CoreWeave Launches Zero Trust AI Framework to Hand Customers Control of Keys and Access

Why CoreWeave says cloud security has to change

CoreWeave argues that agentic AI has changed what customers need from cloud security. Agents retrieve context, call tools, use memory, generate traces and trigger actions in other systems. Reinforcement learning can also pull inference into the training loop, so rollout generation, reward logic, updated checkpoints and new model behavior become part of one operating path.

As a result, sensitive data no longer sits behind a single application boundary. According to CoreWeave, it moves through prompts, embeddings, weights, traces, outputs, evaluation records and runtime systems. The company points out that using a cloud provider often means trusting it with access and visibility. A provider may administer encryption keys, keep privileged access to servers, manage the execution environment, or offer its own AI models that may learn from customer interactions.

CoreWeave says its framework takes a different route. Customers running sensitive AI workloads should keep more control over the parts of the stack that decide access, and should be able to bring the security systems they already trust instead of rebuilding around a provider-defined model.

Six layers, starting with keys and support access

The framework brings together six layers: Remote Key Encryption (RKE), Support Access Management (SAM), confidential computing, remote attestation, model data protection and protected data movement. The source describes the first four in detail.

Zero Key Access. With RKE, customers use keys from the infrastructure they already operate, whether a software key manager, a hardware security module or a KMS in another cloud, while their workloads run on CoreWeave. The keys protecting data at rest stay with the customer. Existing users, groups and identity providers can be federated to RKE-protected resources and CoreWeave IAM. CoreWeave says that if it lacks the key or the permissions to use it, it cannot decrypt the data. The company also says customers do not need to build new key management automation or move to a new cloud KMS before running sensitive training and inference workloads. In its words, "Zero Key Access turns encryption from a provider-managed promise into a customer-controlled safeguard."

Zero Node Access. With SAM, customers decide when CoreWeave may access infrastructure for support. Access is authorized for a defined operational need and ends when the authorized activity ends, rather than being treated as always available.

Attestation and confidential computing

The third layer, Zero Trust Infrastructure, relies on attestation services that verify the system beneath a workload using hardware roots of trust. CoreWeave says attestation can drive automated decisions: a workload, key-management system or orchestration layer can demand valid evidence before releasing secrets, decrypting data or letting execution proceed.

The fourth layer, Zero In-Use Access, centers on confidential computing. CoreWeave notes that much sensitive enterprise data stays on premises under requirements such as GDPR, the EU AI Act and national data-sovereignty mandates, while the most capable models have traditionally been reached through cloud APIs. The company intends to support confidential computing on NVIDIA Blackwell and Vera Rubin platforms to protect models, data and code while they are in use.

According to the source, Blackwell provides hardware-based isolation, cryptographic attestation and inline NVIDIA NVLink encryption. NVIDIA Rubin builds on this with systems such as NVIDIA HGX Rubin NVL8, and NVIDIA Vera Rubin NVL72 extends NVIDIA's third-generation confidential computing across the CPUs, GPUs and NVLink fabric of a whole rack. CoreWeave plans to support confidential computing for select bare metal environments and is working toward additional deployment models, including Kubernetes-based AI workloads. These are plans and intentions, not features stated as generally available.

The company distinguishes the two technologies. Attestation verifies that infrastructure is in an expected state before it is trusted, while confidential computing helps isolate and protect the workload during execution.

No training on customer data, and what it means for enterprises

The fifth layer is titled Zero Model Data: CoreWeave does not train on your data. IDC's Dave McCarthy, Group Vice President, Cloud and Datacenters, Enterprise Infrastructure, framed the framework as a response to the demands of regulated data. In his words, "This shifts trust from provider promises to technical controls, a critical step for enterprises deploying proprietary AI at scale."

For organizations in regulated industries or with especially sensitive intellectual property, the pitch is that security controls stay with the customer while CoreWeave supplies the high-performance AI cloud. CoreWeave also claims the approach can help customers move faster with sensitive workloads instead of slowing them down, because they can reuse existing key infrastructure, identity systems and policies.

The source text available here does not cover pricing, availability dates or the details of the model data protection and protected data movement layers, so those questions remain open.