At the Confidential Computing Summit in San Francisco, experts identified agentic AI security as the breakout use case for confidential computing. The core challenge mirrors the early web before HTTPS: agents lack a trust infrastructure for verifying identity and execution environments. Hardware-backed attestation — where a CPU hashes and signs a protected execution environment — is the proposed foundation, now available on AMD, Intel, and NVIDIA hardware via Azure and Google Cloud. Key gaps remain: binding agent identities to hardware, integrating attestation into the Model Context Protocol, establishing trust chains for agent-to-agent delegation, and cross-cloud trust. Efforts are underway to standardize composite attestation formats (Intel, Microsoft, NVIDIA) toward an IETF RFC. Limitations include cache-level side-channel attacks (TDXRay), shared Kubernetes control planes, unresolved data residency questions, and the difficulty of patching hardware vulnerabilities. The Linux Foundation's DNS-AID project extends DNS concepts to agent identity, signaling that the trust fabric for agents may ultimately resemble today's internet PKI.
