VM vs CVM: why AI trading swarms need confidential VMs

Who can read an ordinary VM

An ordinary VM is a slice of someone else's computer. The hypervisor that runs it can read and copy everything in its memory and on its disk, so whoever runs the host can too: the cloud's operators, anyone with access to the host, anyone who takes it over. Most hosts promise not to look. Nothing on the machine proves it.

Disk encryption does not change this while the machine runs. To use a key, a program loads it into memory in the clear, where the host can read it. For an AI agent, memory holds what matters most: its wallet's private key, its exchange API keys, its strategy, the orders it is about to send and the data it reads.

What a confidential VM changes

A confidential VM (CVM) runs inside a trusted execution environment (TEE) built into the CPU; on Agentgates that is Intel TDX. The CPU encrypts the machine's memory with keys the host never holds and stops the hypervisor from reading or changing it. The host can still start, stop and delete the machine. It cannot see inside it.

On an Agentgates CVM, memory and disk are encrypted in the TEE and we hold no key to them. Env values, where an agent's keys go, are sealed to the machine's own enclave key and never stored. The machine's logs stay inside it.

Attestation: proof in place of a promise

An ordinary host asks you to trust its word. A CVM proves what it runs: the CPU signs a quote, a report of the code loaded into the machine, with a key the chip maker certifies. Anyone can check the quote against the code they meant to run, and a machine running anything else fails the check.

Every Agentgates machine has a public verify page at https://api.agentgates.ai/compute/verify/{id}: its compose hash, its OS image hash and its Intel TDX quote, with no login. Read it before the machine gets its first key.

A "private" or "secure" server with no attestation you can check is an ordinary VM with a promise. Ask for the quote.

Why a trading swarm needs it

A trading agent's edge is its keys and its strategy. On an ordinary VM both sit where the host can read them: a key read there can empty the wallet, and a strategy or an order read before it is sent can be copied or traded against.

A swarm multiplies that. One host running a hundred agents holds a hundred keys. With one CVM per agent, each agent's keys, strategy and orders are sealed in its own machine, away from the host and from every other agent. A parent agent can read each child's verify page before it hands that child a key.

The same holds for research, data and backtesting swarms whose data or models are the asset, and for agents that serve their own APIs to paying customers, who can check the quote themselves.

What a CVM does not change

It runs the code you give it. A bug in your agent, a key it prints to a log that leaves the machine, a payment it signs to the wrong address: a CVM does not undo those. Keep keys out of the image and out of logs, and send them as env values, sealed to the machine.

What the agent sends out leaves the machine as sent: an order goes to the exchange it is sent to, and the exchange sees it.

Moving an agent from a VM to a CVM

Nothing in the agent's code changes: an Agentgates CVM runs your Docker image or compose. Put the agent's keys in env, publish the port it serves on, and read the verify page once the machine reads "running".

Each agent's wallet can buy its own machine with USDC over x402 on Base, Polygon or Solana, with no account and no API key, or one parent wallet can pay for the whole swarm from a prepaid balance with a key per agent (/docs/compute-for-ai-agent-swarms). Live prices are on /pricing.

FAQ