AI Agents Are Breaking the Security Promises of Confidential Computing

Key points

• Confidential computing, a method of protecting data even while a computer is actively using it, has gained serious traction in 2025 after years of slow adoption.
• AI agents, meaning software programs that carry out tasks on behalf of a business and remember context across those tasks, create a new security problem the technology was not built to handle.
• Apple deployed confidential computing across billions of devices in 2025, using hardware from Google, Nvidia, and Intel in a setup that required breaking its tradition of building everything in-house.
• ServiceNow cut a four-day manual process to eight seconds by running salary and commission queries through a confidential computing system, with 9,000 sales employees now getting instant answers.
• The global market for confidential computing is expected to reach around 160 billion dollars by 2030, according to Nvidia senior director Dion Harris.

Picture a vault that stays locked even while a bank teller is actively counting the money inside. That is roughly what confidential computing does: it keeps sensitive data encrypted, meaning scrambled and unreadable, even while a computer processor is working on it. For years the technology was too slow and too expensive for most companies to bother with. That is changing fast, and AI is the reason.

At last month's Linux Foundation Confidential Computing Summit in San Francisco, executives from Google Cloud, Microsoft Azure, and Nvidia said the old barriers, chiefly cost, processing speed, and setup complexity, are largely solved. Mark Russinovich, chief technology officer at Microsoft Azure, admitted he had wrongly predicted a breakthrough "for years" before saying, with some caution, that 2025 might finally be the year.

So what is the new problem?

AI agents are the complication. An agent is a piece of software that does not just answer a single question; it carries out multi-step tasks and, crucially, holds onto information it encounters along the way. Nelly Porter, Google Cloud's director of product management for confidential computing, gave a vivid example: imagine an AI agent helping assess a company for a potential acquisition. It reads financial records, internal projections, and sensitive business details. If the deal collapses, that agent does not automatically wipe what it learned.

"When they see or have even read access to this data, they cannot forget," Porter said.

Confidential computing was designed around a much simpler picture, where data goes in, gets processed, and comes back out. An agent that keeps a running memory of everything it has ever touched does not fit that model neatly.

Porter's proposed fix: give each agent its own dedicated encryption key controlling the memory it holds. When the agent's task is done, you destroy the key rather than hunting down and deleting every individual piece of data. The industry calls this "crypto-shredding." The data still technically exists, but without the key it is permanently unreadable, which is the next best thing to deleting it.

How does this affect ordinary people?

For most people, the practical impact shows up through the services they already use. Apple's Private Compute Cloud, which handles AI requests from iPhones and other Apple devices, is currently the largest real-world deployment of this technology. When your phone sends a question to Apple's servers, the system is designed so that even Apple's own engineers cannot read what you asked. The new setup involves Nvidia graphics processors (chips originally designed for video games but now used heavily for AI), Intel processors with a security feature called Trust Domain Extensions, and a specialised Google security chip called Titan.

On the business side, the consequences are concrete. ServiceNow, a software company, now lets its 9,000 sales staff ask an AI system about their own pay and commission forecasts and get an answer in eight seconds. Previously, those queries required a ticket to the finance department and a four-day wait. The sensitive data, including personal compensation details, never leaves a protected environment.

"A breach is unacceptable," said ServiceNow's chief digital information officer Kellie Romack. "Of course I'm going to choose it."

If you use services from companies adopting this technology, there is nothing specific you need to do right now. The protections are built into the infrastructure. The thing worth watching is whether the AI tools your employer or service providers use have clear policies on how long agents retain information about you, and whether that data can actually be deleted on request.

The failure mode here is not dramatic. Nobody gets hacked in the traditional sense. The risk is quieter: an AI system that absorbed your confidential details for one purpose quietly holding onto them for another. That is the problem the industry is now racing to solve before the agents are everywhere.

Operational takeaway: If your organisation is deploying AI agents, define a data-retention policy for agent memory before you deploy, not after your first postmortem.