Hardware keystores drive agent key-exfiltration attack success from 19.3% to zero — after keys were stolen from a real framework in under five minutes

arXiv 2608.06130·medium signalXBlueskyLinkedInCopy link

The paper opens with a live failure: private keys exfiltrated from a widely deployed agent framework via email injection in under five minutes, because the keys sat in software-readable storage the agent could reach. Their five-layer zero-trust MCP stack — session identity, scope bounds, semantic validation, taint tracking, and a hardware execution boundary (HSM/TPM/smart card) that returns only opaque result handles — cut attack success from 19.3% [14.3–25.4%] to 0% (95% CI upper bound 2.0%) across four models and 12 injection scenarios (n=192), with zero false positives on benign flows. The generalizable rule: an agent should hold a handle to a signing capability, never the key material itself.