PUFsecurity: Trusted AI Agents Need a Root of Trust in Silicon

Why agents raise the stakes

PUFsecurity draws a line between chatbots and agents. A chatbot produces content and a person decides what to do with it. An agent acts on its own output: according to the company, it runs persistently, holds delegated credentials, browses the web, executes code and calls connected services.

In PUFsecurity's view, that changes what a compromise costs. A misled chatbot gives a bad answer that a person can still catch. A misled agent can act with the user's credentials before anyone has a chance to check.

The company points to Meta's Muse as an example of how the industry approaches agent security. According to Meta, each user's agent runs inside a dedicated cloud virtual machine, in an isolated runtime cell with its own file system and network interface. A separate Sentinel agent is the sole authority for network egress and connector actions, and code inside the cell only sees surrogate tokens. Real credentials are swapped in at the network boundary after a request is approved.

Meta also states that the launch Secure VM "does not prevent Meta from accessing data when necessary to support, secure or operate the service," and it plans a Muse Confidential VM in which the entire VM is encrypted with a key only the user holds. PUFsecurity notes that this next step depends on hardware, because a key held only by the user can be released safely only to a platform that can prove it is genuine and booted the expected software.

Attestation and the Roots of Trust in data-center chips

Remote attestation provides that proof. The device signs a report of what it booted, and a verifier checks the report against expected values before releasing any secrets. PUFsecurity lists three properties at stake: identity, which establishes which physical device runs the workload; integrity, which records what it actually booted; and confidentiality, which ensures secrets reach only a verified environment.

The company stresses that the chain hinges on one detail: an attestation report is only as trustworthy as the key that signs it. If compromised software can read or forge that key, the report proves nothing, so the signing identity has to be anchored in silicon.

PUFsecurity says data-center processors increasingly build the Root of Trust into the die, often more than once. At Hot Chips 2026, Arm presented Arm AGI CPU as two compute chiplets, each with its own Runtime Security Engine (RSE), and lists support for Arm's Realm Management Extension. A single package therefore holds two Roots of Trust, and a two-socket server holds four. Arm AGI CPU is built on Neoverse CSS V3, with an RSE serving as its Root of Trust.

The CPU is only part of the picture. Meta notes that limited data leaves the Muse VM for inference, so prompts and context reach accelerators, network interfaces and storage. The Open Compute Project security model calls for a Root of Trust in every device, and OCP's Caliptra provides an integrated Root of Trust block for data-center SoCs such as CPUs, GPUs and DPUs. For multi-vendor chiplet designs, the Arm-led Foundational Chiplet System Architecture, contributed to OCP, addresses how chiplets from different suppliers boot together and secure the system.

PUFsecurity also notes a multi-year collaboration with Arm. In 2022, Arm selected PUFrt, the company's hardware Root of Trust IP, for the secure subsystem in its reference implementation of the Armv9 Confidential Compute Architecture. eMemory has since joined Arm Total Design and introduced PUFrt as a hardware Root of Trust for the RSE in Arm Neoverse Compute Subsystems.

Shared primitives and the PUFrt approach

Whether a chip uses Arm's RSE, Caliptra or a proprietary design, PUFsecurity sees the same foundational needs: a device-unique secret protected at rest, a high-quality source of entropy, and secure non-volatile storage for state that must survive power cycles, such as lifecycle status and revocation data. Caliptra's specification, for instance, anchors device identity in a unique secret generated from on-chip entropy and kept in one-time-programmable fuses, then expands it into a Device Identifier Composition Engine (DICE) identity chain for attestation.

PUFrt combines these primitives in one hardware Root of Trust IP. Its 1024-bit physical unclonable function derives device-unique values from natural variation in the silicon and provides four 256-bit fingerprints that can serve as unique identifiers or root-key seeds. Because the secret comes from the silicon itself, a root key does not need to be injected during manufacturing, which PUFsecurity sees as increasingly valuable as chiplets from multiple suppliers are assembled into one package.

PUFrt also includes a true random number generator and secure storage based on NeoFuse anti-fuse OTP, which eMemory offers from 0.15 µm down to 3 nm FinFET, with 2 nm GAA under development. Combined with anti-tamper protections, these support secure boot, secure debug, entropy generation and key provisioning.

What it means: from agents to physical AI

PUFsecurity expects the stakes to rise further. In its view, the next step is physical AI, where the same autonomy drives robots, vehicles and industrial machines, and a misled system can cause physical harm rather than only digital loss.

The company acknowledges that software safeguards are advancing quickly. Its argument is that the final guarantee, that keys and authority are released only to a platform that can prove what it is and what it booted, has to come from hardware, in every chip along the path, from the data center to the device at the edge. The perspective is a statement of the company's own position, and it also promotes PUFrt as a building block for that approach.