Confidential Computing

At DevDay on September 29, OpenAI announced Private Intelligence. The headline version is easy to repeat: frontier models, confidential computing underneath, and your data stays private, even during inference. The documents tell a more careful story. Private Intelligence is two things, and they are at very different stages: Zero Data Retention with Private Safety Processing (PSP). This is rolling out to eligible API customers, and OpenAI published a 36-page technical white paper describing it. Private Inference. This is a preview “coming this fall.” OpenAI hasn’t published the hardware, the trust boundary, or how a customer would verify it. I’ve spent most of my career on attestation and key release, first in payments and then in confidential computing. The first item is the more interesting piece of engineering, and very few people are writing about it. The second is the bigger bet. This post is my reading of both, based only on what OpenAI and others have published as of early October 2026. ...

An assistant processes a conversation inside a trusted execution environment (TEE). The response comes back, the session ends, and the environment disappears. That is a useful model for private inference. It is a poor model for an assistant that is supposed to remember what you said tomorrow. That gap has been on my mind after reading three recent designs: Google’s plan for secure server-side memory, Meta’s Private Processing architecture for AI glasses, and Amazon’s Bee Private Compute paper. Each starts with a different product. All three have to deal with the same fact: a personal assistant needs context that lasts longer than one inference request. ...

I’m giving a talk at Confidential Computing Summit 2026 in San Francisco on Tuesday. The title is “Trust Is the Next Bottleneck.” This essay is the argument behind the slides. The short version: we are building an economy of autonomous AI agents on a trust foundation designed for humans clicking buttons. That foundation is cracking. The fix isn’t better software — it’s hardware. The gap between authorization and execution OAuth tokens, API keys, and IAM roles answer one question: who authorized this action? ...

Jason Clinton’s OC3 2026 talk on confidential computing and scaling laws pushed me to finally write about Anthropic’s Confidential Inference Systems paper, a joint publication with Irregular (formerly Pattern Labs), released June 2025. It’s one of the cleaner public treatments of what it actually means to make AI trust verifiable rather than asserted. It also points directly at a gap the industry hasn’t begun to close: trust in agentic systems. This post unpacks the paper’s core contributions, where its claims need qualification, and where I think the conversation has to go next: from confidential inference to attested agent identity. ...

Every security architecture problem I have ever worked on, from payments to confidential computing to AI agents, has come down to the same question: Where is the data, and what happens to it? Not “what framework are we using.” Not “are we zero trust.” Not “which compliance checkbox do we need.” Those matter eventually. But they are not where you start. You start by following the data. The questions When I was at RBC working on mobile payments, I learned this the hard way. Every time I was confused about how to approach a security problem (and there were many times), the answer was always the same: stop thinking about the system. Start thinking about the data. ...

In January, I wrote about WhatsApp’s Private Processing as a milestone for confidential computing: the first time TEEs were deployed at truly global scale to protect AI inference for billions of users. That post was about the architecture. This one is about what happened when someone tried to break it. Trail of Bits just published its pre-launch security audit of WhatsApp’s Private Processing system. They found 28 issues, including 8 high-severity findings. Meta fixed the critical issues before launch. ...

MCP servers aggregate high-value credentials behind a weak trust boundary. TEEs can close the host-level gap by combining memory isolation with attestation and measured identity.

There’s a pattern showing up across crypto infrastructure right now for anyone building wallets, MEV (maximal extractable value) pipelines, or agent payment systems: Vitalik frames TEEs as a pragmatic near-term privacy layer (especially around RPC / read-path privacy), Coinbase uses enclave-backed architecture for programmable wallets, policy-controlled signing, and agent-ready payment workflows, Flashbots uses SGX for confidential block building in the MEV pipeline. Different use cases, same design instinct: use hardware-backed isolation to reduce trust now, while more advanced cryptographic systems mature in the background. ...

The Confidential Computing Consortium defines confidential computing as “the protection of data in use by performing computation in a hardware-based, attested Trusted Execution Environment.” It’s a powerful idea. Instead of trusting operators or cloud providers, you trust hardware itself to keep your data protected even while it’s being processed. When WhatsApp recently announced new AI features like summarizing messages or helping draft replies, most people saw just another set of productivity tools. What went unnoticed is that behind these features sits one of the most ambitious privacy technologies ever deployed: confidential computing at internet scale. ...

Back when mobile payments were still in their infancy—long before Apple Pay became a household name—I found myself captivated by the possibilities of NFC technology. As a grad student at Dalhousie University, I started tinkering with NFC and co-founded a small startup called Alfred NFC, where we experimented with peer-to-peer transactions. That was my first real taste of what would become a lifelong fascination with secure technology ecosystems. As graduation approached and the reality set in that Alfred NFC wouldn’t become the next big thing, I faced a crossroads. I applied to countless Canadian companies and banks for NFC-related work—anything that would let me stay in this space I was so passionate about. But the callbacks never came. So I pivoted: I interviewed for several Java developer roles and received multiple offers. It was a safe, predictable path forward. ...