, quota) or semantic checks block the request. Attackers therefore gain no advantage from prompt injection for exfiltration, but could still aim to induce authorised misuse where human-in-the-loop or semantic validation thresholds are weak. The architecture raises the bar for adversaries but does not eliminate the need to protect host integrity or defend against physical and side-channel attacks.