Confidential Computing Summit 2026
2026-06-23..2026-06-24
San Francisco, United States
as the organisers put it
Confidential Computing Summit brings together AI, data, and security leaders advancing secure, real-world AI deployment.
| title | author | length |
|---|---|---|
| DriftlessAF - An open source agentic reconciler framework proven at scale | Manfred Moser | 26m |
Open source reconciler framework Driftless.AF (Apache license) runs in Go with Terraform recipes for Google Cloud, a GCS-backed work queue, and a meta-agent… | ||
| Confidential Computing Summit 2026 Highlight Video | 01m | |
Claims that confidential computing enables secure genetic computing, explicitly saying it applies beyond just genetic AI, and argues this protects individual… | ||
| Keynote: Future-Proofing Confidential AI | Nelly Porter, Anand Pashupathy | 20m |
Cloud architecture adds hardware-enforced TEEs across CPUs and GPUs (H100, Blackwell B200, and new mid-size GPUs in public preview) and a confidential external… | ||
| Keynote: Welcome – Jim Zemlin | Jim Zemlin | 05m |
Linux Foundation says it hosts major projects like the PyTorch Software Foundation, MCP and Agentech AI Foundation while running a roughly $350 million… | ||
| Keynote: Welcome Address | Aaron Fulkerson | 13m |
Announces an open source stack that cryptographically binds agent governance to hardware roots of trust, extending Microsoft AGT (already in millions of… | ||
| Keynote: Attested, Transparent, Sovereign: The Evolution of Confidential Computing | Mark Russinovich | 19m |
Microsoft describes moving core services into hardware TEEs: Entra token signing and Microsoft account token signing run 100% inside TEEs, Windows licensing… | ||
| Keynote: Protecting Data in the Agentic AI Era | Hugo Romero | 12m |
Agentic AI is acting on sensitive data so hardware-rooted confidential computing becomes the enforcement point: AMD SEV with five generations in production… | ||
| Keynote: Agentic AI Is Running Your Infrastructure | Mike Bursell | 13m |
Enterprises already run autonomous agents that make trades and touch sensitive systems: one demo shows an agent instructed to buy 500 shares of "Mike Co" and a… | ||
| Keynote: Welcome – Nelly Porter | Nelly Porter | 04m |
Claims that hardware is ready and confidential computing has moved from debate to deployment, with cloud vendors offering the building blocks. Focus shifts… | ||
| Keynote Panel: The Sovereign Stack: Nations, Enterprises & the Demand for Verifiable AI | Hugo Romero, Najwa Aaraj, Mark Russinovich, Nelly Porter, Mike Bursell | 34m |
Panel details hardware and cloud progress: A100 and H100 support preliminary confidential modes, MI455 and upcoming Ver Rubin extend TEE protections across… | ||
| Strictly Confidential: Use Cases & Demos of AI Workflows in TEEs | S. Lugani, R. Narjala | 24m |
Demo shows end-to-end implementation: Google Cloud adds confidential G4 (NVIDIA Blackwell RTX Pro 6000) and expands C3→C4 CPU families, runs AMD SEV… | ||
| NVIDIA Confidential Computing Attestation for Next-Generation AI | R. Nertney, S. Gilson | 18m |
NVIDIA expands attestation from a single Hopper GPU (2024) and protected PCIe to rack-scale Vera Rubin NVL72, proving multi-node attestation of dozens of GPUs… | ||
| Panel Discussion: State of the Union: Confidential AI From the Field | Aaron Fulkerson | 30m |
Panelists report concrete wins and remaining gaps: a UAE mandate pushes 50% mandate for autonomous agents within two years; SWIFT runs model validation across… | ||
| GKE Hypercluster: Kubernetes TEEs for AI at Scale | Komei Nakamoto, Keith Moyer | 27m |
GKE Hypercluster splits each Kubernetes node into an untrusted parent and a minimal sealed VM that runs measured, attested workloads with zero operator shells… | ||
| Agentic Zero Trust: at Rest, in Transit, and at Runtime | N. Polshakova, J. Halley | 25m |
Kubernetes K3s cluster with Kata containers and GPU passthrough runs self‑hosted vLLM on H100s behind an LLMD gateway; attack toolkit attempts reading… | ||
| Confidential Tenancy: Towards Digital Sovereignty on Public Clouds | A. Delignat-Lavaud | 27m |
Proposes extending confidential computing into a full confidential tenancy that isolates an entire cloud account — IaaS, PaaS, SaaS and its management plane —… | ||
| Who is Calling? Identity for Agents with AAuth | Dick Hardt | 23m |
AAuth gives every agent its own cryptographic identity and replaces brittle API keys with proof of possession via HTTP message signing; three token types… | ||
| Trust Is the Next Bottleneck: Why the Agentic Economy Needs Confidential | P. Khandavilli | 26m |
Claims that current agents cannot cryptographically prove what code ran or whether data stayed inside a trustworthy boundary and gives hard figures — 750k… | ||
| From Perimeter to Silicon: Why Agentic AI Demands a New Security Model | D. Middleton | 27m |
Agentic AI shifts threats from binary tampering to behavioral and cognitive attacks, so the proposal is to anchor trust with cryptographic attestation and… | ||
| AMD SEV & Azure Local: When Confidential VMs Go Local | D. Harmon, D. Manohar | 23m |
Claim: AMD SEV plus Azure Local bring cloud-grade confidential VMs to on‑prem, edge, sovereign and disconnected sites using SEV‑SNP on Genoa EPYC and a… | ||
| Keynote: Encore in Numbers | Monique Dumais | 18m |
Encore handles 4 million accounts and about $2.6 billion in annual collections, each account carrying 25–50 documents, and needs to unlock value from data… | ||
| Keynote: Reliability in AI (Agentic) Systems | Ion Stoica | 27m |
Study of 86 agent deployments across five domains finds failures are prevalent and no single root cause dominates; manual annotation of 150 traces plus an LLM… | ||
| From Pixels To Agents: Optimizing On-Device Performance of Confidential Computing in AI Evolution | Savas Ozkan | 28m |
Experiments on ISLET/isolate show confidential on-device AI adds measurable costs: ~10% inference overhead from frequent context switches, and model loading up… | ||
| Running AI Agents Inside TEEs Without Losing Your Mind | Sonali R. Mishra | 29m |
Architecture for isolating agent-to-agent communication uses confidential VMs, measured boot, attestation nonces and sealed keys, and highlights practical… | ||
| "If It's Shared, It's Vulnerable": Is Kubernetes the Right Platform for Confidential Compute? | Z. Kaiser | 18m |
Kubernetes shares kernels, control planes, network stacks and buses, so attacker-capable primitives like eBPF snooping, conntrack hijacks, cache side channels… | ||
| Keynote: Trustworthy AI with Confidential Computing | Najwa Aaraj | 15m |
Claims an end-to-end confidential AI stack with concrete tools: VEIL implements fully homomorphic encryption for encrypted inference and ships as an SDK used… | ||
| Securing the Future with Azure Confidential Computing | Run Cai, Ashutosh Chickerur | 22m |
Azure announces GA for Intel-based confidential VMs with NVMe via Azure Boost yielding 5x storage throughput, 16% latency reduction, Azure integrated HSM (FIPS… | ||
| Panel Discussion: Proof in Production: Customer Lessons from Confidential AI | Reshma Shetty, Shyam Menon, Nikhil Gulati, James Edwards | 24m |
Enterprises in regulated sectors deploy confidential computing to get verifiable artifacts instead of promises: runtime attestation shows where code ran… | ||
| Governing AI Agents at the Hardware Boundary | Imran Siddique | 23m |
Shows a concrete stack: the open‑source Agent Governance Toolkit plus a TEE-backed CMCP runtime that runs policies inside enclaves and emits verifiable trace… | ||
| Wrap-Up Session Panel Discussion: Sovereign AI | Sripriya Srinivasan, Najwa Aaraj | 20m |
IBM announces IBM Sovereign Core, a software stack that enforces four pillars—data, technology, operational and AI sovereignty—and aims to provide verifiable… | ||
| Wrap-Up Session Panel Discussion: Quick Takes | Anand Kashyap, Marvin Tong, Erica Brescia | 26m |
A rapid roundup of concrete tech and bets: Dstack open source plus Fal cloud runs CPU/GPU private inference and aims to pool idle GPUs for cryptographic… | ||
| Wrap-Up Session: Closing Remarks | Aaron Fulkerson | 01m |
Conference closes with thanks for attendee participation and Q&A, noting this is the fourth annual summit and a strong turnout. Tomorrow’s schedule features an… | ||
| Keynote: Welcome Back | Aaron Fulkerson | 01m |
Opening remarks outline today's lineup and stakes: a deputy CISO of Anthropic will discuss concrete threat models and mitigation tradeoffs, a CIO running… | ||
| Keynote: Privacy at the Hardware Level: Why the Stack Has to Change | B. Kaiser | 20m |
Argues that data privacy must be enforced in silicon and cites building a vertically integrated stack covering energy and mineral rights, land, racks, GPUs… | ||
| PetalGuard, A Privacy-preserving Federated Learning Framework | Victor Sucasas | 16m |
PetalGuard uses secret-sharing-based secure multi-party computation to aggregate local model updates so that clients send only cryptographic shares, claiming… | ||
| Building Trusted AI Factories with NVIDIA Accelerated Confidential Computing | E. Bohnhorst | 20m |
NVIDIA presents an end-to-end stack that extends hardware root of trust into GPUs with isolation and encryption across CPU GPU and NVLink and adds composite… | ||
| Confidential Computing for Sovereign AI: The Emerging Opportunity in Japan | T. Kondo, S. Ueki | 17m |
Japan targets a premium trust market where national AI spending (~¥70B plan) and a projected crowdsourced AI market of ~$120B by 2029 hides a roughly $30… | ||
| Q-Day Survival Guide: What the Post-quantum Cryptography Transition Means for Confidential Computing | A. Savage | 27m |
Estimates for Q-day compress to around 2030 after recent papers that add three orders of magnitude speedup to Shor-like attacks, overturning older 2035… | ||
| WhatsApp Private Processing | Kevin Hui, Yunqi Li, Elizabeth Li, Henry Wang, Varun Patil | 23m |
WhatsApp runs a production confidential‑computing stack that powers an Incognito Chat product launched May 2026 and has operated at scale for over a year… | ||
| Overview of the AWS Nitro System: Building Trust Through Secure Cloud Infrastructure | M. Wilson | 25m |
AWS Nitro splits virtualization into dedicated hardware and minimal software, using Annapurna Labs SoC Nitro cards for a hardware root of trust… | ||
| Global Agentic Identity and Programmable Trust: Lessons Learned From the NATO DIANA Pilot | M. Fontaine | 28m |
NATO DIANA pilot demonstrates a working mesh that uses confidential computing to give each entity a self‑generated 256‑bit cryptographic identifier that is… | ||
| Privacy-Preserving Fraud Intelligence for India's Open Finance Ecosystem Using TEEs | K. Gopinath, R. Kolga | 24m |
India faces about $4 billion annual loan fraud; a deployed Open Finance network with 285 million linked accounts and 431 million consents enables a… | ||
| A Large-Scale Data Clean Room Case Study in Japan | T. Takenouchi, T. Kondo | 15m |
Japan is moving privacy law to endorse PETs and confidential computing, and a deployed data clean room handles 40 million users for a Fortune Global 500 telco… | ||
| Characterizing NVIDIA Confidential Computing Overheads Across Model Inference & Training | T. Verma | 18m |
Measurement shows NVIDIA Confidential Computing overheads stem from DMA disabled between CPU and GPU, forcing a bounce buffer path that inflates CPU→GPU… | ||
| Realizing Confidential VMs Ensuring Privacy of AI Features | H.Narukawa, A. Misawa | 15m |
Private cloud deploys AMD SEV-SNP with attestation so mobile apps verify a 64-byte field embedding a container public key and establish TLS directly to a VM… | ||
| Private Model as a Service: Zero-Trust Blueprint for Protecting AI Weights | M. Entenza, J. Freimann | 28m |
Private Model as a Service presents a production-ready reference architecture that keeps model weights encrypted and decrypts them only inside hardware-rooted… | ||
| From Trust Assumptions To Trust Evidence: Why PKI and Confidential Computing | Brian Trzupek | 24m |
DigiCert demonstrates two concrete solutions: retrofitting TPM-based measured boot and model integrity checks onto deployed MRIs using device identity… | ||
| Keynote: The Evolution of Apple Private Cloud Compute | Ivan Krstić | 24m |
Apple builds a private cloud compute (PCC) system that it claims already meets level three frontier security, asserting it is the only widely deployed system… | ||
| Keynote: The Defender Advantage Has a Single Point of Failure | Jason Clinton | 19m |
Claim: within 2–5 years CI/CD pipelines run Mythos-class models so products stop shipping exploitable security bugs. That permanent defender advantage has a… | ||
| Keynote Panel Discussion: Three Forces Making Confidential AI A Mandate | Monique Dumais, Jason Clinton, Brittany Kaiser, Ion Stoica, Jason Hiner | 32m |
Three forces make Confidential AI mandatory: Mythos‑class models make a malicious agent inside your environment probable, current agent architectures leak… | ||
| Regulatory Panel Discussion | Brittany Kaiser, Mark Bower, Aaron Fulkerson | 29m |
Regulators and standards bodies start citing trusted execution environments and confidential computing as concrete controls: Sweden now requires TEEs for GDPR… | ||
| Keynote: Closing & Wrap-Up | Aaron Fulkerson | 22m |
Conference wrap-up summarizes concrete milestones: confidential GPUs land on Azure and GCP in September 2024, Apple runs confidential AI across 2 billion… | ||
| Open Source, Confidential by Design: The Linux Stack for Agentic AI | Brittany Kaiser, Allen Roush, Shaw Walters, Tina Zhen | 32m |
Claims a Linux-first agent OS (Eliza OS), an agent harness wired to Gmail/Signal/Telegram that accidentally replied to a friend, and a demo agent inside a TDX… | ||
| How OPAQUE Enables Hardware-enforced AI Governance | Rishabh Poddar | 33m |
OPAQUE maps the AI stack into three layers and catalogs 8 categories 46 exposure vectors of data leakage, then enforces controls at the compute and control… | ||
| nothing matches | ||