Keynote: Agentic AI Is Running Your Infrastructure

### Overview In this keynote address, the speaker speaks to members and attendees associated with the Linux Foundation's Confidential Computing Consortium (CCC). The presentation focuses on how to communicate the vital importance of confidential computing to customers, CISOs, security architects, board members, and auditors in an era where agentic AI is rapidly managing infrastructure. The speaker emphasizes that when AI-driven systems fail, accountability falls squarely on organizations and their customers rather than external vendors, making foundational infrastructure security indispensable.

### Key Topics - **Accountability in AI-Driven Infrastructure**: As AI agents touch and manage systems everywhere, organizations must recognize that they bear ultimate responsibility when operations go wrong. - **Failure of Traditional and Reactive Defenses**: Host perimeters, network perimeters, traditional virtualization, and reactive defense methods fail to provide adequate protection against the asymmetry and speed of AI-driven attacks. - **Role of the Confidential Computing Consortium (CCC)**: Operating under the Linux Foundation, the CCC provides a neutral venue for competitors to collaborate, sponsors academic research, engages standards bodies and regulators worldwide, and promotes open-source trusted computing bases. - **Securing Agentic AI Workflows**: Moving beyond reactive software controls to hardware isolation and cryptographic attestation to protect sensitive data, credentials, and execution in memory. - **Data and Process Sovereignty**: Expanding the concept of sovereignty beyond national borders to encompass organizational and personal sovereignty, protecting both sensitive data and agent processes.

### Technical Details Traditional virtualization and software-based defenses leave system memory (RAM) exposed; if memory remains unprotected, all sensitive context, confidential data, and credentials can be accessed. Models like Willis's lethal trifecta (a reinterpretation of the CIA triad—confidentiality, integrity, and availability) become irrelevant if the underlying infrastructure is compromised.

To demonstrate this risk, the speaker provides a concrete example of an MCP agent communicating with an MCP server to execute a financial transaction (buying 500 shares of stock on behalf of an organization). Without hardware-level protection, an attacker or tampering mechanism can alter critical parameters: switching an action from a buy to a sale, altering amounts, changing the targeted stock, swapping the entity on whose behalf the transaction occurs, or redirecting to an unauthorized bank account. By encapsulating this execution in a hardware-isolated confidential computing environment, systems gain: 1. **Integrity protection**: Preventing unauthorized alteration of instructions or runtime states. 2. **Confidentiality protection**: Preventing extraction of sensitive execution data and context from memory. 3. **Cryptographic attestation**: Providing verifiable proof to external parties that the workload executed securely on trusted hardware.

### Takeaways Organizations cannot afford to deploy agentic AI first and address security reactively later. Customer-facing teams and security professionals must clearly articulate the need for hardware-rooted trust and cryptographic guarantees. The CCC encourages industry members to collaborate openly on standards, contribute to open source, and ensure agentic AI infrastructures are fundamentally protected from the hardware layer up.