NVIDIA expands confidential computing for frontier AI models

Introduction: Why confidential computing matters for AI agents

NVIDIA has introduced Confidential Bare Metal, a deployment option intended to let frontier model builders run sensitive workloads on dedicated third-party infrastructure while retaining control of their models and data. Announced on October 21, 2026, the expansion brings NVIDIA Confidential Computing to a deployment model in which builders can operate their own software stack, including host and platform infrastructure software.

For AI agents, the significance is the protection of the models and data they depend on during execution. NVIDIA describes confidential computing as the infrastructure layer within its broader approach to deploying agents safely. The announcement addresses that layer through hardware-rooted isolation, cryptographic attestation and new platform security controls.

The practical question is whether model builders can use infrastructure operated by other organizations while maintaining the confidentiality their workloads require. NVIDIA’s answer combines a new bare-metal option, broader hardware coverage and partner integrations. Its announcement is the source for these capabilities and plans; it does not provide independent security validation or performance benchmarks.

That distinction matters when interpreting the implications for agents. Protecting a model’s execution environment addresses a specific infrastructure concern. The announcement does not establish that an agent’s decisions, permissions or interactions with external systems are safe. Its contribution is narrower: a hardware-rooted foundation for protecting sensitive computation across infrastructure outside the model builder’s ownership.

What is Confidential Bare Metal and how it expands NVIDIA’s security stack

Confidential Bare Metal is one of three deployment options in what NVIDIA calls a converged confidential computing security architecture. The other two are Confidential Containers for Kubernetes environments and Confidential Virtual Machines for virtualized environments. NVIDIA says organizations can select among them according to their trust boundaries and operating requirements.

The addition gives model builders a confidential computing option for dedicated infrastructure on which they own and operate a bespoke software stack. NVIDIA explicitly includes host and platform infrastructure software within that scope. The company says the option applies across third-party cloud, neocloud and enterprise infrastructure running NVIDIA accelerated computing.

The architectural significance is the relationship between software control and infrastructure ownership. According to NVIDIA, builders can retain control of models and data while operating on another organization’s dedicated infrastructure. As an editorial interpretation, this makes the deployment option relevant to builders whose operating requirements include control over the host software stack as well as access to external computing capacity.

The three options should not be read as a performance ranking. NVIDIA’s announcement supplies no comparative measurements of bare-metal, container and virtual-machine deployments. Nor does it establish that one mode is universally preferable. The supported distinction is their deployment environment and the ability to match that environment to an organization’s operating and trust requirements.

Key security controls: data‑in‑transit protection, integrity measurement, hardware access restrictions

NVIDIA identifies three new platform security controls: protection for data in transit, measurement of platform integrity and enforcement of hardware-level access restrictions. Together, they address different aspects of operating sensitive workloads on third-party infrastructure.

Data-in-transit protection concerns information moving between components. In its description of Cohere’s planned integration, NVIDIA specifically identifies protection for models and data across interconnects during execution, alongside protection in memory. This is relevant to the announcement’s central objective: protecting sensitive information while computation is taking place.

Platform integrity measurement concerns the state of the platform on which the workload runs. NVIDIA also says its confidential computing architecture uses cryptographic attestation. The announcement identifies these mechanisms without supplying an attestation workflow, the precise components measured or the policy by which a customer would accept a platform. Those implementation details therefore remain questions for deployment assessment.

Hardware-level access restrictions provide another part of the stated protection. NVIDIA places hardware-rooted isolation at the center of its approach. The source does not enumerate every restricted access path or provide a complete threat model, so the announcement cannot support a claim that all forms of infrastructure access or compromise are covered.

The controls are best understood as complementary elements of the announced architecture. Protecting data as it moves, measuring the platform and restricting access each addresses a distinct concern. The evidence supports that layered design, but it does not quantify its resistance to particular attacks or document an independent audit.

For a prospective operator, the useful distinction is between the named controls and the details needed to evaluate them. NVIDIA has identified what the architecture is intended to protect. The supplied announcement leaves verification procedures, operational policies and the exact boundaries of those protections unspecified.

Hardware coverage: Grace Blackwell, Rubin, and DSX OS integration

The expansion extends beyond a new deployment option. NVIDIA says Confidential Computing support now reaches Grace Blackwell NVL72, bringing it to NVL72 rack-scale systems, as well as x86-based NVIDIA HGX Rubin NVL8 and NVIDIA DGX Rubin NVL8 systems.

These platform names define the hardware coverage described in the announcement. They do not establish identical configurations, availability or performance across every system. The source provides no platform-by-platform benchmark or security-feature comparison from which to draw those conclusions.

NVIDIA DSX OS supplies the software portion of the expansion. The company says it will support all NVIDIA Confidential Computing modes and serve as a software foundation for cloud providers building and operating AI factories with confidential workloads. NVIDIA also describes the planned DSX OS integration as part of a reference architecture for those providers.

The timing deserves precision. The announcement describes support as extending to the named Grace Blackwell and Rubin systems, while DSX OS support and integration are expressed as future commitments. Treating the entire expansion as a completed, uniformly available deployment would erase that distinction.

Analytically, the combination connects the model builder’s deployment choice with the provider’s infrastructure foundation. Confidential Bare Metal addresses how a sensitive workload can be operated; the hardware expansion and planned DSX OS integration address the platforms on which providers can build that service. The announcement does not include a rollout schedule for every component, leaving the practical sequence dependent on the specific offering.

Ecosystem adoption: Google Cloud A4X Max, Cohere Model Vault, and other partners

Google Cloud and Cohere provide the announcement’s most concrete examples of how the expanded architecture is expected to reach users. Their roles differ: Google Cloud is extending infrastructure support, while Cohere plans to integrate the technology into its Model Vault offering.

NVIDIA says Google Cloud is extending Confidential Bare Metal support to A4X Max instances powered by NVIDIA GB300 NVL72 systems. These instances will combine non-virtualized NVIDIA accelerated computing with cryptographic protection for training data and model intellectual property. The announcement does not supply pricing, regional availability or a general-availability date for that configuration.

The source also includes a Google Cloud statement claiming serving-performance benefits. Without accompanying measurements or a stated comparison methodology, that statement cannot establish the performance cost or advantage of the confidential configuration. The substantiated deployment detail is the announced combination of A4X Max, GB300 NVL72 and Confidential Bare Metal.

Cohere plans to integrate Confidential Bare Metal into Cohere Model Vault. According to NVIDIA, the integration will use NVIDIA Confidential Computing trusted execution environments to extend hardware-rooted security directly to the GPU, protecting models and data in memory and across interconnects during execution. The announcement positions this integration around confidential inference, but describes it as a plan rather than a completed rollout.

NVIDIA also names CoreWeave, Firmus, GMI Cloud, Google Cloud, IREN, Lambda, Microsoft Azure Infrastructure, Nebius, Nscale and Vultr as supporting NVIDIA Confidential Computing deployments. That statement concerns the broader portfolio; it does not establish that every listed provider offers the same Confidential Bare Metal configuration.

On the systems side, NVIDIA says Cisco, Dell Technologies, HPE, Lenovo, Supermicro and Bull will support these capabilities through NVIDIA-Certified Systems. These commitments broaden the announced ecosystem, while leaving the specifications and delivery timing of individual offerings unresolved in the supplied evidence.

Implications for AI agents: secure training, inference, and sovereign deployment

NVIDIA frames the expansion as a way for model builders to gain more geographic, sovereign and operational options for scaling training and inference worldwide. For agent platforms dependent on proprietary models or sensitive data, the relevant implication is access to external infrastructure with protections intended to preserve control during execution.

Training and inference appear in different parts of the partner story. Google Cloud’s announced configuration explicitly includes cryptographic protection for training data and model intellectual property. Cohere’s planned Model Vault integration emphasizes confidential inference and GPU-level protection. Together, these examples support relevance across the model lifecycle without proving that every deployment option has identical operational characteristics.

The sovereign-deployment argument requires care. NVIDIA says its expanding ecosystem creates more sovereign options. The announcement does not identify particular jurisdictions, residency guarantees, certifications or legal requirements met by a deployment. Hardware-rooted protection is therefore relevant to sovereignty planning, but the source does not establish that it independently satisfies any specific sovereignty obligation.

There is also a distinction between confidentiality of execution and the behavior of an agent using that execution environment. The evidence describes protection for models and data while running. It does not document controls governing an agent’s tool permissions, the destinations to which an application sends information or the correctness of its actions. Those subjects fall outside what this announcement demonstrates.

For deployment decisions, the practical questions follow directly from the gaps in the announcement: which provider offers the required mode, on which supported hardware, with what attestation process and on what availability schedule? Performance and cost also remain unquantified. These are unresolved evaluation questions, rather than evidence that the announced protections are ineffective.

The strongest supported implication is expanded choice. Builders seeking dedicated third-party infrastructure and control over their software stack have a newly announced confidential computing route. Whether it fits a particular agent platform depends on the concrete service and the requirements that service must meet.

Conclusion: Outlook for confidential AI agent infrastructure

Confidential Bare Metal extends NVIDIA’s confidential computing portfolio to dedicated third-party infrastructure, alongside its container and virtual-machine options. Broader hardware support, Google Cloud’s announced A4X Max configuration and Cohere’s planned Model Vault integration give the expansion identifiable routes toward model training and inference workloads.

The significance for AI agents is a more explicit infrastructure foundation for protecting the models and data behind them. The limits of the evidence are equally clear: the announcement supplies no independent security testing, comparative benchmarks or complete partner rollout schedule. Its promise is a wider set of protected deployment options; assessing a production service still requires the implementation details behind those commitments.