Agents Need a Cloud They Can Verify

The model thinks on GPUs. The agent lives on a CPU.

An AI agent is a loop, not a single model call. It takes a goal, asks a model what to do next, calls a tool, remembers the result and repeats until the job is done.

Animated agent loop: the agent lives in a confidential CPU VM with its memory, credentials, task state and connectors, and calls a model API on GPUs and external tools — The agent loop: memory, credentials and actions stay in the agent's home; the model sees one request at a time.

The model does its thinking on GPUs, behind an API, one request at a time. Everything else runs on a CPU: the loop itself, the agent's memory, its credentials and its connections to every tool. That CPU VM is the agent's home, and it holds the most sensitive things in the system for hours or days at a time.

So the question for anyone running agents is where that home lives, and who can see inside it. An agent that leaks exposes its user's authority, not just a conversation. The largest AI platforms now answer with confidential computing: in June 2026 Apple extended Private Cloud Compute to third-party data centers, on Intel TDX with NVIDIA GPUs, to support agentic tool use. FarmGPU is bringing the same foundation for the agent's home to FarmGPU Cloud: confidential VMs on Intel® Xeon® 6 processors with Intel® Trust Domain Extensions (Intel® TDX), verified by Intel® Trust Authority.

FarmGPU: a neocloud software stack

FarmGPU is a neocloud headquartered in Rancho Cordova, California. Our TractorOS software unifies compute, storage, networking and fleet operations.

The FarmGPU software stack: TractorOS (neocloud OS), Homestead (provisioning), Shepherd (agentic SRE), Silo (storage) and Haystack (SLA engine) — Five tools take a machine from bare metal to a cluster that meets its SLA: TractorOS keeps every machine identical, Homestead brings clusters online, Shepherd watches them, Silo keeps them fed with data, and Haystack holds them to their SLA.

What an agent needs from the machine it runs on

Every agent has the same need: what it holds must stay out of reach of whoever runs the hardware. Four kinds of agent show why.

Ordinary VM versus Intel TDX trust domain: on an ordinary host the operator reads memory in plaintext; in a trust domain the host sees only ciphertext and Intel Trust Authority vouches for the VM — On an ordinary host, everything an agent holds is plaintext to whoever runs the machine. In a trust domain the host sees only ciphertext, and Intel Trust Authority proves what is running inside.

Agent	What it holds	What an Intel TDX trust domain adds
Assistant with long-term memory	A user's history, preferences and past decisions	Memory on an encrypted volume whose key goes only to an attested VM
Coding and cloud-ops agent	OAuth tokens, API keys, signing keys	Credentials delivered only to an attested VM
Agent on regulated data	Patient, financial or residency-bound records	The cloud operator is kept out by hardware, and an Intel-signed token is the evidence for auditors
Agent shared by several organizations	Each party's data and the joint results	Every party checks the same Intel-signed token before contributing

The rule underneath is the same each time: keys, data and credentials go only to a runtime that has proved what it is, and the client refuses if the proof fails. Alibaba Cloud and Intel describe exactly this gate for agents on Intel TDX: verify first, then connect and release.

Confidential computing protects what an agent holds; it does not make the agent's choices safe. Tool policies and limits on where an agent can send data still decide what a manipulated agent can do.

Why Intel TDX and Intel Trust Authority

An agent platform needs two guarantees: the operator cannot look inside, and the customer can prove it. Intel TDX provides the first and Intel Trust Authority the second.

Intel TDX isolates. Each confidential VM runs as a trust domain: the CPU encrypts its memory and keeps its state away from the hypervisor, which takes the cloud operator out of the trust boundary.

Intel Trust Authority verifies. Isolation alone does not tell a customer what is running inside. Intel Trust Authority is an independent verifier. It checks the VM's hardware-signed measurements against published reference values and returns a token signed by Intel. The customer checks that signature against Intel's public keys, not FarmGPU's. The white paper walks through each measurement the token carries.

🔒

"Personal agents hold extremely sensitive information - I have my agents doing my expense reports, travel, and purchasing. Allowing an independent third party to verify that the virtual machine is actually encrypted through Intel TDX and ITA, and the ability to revoke access at any time is a complete game changer for agent trust."
Jonmichael Hands, CEO, FarmGPU

TractorOS and the FarmGPU cloud API

TractorOS is the operating system under FarmGPU Cloud: Red Hat Enterprise Linux 10 in image mode, on every host and every guest. A confidential guest is a sealed image, a single signed boot image whose measurement covers the firmware, the kernel and the entire root filesystem. The build checks Red Hat's signature on every package and seals the software bill of materials inside, so a customer can trace the image back to Red Hat.

Customers will use it through one cloud API:

Create a confidential instance, from 2 to 64 vCPUs. Its tenant and instance identity are written into the measurement Intel signs.
Unlock happens only after proof: the key broker releases the VM's disk key and configuration once Intel Trust Authority has appraised the VM.
Verify at any time. GET /v1/instances/{id}/attestation?nonce=… returns a fresh Intel-signed token bound to the customer's own nonce, so it cannot be replayed.
Delete is cryptographic. The key goes first, so a disk left behind is unreadable.

Confidential VM lifecycle in six steps between the tenant, FarmGPU cloud API, key broker, the Intel Xeon 6 TDX host and Intel Trust Authority — The host launches the VM but never holds its key.

The host has no console into the VM and no view of its memory; it only forwards bytes it cannot read. That is what designing the operator out means in practice.

Look out for the launch

Agents need a home their users can verify. TractorOS and confidential computing VMs launch on FarmGPU Cloud by the end of this year: a sealed RHEL 10 guest, attestation built in, and proof on demand through a single API call.

For the full technical walk-through, covering the boot chain, measurement registers, build gate and attestation flow, download the white paper by Luke Macken, FarmGPU Engineering Fellow: Introducing TractorOS: Sealed RHEL 10 Images, Attested on Intel TDX.

Download the white paper (PDF)

Look out for the launch. Contact FarmGPU for early access.

Further reading: Intel Trust Domain Extensions · Intel Trust Authority · Apple: Expanding Private Cloud Compute · ITU-T: Confidential Computing for Agentic AI