Hardware Keystore Drops AI Agent Attack Success to 0%

A new design pulls AI agents' signing keys out of plaintext storage and locks them inside physical hardware, per an August 6 arXiv paper. The paper cites a production incident where email injection exfiltrated keys from a widely deployed framework. The theft took under five minutes and gave the attacker power to sign commits or authenticate API calls as the agent.

The fix routes every key through a PKCS#11 interface to an HSM, TPM, or smart card. The agent's host process only ever touches an opaque handle, never the key itself. That's wrapped in five checks: session identity, scope bounds, semantic validation, taint tracking, and a hardware boundary.

Researchers tested the setup against 12 injection scenarios from AgentDojo's ImportantInstructionsAttack template, across four models and 192 trials. The unprotected baseline succeeded 19.3% of the time, with a range of 14.3% to 25.4%. The protected version hit zero successes, with a 95% statistical ceiling of 2%, and produced no false positives on legitimate tasks.