Red Hat pairs confidential GPU AI with VM-isolated agent execution on OpenShift

Red Hat has released OpenShift sandboxed containers 1.13 and Red Hat build of Trustee 1.2, while introducing Red Hat build of Agent Sandbox as a Technology Preview. The package joins two related controls: protecting AI models and data while they are in use, and isolating code executed by autonomous agents. Red Hat’s release post was published August 4.

What changed

Confidential AI with GPU accelerators on bare metal is now generally available. Red Hat says the implementation encrypts data, model weights and GPU memory during computation, and uses Red Hat build of Trustee with NVIDIA Remote Attestation Service to verify the hardware before a workload runs. The GA configuration supports multiple GPUs on NVIDIA DGX B200 systems with an Intel TDX confidential node, and integrates with the NVIDIA GPU Operator and common CUDA-based frameworks.

The 1.13 release also adds Technology Preview paths for sandboxed containers on hosted clusters and on AWS, Azure and Google Cloud through nested virtualization. Short-lived credentials are supported through Microsoft Entra Workload ID and AWS Security Token Service. IBM Confidential Computing Containers for IBM Z and LinuxONE are now generally available as well.

Alongside that release, Red Hat build of Agent Sandbox introduces an operator for ephemeral, VM-isolated execution environments backed by Kata Containers. Its custom resources cover sandbox templates, claims and warm pools. A sandbox router provides network access for browser, notebook and IDE-style tools, while preprovisioned pools are intended to reduce startup latency for interactive agents.

Who it affects

The confidential-computing changes matter to platform teams that need to keep model weights and sensitive inference data hidden from the host, hypervisor and cluster administrator. The Agent Sandbox preview targets teams allowing AI agents to execute generated or otherwise untrusted code—workloads for which an ordinary container boundary may be too permissive.

The two features solve different parts of the same deployment problem. Confidential containers protect the model and its data from infrastructure operators; Agent Sandbox contains the code an agent chooses to run. The latter is also positioned as a substrate for Model Context Protocol code-execution patterns and partner integrations.

What to do

Teams with supported bare-metal GPU hardware can evaluate the now-supported confidential AI path against their attestation and performance requirements. Cloud and hosted-cluster users should treat the new footprints as previews rather than production commitments.

Agent-platform teams can install Red Hat build of Agent Sandbox from OperatorHub or enable it alongside OpenShift sandboxed containers through an opt-in feature gate. A sensible evaluation should measure warm-pool latency, network controls and credential exposure, while keeping the Technology Preview status explicit in production planning.