Red Hat is addressing a fundamental trust problem in enterprise AI: how to protect proprietary model weights, keep sensitive data confidential during processing, and safely execute code that AI systems generate without human review. The company announced three major updates to its OpenShift platform that tackle these challenges from different angles, making it possible for organizations to run confidential AI workloads on their own hardware while containing autonomous agents in secure, isolated environments.

What's the Trust Problem at the Heart of Enterprise AI?

As AI moves from simple chatbots to autonomous agents that execute code, manipulate files, and orchestrate tools, enterprises face a new security dilemma. Three parties need protection simultaneously: the model owner wants cryptographic proof that proprietary weights remain hidden from infrastructure they don't control; the data owner needs the same guarantee for their sensitive information while it's being processed; and the platform operator must run both workloads without ever being able to inspect what's happening inside them.

This three-way trust problem has no easy solution in traditional cloud infrastructure. Standard Kubernetes containers, which most enterprises use to run workloads, weren't designed for this scenario. Default security settings permit broad code execution, meaning a misbehaving or compromised AI agent could attempt credential theft or lateral movement across the entire system.

How Does Red Hat's New Approach Protect AI Workloads?

Red Hat's solution operates on two fronts. First, it extends confidential computing to GPU-accelerated AI inference, which is now generally available for production use. Second, it introduces a new operator called Red Hat build of Agent Sandbox, currently available as a technology preview, that isolates untrusted AI-generated code in hardware-level boundaries.

The confidential AI capabilities now include:

• End-to-End Hardware Encryption: Data, models, and model weights stay encrypted across both CPU and GPU memory throughout computation, protecting against inspection by cluster administrators or the hypervisor.
• GPU Attestation: Red Hat build of Trustee integrates with NVIDIA's Remote Attestation Service to ensure workloads run only on verified, tamper-proof hardware.
• Multi-GPU Support: Organizations can now run larger AI workloads on a single node using NVIDIA DGX B200 systems with Intel TDX confidential computing.
• Framework Compatibility: Integration with common AI tools like PyTorch, TensorFlow, and NVIDIA CUDA means data scientists can protect existing workloads without rewriting code.

For autonomous agents, Red Hat build of Agent Sandbox provides a new security layer. It manages the lifecycle of ephemeral, virtual machine-isolated sandboxes backed by Kata Containers, giving AI-generated code a strong hardware-level boundary that contains even kernel-level exploits.

What Practical Capabilities Does Agent Sandbox Provide?

The Agent Sandbox technology preview includes several features designed specifically for the emerging world of autonomous AI agents. Organizations get runtime-neutral sandbox lifecycle management through custom resources, warm pools that preprovision sandbox environments for low-latency responsiveness, and a sandbox router for secure network access to running sandboxes. This last feature is critical for web-based agent tools like browsers, notebooks, and integrated development environments.

The sandbox can be deployed flexibly across different infrastructure types. Enterprises can use peer pods and nested virtualization on public cloud platforms like Microsoft Azure Red Hat OpenShift and Red Hat OpenShift Service on AWS, or deploy on bare metal with Kata Containers. Red Hat also positioned Agent Sandbox as the substrate for the emerging Model Context Protocol code-execution pattern and for independent software vendor integrations.

Where Can Organizations Run Confidential AI Today?

Red Hat is expanding where confidential AI can run beyond just on-premises data centers. The company announced technology previews for OpenShift sandboxed containers on hosted clusters via hosted control planes and on public cloud infrastructure using nested virtualization, which offers a lower-cost alternative to peer pods. This means organizations can now get the same hardware-encrypted CPU and GPU memory protection on Microsoft Azure that they would have on their own bare metal infrastructure, with attestation handled by Red Hat build of Trustee.

The company also added short-lived token support for OpenShift sandboxed containers on Microsoft Entra Workload ID and AWS Security Token Service, improving integration with cloud-native identity systems. Additionally, IBM Confidential Computing Containers for IBM Z and LinuxONE reached general availability, taking advantage of IBM's Telum and Telum II on-chip AI acceleration for real-time fraud detection and risk analytics.

How Does Red Hat Build of Trustee Support Disconnected Environments?

Red Hat build of Trustee, the cornerstone of policy-driven secret management for confidential workloads, released version 1.2 with expanded capabilities for air-gapped and highly regulated deployments. Disconnected attestation now extends to Intel TDX on both bare metal and Azure or Azure Red Hat OpenShift, building on previous AMD SEV-SNP disconnected support. This is critical for government agencies and organizations operating in network-isolated environments where systems cannot reach external attestation services.

The new version also includes automated platform-data collection and quote-generation setup via the Intel TDX DCAP Operator on the workload cluster, replacing manual configuration processes that previously required significant operational overhead.

These announcements reflect a broader shift in how enterprises approach AI infrastructure. As AI moves from experimental projects to production systems handling sensitive data, the ability to prove that data and models remain protected becomes a competitive necessity rather than a nice-to-have feature. Red Hat's multi-layered approach, combining confidential computing for data protection, GPU attestation for hardware verification, and agent sandboxing for code containment, addresses the full spectrum of trust challenges that enterprises face when deploying AI at scale.