As AI moves from generating answers to taking autonomous actions, security protection is no longer limited to the model itself but must cover the entire system that translates intelligent decisions into actual actions.
In the era of generative artificial intelligence (AI), discussions about security have largely focused on protecting models, prompts, and data. The age of AI agents adds a new dimension to security challenges, as AI can now autonomously use tools, access systems, write code, and execute operations at machine speed. Flight booking is a typical example: while a generative AI system might only suggest flight options to users, an agent system can independently retrieve fares, call saved payment information, and complete the booking on behalf of the user.
The foundational elements of security in the agent era remain unchanged, including identity verification, the principle of least privilege, isolation mechanisms, trusted execution, memory safety, monitoring, and resilience design. However, the operational model has changed. As agents act autonomously, dynamically select actions, and operate across different software, infrastructure, edge devices, and physical systems, they require clear and enforceable boundaries to limit their access and action permissions. Protecting the model alone is no longer sufficient; security defenses must cover the entire path from intelligence to action.
This is also key to driving the large-scale adoption of agent AI. Organizations need to be confident that autonomous systems always operate within established boundaries, that their actions can be tracked and attributed, and that abnormal behavior can be effectively controlled. Security itself does not directly build trust; trust ultimately depends on users, application scenarios, and risk levels. However, security provides verifiable boundaries, accountability mechanisms, and system resilience, which form the foundation for building trust.
Will Abbey, Executive Vice President and Chief Business Officer at Arm, elaborates on the industry's shift towards agent AI and the impact of this transformation on cloud, edge, and physical world application scenarios.
Agent AI Requires Full-Stack Security Protection
No single security mechanism can protect the entire path from inference to execution. Security in the agent era requires multiple complementary control mechanisms covering the agent runtime, software stack, host computing platform, infrastructure, and the final devices and systems executing the decisions.
Systems must be able to identify the entity executing actions, conduct activities based on user permissions, and ensure that only authorized operations are performed. When agents dynamically select actions, relevant policies must always be effectively enforced. At the same time, the operation process requires observability to ensure that autonomous behaviors are accountable. When anomalies occur, the system must have mechanisms in place to contain accidental or unauthorized actions.
The underlying architectural principle behind these requirements is clear: the component making decisions should not simultaneously hold the sole authority to approve whether those decisions are permitted. The model proposes action plans, while the system authorizes them and ensures that relevant constraints are enforced.
To put this principle into practice, security protections need to be established at multiple points between intelligence and action:
· Establish trusted execution environments;
· Protect the path from decision to execution;
· Determine through independent mechanisms whether an operation is permitted;
· Protect the device or system that finally executes the operation.
Arm's decades of accumulation in secure computing are particularly important here. Arm provides foundational infrastructure covering Root of Trust (RoT), secure boot, measured boot, remote attestation, isolation mechanisms, and memory safety, accompanied by reference software, application programming interfaces (APIs), and ecosystem support to help developers easily leverage these capabilities.
These technologies address the security challenges of agent AI at different stages of the system. Secure boot and remote attestation help verify that workloads and security control mechanisms are running in the expected environment. However, verifying the environment is only part of the challenge; attackers may still exploit vulnerabilities in the agent runtime, tool hosts, or policy enforcement software to bypass security controls or trigger unauthorized actions. Memory safety technologies such as Arm Memory Tagging Extension (MTE), along with other architecture-level defense mechanisms, help mitigate these risks, making it more difficult to exploit certain memory safety vulnerabilities within the software link between inference and execution.
Detailed Explanation of Arm Memory Tagging Extension
As agents gain continuous access to private context, memory, and state, security mechanisms must also manage the conditions under which sensitive data is released. In workflows with higher trust requirements, remote attestation mechanisms can first verify the trustworthiness of the execution environment before granting the agent access to protected context data.
Implement Independent Security Controls for Agents
Infrastructure security is another important dimension in the agent era. As agent capabilities continue to improve and they become capable of continuous operation, infrastructure not only needs computing resources to execute agent workloads but also independent computing resources to observe, manage, and constrain them.
The collaborative architecture of CPU and DPU is a typical implementation of this principle, both based on Arm providing a unified computing foundation. The CPU is responsible for running the agent runtime, execution frameworks, orchestration systems, tool calls, and applications; the DPU provides an independent operating environment for infrastructure functions such as networking, monitoring, isolation, and security services.
Arm CPUs host and run agent workloads, while Arm-based DPUs independently observe, manage, isolate, and protect them.
This further confirms a principle: when security control mechanisms are isolated from the processes they regulate, their effectiveness is strengthened. NVIDIA's recently released NVIDIA Open Agent Safety Platform demonstrates how this architectural pattern can be applied to agent infrastructure.
Security Protection Must Extend with Action
As agent workflows gradually extend from data centers to PCs, smartphones, edge devices, and physical AI systems, the scope of security challenges also expands. In the future, an agent might use models in the cloud for inference, process private context data on edge devices, and finally execute actual operations through robots or industrial equipment.
Therefore, security capabilities need to continuously expand along two dimensions:
1. Through the computing stack within each system;
2. Cover every computing environment contacted by the agent.
All computing environments follow the same core principle: agents can only access authorized resources and perform permitted actions. However, compared to cloud and data centers, edge and physical AI systems face different challenges.
Agent Workflows Across Edge, Cloud, and Physical Environments
Consumer devices, cameras, robots, cars, and industrial equipment are not as easily isolated as cloud virtual resources. As intelligent decisions increasingly translate into physical actions in the real world, security mechanisms must span software, communication links, and the final devices executing these operations. This places greater demands on device identity, communication authentication, permission management, device-side policy enforcement, and auditability. Arm Device Connect provides a unified way for AI agents to discover and interact with various heterogeneous devices, helping to build a connectivity layer that supports authentication, permission management, and governance mechanisms.
Furthermore, as agents increasingly interact with physical devices and systems, agent security must also integrate with existing device security and functional safety systems. Identity verification, authentication, and authorization mechanisms need to extend to the device side and coordinate with device-side constraint mechanisms, operating restrictions, fail-safe mechanisms, and various existing security mechanisms used to ensure the safe operation of physical systems. Information security mechanisms determine whether an operation is authorized, while functional safety mechanisms determine whether the operation can be executed within the defined safe operating range. When agent AI enters physical systems, the two must work together.
Build Security Systems Around Intelligence
The transition from generative AI to agent AI changes a fundamental assumption in the field of AI security. Previously, models were only responsible for generating information, leaving humans to decide whether to act on it; today, agent AI systems can initiate actions autonomously. Security protection must expand from merely protecting models and data to controlling the entire process from inference to execution.
This has also given rise to a new AI architectural pattern: the model determines the action to be executed, and an independent system decides whether that action is permitted. From root of trust and remote attestation to memory safety, independent infrastructure management, and device authentication, each layer of technology helps strengthen this separation of duties as agent AI expands from the cloud to the edge and physical systems.
Arm provides a unified architectural foundation and security technologies to help implement these boundary constraints at the entire system level. As agent AI gains increasingly strong autonomous action and execution capabilities, corresponding security protections expand and function in tandem.
– End –