Researchers just showed that putting an AI agent's signing key in a hardware chip does not stop a malicious email from hijacking it.
AI agents now sign git commits, certify documents, and attest release artifacts on behalf of their operators, and their private keys often sit in plaintext files, environment variables, or container memory that any process the agent can reach can read. One widely deployed agent framework reportedly leaked its keys this way after a single email injection. Moving the key into a hardware keystore (HSM, TPM, smart card) does not fix the underlying issue, the researchers argue, because once a signing session is open, the hardware still cannot tell a legitimate request from one an attacker slipped into content the agent read. Their fix is a five-layer zero-trust enforcement stack that checks every signing request against what the operator actually committed to in advance.
Tested against AgentDojo prompt-injection attacks on three injection-prone models across 144 trials, the stack cut the attack success rate from 18.1 percent to zero. It handled tool poisoning from a compromised MCP server, tested with MCPTox, the same way: hashing pre-committed payloads and escalating anything uncommitted to a human. That escalation rule is the real finding here - the system's safety never depends on catching a fake document, only on a human getting asked whenever nothing was locked in ahead of time.
The limits show up fast. A substitute document under an adversarially plausible name beat the semantic filter in every trial the researchers ran, which is really just a reminder that this only works as well as your naming conventions - and as often as you're willing to interrupt a human.