Agent Signing Keys Move Into HSMs: PKCS#11 Keystore Plus Zero-Trust MCP Stack Drops Injection Success From 19.3% to 0%
arXiv 2608.06130 (Aug 6) targets the fact that AI agents signing Git commits, authenticating API calls, and issuing certificates keep private keys in plaintext files, env vars, or container memory — citing a production incident where keys were exfiltrated from a widely deployed framework via email injection in under five minutes. The design confines keys to an HSM, TPM, or smart card behind a vendor-neutral PKCS#11 interface so the host only ever receives opaque handles, wrapped in a five-layer enforcement stack (session identity, scope bounds, semantic validation, taint tracking, hardware boundary). Against 12 injection scenarios from AgentDojo's ImportantInstructionsAttack template across four models (n=192), baseline attack success rate was 19.3% [14.3%, 25.4%] and protected ASR was 0% (Wilson 95% upper bound 2.0%), with zero false positives on benign tasks.
↳ Follow the thread