Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-07 · high
A real signing key was stolen from an agent framework via email injection in under five minutes, the incident the new design was built to stop.
Why now: The zero-percent result surfaces while agent frameworks still default to plaintext signing keys in environment variables, the exact setup the paper's opening incident exploited.
A new signing scheme locks agent private keys inside hardware and cut successful email-injection attacks from 19.3% to 0%, according to a paper posted to arXiv as 2608.06130.
Agents that sign commits, approve payments, or push code typically hold those signing keys in plaintext, sitting in environment variables the agent process can read on demand. The paper opens with what that costs: a real key pulled out of a widely deployed agent framework through an email prompt injection, in under five minutes.
The fix moves the key into a hardware security module, TPM, or smart card behind the PKCS#11 standard, so the host process never touches the key itself, only an opaque handle to it. Five separate checks sit on top: session identity, scope bounds, semantic validation, taint tracking, and the hardware boundary itself.
The researchers ran 12 AgentDojo ImportantInstructionsAttack scenarios across four models, 192 trials total. The unprotected baseline succeeded 19.3% of the time, with a confidence interval of 14.3% to 25.4%. The hardware-backed version succeeded zero times, with a Wilson 95% upper bound of 2.0%, and didn't block any of the benign tasks it was tested against.
What the paper doesn't say is whether any production agent framework has adopted this, or what it costs to run an HSM or TPM check on every signing call at scale. The result holds in a benchmark, not in the wild yet.
The bet worth making: agents signing things with plaintext keys in env vars is the current default, and it's going to look as reckless as committing a .env file to a public repo once one of these keys gets used for something with real money behind it.
Each link below shares sources, entities, or timing with this story.
This paper opens with a live failure: private keys exfiltrated from a widely deployed agent framework via email injection, because the keys sat in software-readable storage the agent could reach. Their five-layer zero-trust MCP stack ends in a hardware execution boundary (HSM/...
The hardware keystore paper drove key-exfiltration success from 19.3% to 0% across four models and 12 injection scenarios by putting a hardware execution boundary at the end of a five-layer chain that returns only opaque result handles. You don't need an HSM to apply the princ...
arXiv 2608.05108 skips the RL-trained attacker models that dominate red teaming and generalize poorly, instead accumulating a strategy library across a sequence of (dataset, target) pairs that transfers to unseen targets with no retraining. AgentDojo: 86.7% ASR against Gemini-...
WebMASLab holds task, tools, and browser fixed and varies only architecture. The Telephone Loop attack exploits cross-agent delegation to create cyclical task loops, averaging 80% success with 0% detection against multi-agent versions of Claude Sonnet 4.5, GPT-5.2, and GPT-5.4...
arXiv 2607.26935 argues the human-vs-bot label space can't represent agent traffic: an MLP binary classifier misroutes 39.1% of real agent sessions as human, a SAINT transformer 34.5%, while adding an explicit third class yields agent F1 = 1.000 across all 30 runs. Against a f...
arXiv 2607.28165 attacks always-listening multimodal agents by embedding malicious instructions in ambient audio that overlaps user speech, using instruction augmentation and scenario concealment so the injection is imperceptible. Eleven agents evaluated, 69.10% average ASR ag...
MindPattern daily
One email a day at 7 AM. Sources and a take on every story. Unsubscribe anytime.