Fetching from the wire…
01
02
03
04
05
06
07
08
Public story · 2026-08-07 · high
A real signing key was stolen from an agent framework via email injection in under five minutes, the incident the new design was built to stop.
Why now: The zero-percent result surfaces while agent frameworks still default to plaintext signing keys in environment variables, the exact setup the paper's opening incident exploited.
A new signing scheme locks agent private keys inside hardware and cut successful email-injection attacks from 19.3% to 0%, according to a paper posted to arXiv as 2608.06130.
Agents that sign commits, approve payments, or push code typically hold those signing keys in plaintext, sitting in environment variables the agent process can read on demand. The paper opens with what that costs: a real key pulled out of a widely deployed agent framework through an email prompt injection, in under five minutes.
The fix moves the key into a hardware security module, TPM, or smart card behind the PKCS#11 standard, so the host process never touches the key itself, only an opaque handle to it. Five separate checks sit on top: session identity, scope bounds, semantic validation, taint tracking, and the hardware boundary itself.
The researchers ran 12 AgentDojo ImportantInstructionsAttack scenarios across four models, 192 trials total. The unprotected baseline succeeded 19.3% of the time, with a confidence interval of 14.3% to 25.4%. The hardware-backed version succeeded zero times, with a Wilson 95% upper bound of 2.0%, and didn't block any of the benign tasks it was tested against.
What the paper doesn't say is whether any production agent framework has adopted this, or what it costs to run an HSM or TPM check on every signing call at scale. The result holds in a benchmark, not in the wild yet.
The bet worth making: agents signing things with plaintext keys in env vars is the current default, and it's going to look as reckless as committing a .env file to a public repo once one of these keys gets used for something with real money behind it.
Each link below shares sources, entities, or timing with this story.
Shared entity: ASR / Same source domain / Shared topic / Earlier coverage / Tension
Both cover ASR; reported by the same outlet (arxiv.org); overlapping topics (against, agent, agentdojo).
Both cover ASR; reported by the same outlet (arxiv.org); overlapping topics (against, agent).
Shared entity: Against / Same source domain / Shared topic / Earlier coverage / Tension
Both cover Against; reported by the same outlet (arxiv.org); overlapping topics (against, agent).
Shared entity: ASR / Same source domain / Shared topic / Earlier coverage
Both cover ASR; reported by the same outlet (arxiv.org); overlapping topics (against, agent, injection).
Same source domain / Shared topic / Tension
Reported by the same outlet (arxiv.org); overlapping topics (against, agent, agentdojo, boundary, injection); pushes against this story (against).
Shared entity: TPM / Same source domain / Earlier coverage / Tension
Both cover TPM; reported by the same outlet (arxiv.org); earlier TPM coverage from 2026-08-05.
Shared entity: Wilson / Same source domain / Earlier coverage / Tension
Both cover Wilson; reported by the same outlet (arxiv.org); earlier Wilson coverage from 2026-07-31.
Shared entity: Against / Shared topic / Earlier coverage / Tension
Both cover Against; overlapping topics (against, agent); earlier Against coverage from 2026-06-26.