San Jose – October 09, 2026 -- PUFsecurity, a subsidiary of eMemory Technology, argues that the security of AI agents ultimately rests on hardware Roots of Trust in the chips that run them, as agents gain delegated credentials and act without user review.
Agents that act on their own output raise the cost of compromise
Unlike a chatbot, an agent runs persistently, holds delegated credentials, browses the web, executes code and calls connected services. PUFsecurity says a misled chatbot yields a bad answer a person can still catch, while a misled agent can act with the user's credentials before anyone checks.
Meta's Muse isolation model still depends on the platform beneath it
According to Meta, each Muse user's agent runs in a dedicated cloud virtual machine, inside an isolated runtime cell with its own file system and network interface. A separate Sentinel agent is the sole authority for network egress and connector actions, and code in the cell sees only surrogate tokens. Real credentials are swapped in at the network boundary after a request is approved.
Meta states that its launch Secure VM does not prevent it from accessing data when necessary to support, secure or operate the service. It plans a Muse Confidential VM, encrypted with a key only the user holds. PUFsecurity notes that such a key can be released safely only to a platform that can prove it is genuine and booted the expected software.
Arm selected PUFrt in 2022 and builds its newest CPU on the same platform
In 2022, Arm selected PUFrt, PUFsecurity's hardware Root of Trust IP, for the secure subsystem in its reference implementation of the Armv9 Confidential Compute Architecture. eMemory has since joined Arm Total Design and introduced PUFrt as a hardware Root of Trust for the Runtime Security Engine (RSE) in Arm Neoverse Compute Subsystems.
Arm AGI CPU, which Arm positions for agentic AI infrastructure, is built on Neoverse CSS V3, with an RSE as its Root of Trust. At Hot Chips 2026, Arm presented it as two compute chiplets, each with its own RSE, and listed support for Realm Management Extension. One package therefore holds two Roots of Trust, and a two-socket server holds four.
Remote attestation is only as reliable as the key that signs it
In remote attestation, a device signs a report of what it booted, and a verifier checks it against expected values before releasing secrets. PUFsecurity says the chain hinges on the signing key: if compromised software can read or forge it, the report proves nothing, so the identity must be anchored in silicon.
Open Compute Project efforts extend Roots of Trust beyond the CPU
Meta notes that limited data leaves the Muse VM for inference, so prompts and context reach accelerators, network interfaces and storage. The Open Compute Project security model calls for a Root of Trust in every device, each reporting integrity through attestation. OCP's Caliptra provides an integrated Root of Trust block for data-center SoCs such as CPUs, GPUs and DPUs. It anchors device identity in a unique secret generated from on-chip entropy and held in one-time-programmable fuses, then expands it into a DICE identity chain.
For multi-vendor chiplet designs, the Arm-led Foundational Chiplet System Architecture, contributed to OCP, addresses how chiplets from different suppliers boot together and secure the system.
PUFrt packs a 1024-bit PUF and anti-fuse storage into one IP block
PUFsecurity says every Root of Trust, whether Arm RSE, Caliptra or proprietary, needs a device-unique secret protected at rest, high-quality entropy, and secure non-volatile storage for lifecycle status and revocation data. PUFrt's 1024-bit physical unclonable function derives four 256-bit fingerprints from natural silicon variation, usable as unique identifiers or root-key seeds. Because the secret comes from the silicon, no root key needs to be injected during manufacturing, which PUFsecurity sees as valuable for multi-supplier chiplet packages.
PUFrt also includes a true random number generator and secure storage based on NeoFuse anti-fuse OTP. eMemory offers NeoFuse from 0.15 μm down to 3 nm FinFET, with 2 nm GAA under development. With anti-tamper protections, these support secure boot, secure debug, entropy generation and key provisioning.
PUFsecurity expects the next step to be physical AI, where the same autonomy drives robots, vehicles and industrial machines, and a misled system can cause physical harm.