OpenShift’s confidential-AI release draws two different trust boundaries

Red Hat’s August release of OpenShift sandboxed containers 1.13 puts two increasingly common AI risks under different forms of isolation. Confidential GPU workloads on bare metal reached general availability, while the new Red Hat build of Agent Sandbox entered Technology Preview as a way to contain untrusted code produced or invoked by autonomous agents.

What changed

The confidential-AI path extends a trusted execution environment across CPU and GPU memory. Red Hat says the supported configuration encrypts models, weights and data while they are in use, and combines GPU attestation through Red Hat build of Trustee with NVIDIA’s Remote Attestation Service. The release also adds multi-GPU support for NVIDIA DGX B200 systems on an Intel TDX confidential node and keeps compatibility with common CUDA, PyTorch and TensorFlow workloads.

That matters because the model owner, data owner and infrastructure operator do not necessarily trust one another. Hardware-backed encryption and attestation provide a way to run inference without exposing plaintext weights or input data to the host, hypervisor or cluster administrator. Red Hat’s release makes that bare-metal configuration a supported product capability rather than a preview.

Agent Sandbox addresses a separate problem. Instead of protecting a trusted workload from the infrastructure, it protects the infrastructure from code an agent may generate or execute. The preview uses Kata-backed virtual machines and introduces custom resources for sandboxes, templates, claims and warm pools. A router provides network access to running sandboxes, while warm pools reduce the latency of creating an isolated environment for interactive tools.

Who should care

Platform teams operating sensitive inference pipelines now have a production-supported option for confidential GPU processing on supported bare-metal systems. Teams experimenting with coding agents, browser tools, notebooks or Model Context Protocol code-execution patterns get an early OpenShift-native control plane for stronger workload isolation, but Agent Sandbox remains a Technology Preview rather than a generally available service.

The same release also broadens the surrounding platform. OpenShift sandboxed containers 1.13 previews hosted-cluster and nested-virtualization deployments on public clouds, while Trustee 1.2 adds disconnected Intel TDX attestation, automated quote-generation setup and post-quantum readiness work around ML-KEM.

What to do

Treat the two capabilities differently. Confidential GPU support can enter production evaluation where the documented hardware and attestation dependencies fit. Agent Sandbox is better suited to controlled trials that measure startup latency, warm-pool sizing, network policy and failure cleanup before any production commitment. The key architectural decision is whether the threat is infrastructure reading a sensitive AI workload, untrusted agent code reaching the platform, or both; this release provides a separate boundary for each.