What's new in Red Hat OpenShift confidential computing and sandboxing

Red Hat is announcing Red Hat OpenShift sandboxed containers 1.13 and Red Hat build of Trustee 1.2, alongside the debut of Red Hat build of Agent Sandbox, now available as a Technology Preview.

This release advances confidential computing on 2 fronts: 

• First, confidential AI on bare metal reaches general availability (GA). The graphics processing unit (GPU)-accelerated protection introduced as a Technology Preview in the previous release is now production ready. It gives organizations verifiable, end-to-end protection for AI models and data in use, from CPU to GPU, on their own hardware. 
• Second, it extends OpenShift sandboxed containers beyond confidential computing into agentic AI with Red Hat build of Agent Sandbox. This new operator gives autonomous AI agents a more security-rich, virtual machine (VM)-isolated place to execute untrusted code.

Together, these 2 areas of advancement address the trust problem at the heart of running AI on sensitive data, which forces 3 parties together: the model owner protecting proprietary weights, the data owner keeping information confidential while it’s in use, and the platform needing to run untrusted agent code without being exposed to it. Protect the model. Protect the data. Contain the agent.

OpenShift sandboxed containers 1.13: Hardening confidential computing and expanding where it runs

OpenShift sandboxed containers 1.13 builds on prior releases, extending confidential computing to GPU-accelerated AI at GA, reaching new managed and hosted footprints, and further hardening the platform for regulated production use.

Feature highlights include:

• Technology Preview for OpenShift sandboxed containers on hosted clusters via hosted control planes.
• Technology Preview for OpenShift sandboxed containers on public cloud (AWS, Azure, and Google Cloud) using nested virtualization, a lower-cost alternative to peer pods.
• Short-lived token support for OpenShift sandboxed containers on Microsoft Entra Workload ID and AWS Security Token Service.
• UBI-minimal operator images and central transport layer security (TLS) profile consistency for tighter compliance and a smaller attack surface.
• GA of IBM Confidential Computing Containers for IBM Z and LinuxONE, which takes advantage of IBM’s Telum and Telum II on-chip AI acceleration for real-time fraud detection, risk analytics, and end-to-end protection for AI data pipelines through IBM Secure Execution.

Confidential AI on bare metal now generally available

AI raises the stakes for protecting data in use. Training and inference expose proprietary model weights and sensitive data to the entire infrastructure environment. In the previous release, we introduced Technology Preview support for extending the trusted execution environment (TEE) from the CPU to the GPU. Now, confidential containers with confidential GPU accelerators on bare metal graduate to GA, with full production support and Red Hat service-level agreement (SLA) commitments.

At GA, the solution provides:

• End-to-end hardware encryption of data, models, and model weights across both CPU and GPU memory throughout computation, protecting against host-level inspection.
• GPU TEE attestation through Red Hat build of Trustee, integrated with the NVIDIA Remote Attestation Service (NRAS), so workloads run only on verified, tamper-proof hardware.
• Multi-GPU support with NVIDIA DGX B200 for larger AI workloads on a single Intel TDX confidential node.
• Integration with the NVIDIA GPU Operator and compatibility with common artificial intelligence and machine learning (AI/ML) frameworks, such as PyTorch, TensorFlow, and NVIDIA CUDA, so data scientists can protect existing workloads without code changes.

Confidential AI is fundamentally a problem of trust among 3 parties, each needing a guarantee the other 2 cannot override:

• The model owner needs cryptographic proof that proprietary weights are never visible on infrastructure they don’t control.
• The data owner needs the same guarantee for their data while it’s in use, and that includes protection from the model owner. The model processes the data, but the party who built it should never see it in the clear.
• The platform operator runs both workloads and is trusted with neither. They keep the infrastructure available without ever being able to inspect what runs on it.

Confidential containers with confidential GPUs resolve this tension. Model weights and data stay hardware encrypted and attested throughout inference, so neither is ever exposed in plaintext—not to the cluster administrator, the hypervisor, or the host.

Confidential AI is also no longer limited to hardware you own. In this release, we’re extending it to Microsoft Azure as a Technology Preview, so you get the same protection model on confidential GPU instances in the cloud: hardware-encrypted CPU and GPU memory, with attestation handled by Red Hat build of Trustee. It’s the 1st step toward running confidential AI wherever your workloads happen to live, whether that’s bare metal in your own datacenter or infrastructure you don't control.

Confidential inference demo

Introducing Red Hat build of Agent Sandbox (Technology Preview)

As AI shifts from passive chatbots to autonomous agents that execute code, manipulate files, and orchestrate tools, enterprises face a new challenge: How do you safely run code that an AI generated and that you cannot fully trust? Standard Kubernetes containers weren’t designed for this. Default syscall profiles permit broad execution, and a compromised or misbehaving agent can attempt credential theft or lateral movement.

Red Hat build of Agent Sandbox—debuting in this release as a Technology Preview—closes that gap. It’s a new operator under the OpenShift sandboxed containers umbrella that manages the lifecycle of ephemeral, VM-isolated sandboxes backed by Kata Containers. This gives AI-generated and untrusted code a strong, hardware-level boundary that contains even kernel-level exploits.

Key capabilities in this Technology Preview include:

• Runtime-neutral sandbox lifecycle management through a simple set of custom resources (Sandbox, SandboxTemplate, SandboxClaim, and SandboxWarmPool).
• Warm pools that preprovision sandbox environments for low-latency, interactive agent responsiveness, avoiding cold-start VM creation.
• A sandbox router for secure and scalable network access to running sandboxes, which is a prerequisite for web-based agent tools such as browsers, notebooks, and integrated development environments (IDEs).
• Flexible deployment: peer pods and nested on public cloud (Microsoft Azure Red Hat OpenShift, Red Hat OpenShift Service on AWS (ROSA), and self-managed OpenShift on public cloud), or bare metal with Kata.
• The substrate for the emerging Model Context Protocol (MCP) code-execution pattern and for independent software vendor (ISV) and partner agentic AI integrations.

Red Hat build of Agent Sandbox can be installed on its own from OperatorHub, or enabled alongside OpenShift sandboxed containers through an opt-in feature gate, with zero disruption to existing users.

From prompt injection to containment: Executing AI-generated code safely with Red Hat build of Agent Sandbox

Red Hat build of Trustee 1.2: Attestation everywhere, ready for what's next

Red Hat build of Trustee remains the cornerstone of policy-driven secret management for confidential workloads. It releases secrets only to hardware-attested workloads, never exposing them in plaintext to cluster administrators. Version 1.2 extends that foundation:

• Disconnected (air-gapped) attestation now extends to Intel TDX on both bare metal and Azure or Azure Red Hat OpenShift, building on the AMD SEV-SNP disconnected support delivered previously—a critical requirement for government and highly regulated, network-isolated deployments
• Automated platform-data collection and quote-generation setup via the Intel TDX DCAP Operator on the workload cluster, replacing a previously manual per-node configuration process
• Post-quantum cryptography (PQC) readiness, including validation of ML-KEM, preparing attestation for a post-quantum world
• Expanded IBM Secure Execution for Linux (SEL) support for IBM LinuxONE environments
• Must-gather support for Red Hat build of Trustee for easier diagnostics and faster support resolution
• Seamless upgrades from Trustee 1.1 to 1.2, plus continued compliance and security hardening (central TLS profile consistency and UBI-minimal images)

Driving industry adoption by protecting critical workloads

With confidential AI now GA and Red Hat build of Agent Sandbox available for preview, organizations across financial services, healthcare, the public sector, and other regulated industries gain new ways to protect their most sensitive AI workloads and contain the autonomous agents acting on them.

What's next

This release sets the stage for the next phase of our roadmap: 

• Driving confidential AI on bare metal to broader hardware coverage 
• Advancing confidential computing on managed and hosted Red Hat OpenShift toward general availability
• Maturing Red Hat build of Agent Sandbox from Technology Preview toward GA with deeper integrations across the agentic AI ecosystem, including MCP tool servers and partner platforms

Get started

Whether you’re protecting proprietary models and sensitive data in confidential GPU pipelines or giving your AI agents a secure place to run code, this release brings hardware-backed protection to your most important AI workloads. Get started through the Red Hat Hybrid Cloud Console, and explore the documentation for OpenShift sandboxed containers, Red Hat build of Trustee, and Red Hat build of Agent Sandbox.

Do you prefer a working environment over a checklist? Deploy a reference environment with a GitOps Confidential Containers and Red Hat build of Trustee deployment with sample workloads, and part of the broader Layered Zero Trust pattern. You can also read about how to use validated patterns.