AI代理的签名私钥容易被软件环境窃取，这套方案把密钥锁进硬件，注入攻击成功率从19.3%降到0%，做AI安全的可以读读。
AI代理现在常把私钥放在明文文件、环境变量或容器内存里，任何有读权限的进程都可能提取密钥。论文描述了一起生产事故：私钥通过邮件注入在不到五分钟内被窃取。作者提出用HSM、TPM或智能卡承载密钥，通过PKCS#11接口让硬件设备执行签名操作，宿主只拿到不透明句柄。整套零信任架构分五层，包括会话身份SAGA、作用域边界Smax、语义校验RAV、污点跟踪和硬件执行边界。在AgentDojo的12种注入场景中，四个模型加192次测试的基线攻击成功率从19.3%降至受保护时的0%，四个良性任务零误报。
Hardware Keystores for AI Agent Signing Workflows: A Zero-Trust MCP Enforcement Architecture
AI agents performing cryptographic operations (signing Git commits, authenticating API calls, issuing certificates) currently store private keys in software-accessible locations: plaintext files, environment variables, or container memory. Any process with sufficient read privileges can extract the raw key material. A recent production incident demonstrated the practical severity: private keys were exfiltrated from a widely deployed framework via email injection in under five minutes. We aim to enforce both key confidentiality and content-aware authorisation for key use. To that end, we replace software-resident keys with hardware-confined keys accessible through a vendor-neutral PKCS#11 interface. A hardware keystore (HSM, TPM, smart card) executes cryptographic operations on-device; the host receives only the result via opaque handles. Hardware confinement is the primary contribution; it is enabled by a surrounding five-layer Zero-Trust enforcement stack comprising session identity (SAGA), scope bounds (Smax), semantic validation (RAV), taint tracking, and the hardware execution boundary. We evaluate against 12 injection scenarios derived from AgentDojo's ImportantInstructionsAttack template (Debenedetti et al., arXiv:2406.13352). We run four LLM models; three follow injections in baseline mode (gpt-oss-120b, Qwen2.5-72B, DeepSeek-V4-Flash, n=192 combined). Baseline Attack Success Rate (ASR): 19.3% [14.3%, 25.4%]; protected ASR: 0% (Wilson 95% CI upper bound 2.0%). Zero false positives across four benign task scenarios.