Private AI Agents
AI agents need privacy the most.
Agents hold your keys, your tokens, your inbox, and your wallet — and act on your behalf. Run them inside an attested CVM where the compose-hash is the scope and every action is signed.
Confidential agents, in production.
Personal, coding, security, financial, social, memory, MCP — pick a category, then drill into a specific framework to see how Phala slots into the runtime.
OpenClaw
bot
Personal computer-use agent. Sessions, calendars, and inbox sealed in a CVM whose compose-hash IS the permission scope.
Agents · live on Phala Cloud.
Verified counts from Phala Cloud + ClickHouse. Compose-hashes are observed in the Cloud DB; trust-by-construction primitives sit in an attested CVM.
Agent CVMs deployed
12,783
cumulative · all frameworks
Compute hours
16.9M
fleet-wide · since Feb 2025
TDX quotes verified
1.10M
KMS attestation
Compose-hashes observed
2,591
distinct agent builds
Total CVMs deployed by framework
cumulative · since first deploy
1,585
1,545
604
279
168
98
Eliza
character agents
7 live · since 2024-12
Clawdi
OpenClaw
193 live · since 2026-01
BlueNexus
MCP servers
5 live · since 2025-10
Vijil
verifiable CI
since 2025-04
Agent Wallet
x402 · ERC-8004
1 live · since 2025-05
Hermes
Nous Research
7 live · since 2025-01
TDX nodes
17
GPU TEE teepods
8 · 64 GPUs
Regions
5
KMS instances
34
Failed quotes / 24h
1 / 35
Run any agent framework. Sealed by construction.
Coding agents
Claude Code, Codex, and verifiable CI agents like Vijil run in a CVM where the repo, secrets, and tool tokens stay sealed against the registered compose-hash. Every diff signed before merge.
marvin@Mac ~/ai-agent % claude code
Claude Code
sealed CVM
· [marvin@Mac] % claude
✓ scope: github.write
› refactor agents/...
⏺ sealed-token: github.pat ✓
✓ Sign-RPC 0x9c1a…
OpenClawbottool · gmail.search
3 threads · 11 messages
Computer-use agents
OpenClaw, Hermes, and Pi take over the browser, GUI, and OS — bounded by an attested compose-hash and KMS-gated credentials. Sessions, calendars, inbox stay sealed in the CVM.
Tool & memory agents
MCP servers (BlueNexus) attest to clients before they accept a connection — mutual RA-TLS. Long-term memory backends (Xtrace) seal shards per app-id; revoking the build evicts memory cleanly.
BlueNexus MCP
Agent Walletx402payment request
$24.00 USDC
api.confidential-llm.ai
Wallet & on-chain agents
Agent Wallet (ERC-8004 + Coinbase x402) and Ironclaw (NEAR security) bind spending scope to the compose-hash. Multi-sig DstackApp gates every signing key; revoke compose-hash → kill access.
permission as identity · scope as compose-hash
Permission is identity. Identity is the compose-hash.
On dstack, an agent’s tool list and credential scope can’t drift from what its build authorizes — there’s no runtime path that widens privilege.
01
Attested launch
dstack-vmm boots the agent CVM. The TDX quote covers the full compose-hash — including system prompt, model digest, and tool list (all in the docker-compose).
02
Sealed credentials
User previously sealed OAuth tokens against this exact compose-hash. dstack-kms releases the wrap key only after the quote matches. No host process ever sees plaintext.
03
Mutual RA-TLS
When Agent A delegates to Agent B, each cert embeds a fresh TDX quote. Both sides run dcap-qvl on the peer and check DstackApp.sol for the allowed-delegates whitelist.
04
Bounded outbound
External tool (Gmail, Stripe, etc.) is outside the trust boundary. The OAuth token leaves only inside the outbound TLS handshake, scope upper-bounded by compose-hash.
05
Signed action log
Every tool call is appended inside the CVM and signed via Sign RPC. Tamper breaks the chain. Auditors verify without trusting Phala or the operator.
Step through a multi-agent pipeline.
Toggle dstack off to see credentials and tool scope drift loose.
Confidential AI Agents on dstack
Agent computer in a CVM · per-subagent sandboxes · sealed vault · scoped outbound channel
Attested Boot — TDX Quote Verifies the Whole Computer
dstack-vmm boots the agent runtime as one TDX CVM. dstack-guest-agent emits a combined TDX quote covering MRTD + RTMR0–3 + GPU Confidential mode. The user fetches the quote via RA-TLS and runs dcap-qvl locally — the trust decision is client-side, anchored in Intel's TDX hardware root and DstackKms.sol on-chain. Phala Network is not asked to vouch for itself.
live · Sign-RPC action log
Every tool call leaves a tamper-evident receipt.
Each row is a real-shaped Sign-RPC entry: agent identity, tool, args hash, and a per-app key signature that chains to the TDX root. Auditors verify the log offline — Phala isn't in the trust chain.
tamper detected · 0
AI solution paths
Use private models where AI touches secrets.
The private model endpoint is the first entry point. The same privacy primitive extends to agents, data workflows, and training.
Private AI inference
Serve OpenAI-compatible model calls where prompts, outputs, and customer context need encrypted-in-use protection.
DeepSeek V3.1
128K
$0.27/M input
Qwen3 Coder
256K
$0.40/M input
Llama 3.3 70B
128K
$0.15/M input
GPT OSS 120B
128K
$0.10/M input
Claude Sonnet 4.5
200K
$3.00/M input
Gemini 2.5 Pro
1M
$1.25/M input
Private model training
Adapt models on proprietary data while keeping datasets, gradients, checkpoints, and evaluation traces inside the boundary.
private training run
Observe without exposing weights.
01
dataset
sealed
02
fine-tune
running
03
eval
private
04
checkpoint
verified
loss curve
proof attached
attestation.json
Private AI data
Move models to sensitive records and return approved outputs without exposing raw data to the model operator.
source
EHR data
source
Customer records
source
Internal docs
TEE clean room
query without raw access
approved output
aggregate only
Deploy a confidential agent
Permission as identity. Scope as compose-hash.
Ship the agent as a docker-compose. Register the compose-hash. Seal the OAuth tokens. Every cross-agent call re-verifies the peer over RA-TLS.
- 01Mutual RA-TLS between agent CVMs
- 02Sealed OAuth tokens, KMS-gated
- 03Compose-hash IS the scope
- 04Outbound tools bounded by attested code
- 05Sign-RPC action log
