When agents handle confidential information: a survey of confidential computing for agentic AI

The arXiv survey by Javad Forough et al. reviews confidential computing approaches for agentic AI, noting that software-layer defenses can be bypassed by high-privilege attackers, while hardware TEEs and remote attestation provide an isolation path. The survey uses a unified taxonomy to compare the deployment roles and performance trade-offs of six TEE platforms: Intel SGX, Intel TDX, AMD SEV-SNP, ARM TrustZone, ARM CCA and NVIDIA H100 CC. It divides the agent threat model into five layers—perception, planning, memory, action and collaboration—corresponding to nine security goals, and compares which confidential computing findings for single inference can transfer to agents and which require new designs. The authors also list six open challenges, including composite attestation for multi-hop agent chains and GPU-TEE performance at LLM scale, and note that there is currently no widely adopted end-to-end framework that combines these hardware trust primitives into a production-grade security foundation.