Why AVF?

TEE.fail: Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition

Breaking Trusted Execution Environments via DDR5 Memory Bus Interposition

Introducing Deno Sandbox | Deno

Instant Linux microVMs with defense-in-depth security for running untrusted code.

TrenchBoot Anti Evil Maid (current plan - v2) - Dasharo Universe

As Qubes OS users, promoters, and developers, we understand how essential it is to be aware of the latest developments in maintaining the security of your favorite operating system. We're excited to share our plans to integrate the TrenchBoot Project into Qubes OS's new Anti-Evil Maid (AEM) implementation. As you may know, traditional firmware security measures like UEFI Secure Boot and measured boot, even with a Static Root of Trust (SRT), may only sometimes be enough to ensure a completely secure environment for your operating system. Compromised firmware may allow for the injection of malicious software into your system, making it difficult to detect. To overcome these limitations, many silicon vendors have started implementing Dynamic Root of Trust (DRT) technologies to establish a secure environment for operating system launch and integrity measurements. We're excited to take advantage of these advancements through integration with the TrenchBoot Project.

microsandbox - Every agent deserves its own machine

Run lightweight microVMs locally. Programmable networking, custom filesystems, secrets that never leak.

FOSDEM 2025 - Goblins: The framework for your next project!

Building peer-to-peer decentralised applications remains difficult and error-prone. Most attempts at this either abandon collaborative features entirely or fall back on centralised architectures. The Spritely Institute is working on this challenge by creating (among other things) Goblins, a Guile framework that makes secure, fault-tolerant peer-to-peer applications accessible to developers. These tools are especially valuable for developers building secure collaborative applications that aim to foster healthy online communities. This talk walks you through Goblins’ most powerful features, including the actor model, object capability security, networking, time travel debugging, and persistence.

Genode - Genode Operating System Framework

We understand the complexity of code and policy as the most fundamental security problem shared by modern general-purpose operating systems. Because of high functional demands and dynamic workloads, however, this complexity cannot be avoided. But it can be organized. Genode is a novel OS architecture that is able to master complexity by applying a strict organizational structure to all software components including device drivers, system services, and applications. The Genode OS framework is an open-source tool kit for building highly secure component-based operating systems. It scales from embedded devices to dynamic general-purpose computing.

Composio

Just-in-time tool calls, secure delegated auth, sandboxed environments, and parallel execution across 1,000+ apps.

Reflections on trusting trust

To what extent should one trust a statement that a program is free of Trojan horses? Perhaps it is more important to trust the people who wrote the software.

libkrun/libkrun

A dynamic library providing Virtualization-based process isolation capabilities

osvauld/osvauld

Fully open-source, end-to-end encrypted, peer-to-peer application suite.

Joanna Rutkowska (@rootkovska) on X

Distrusts computers. Keeps embracing them anyway. Previously: Golem Foundation/Wildland, Qubes OS, hardware/virtualization/OS security research.

SGX.Fail

Intel's Software Guard Extension (SGX) promises an isolated execution environment, protected from all software running on the machine. In the past few years, however, SGX has come under heavy fire, threatened by numerous side channel attacks. With Intel repeatedly patching SGX to regain security, we set out to explore the effectiveness of SGX's update mechanisms to prevent attacks on real-world deployments.

Confidential Inference via Trusted Virtual Machines

Announcing a new collaborative research paper on Confidential Inference, a set of tools to improve the security of our model weights and of our users' data

Defeating Prompt Injections by Design

Large Language Models (LLMs) are increasingly deployed in agentic systems that interact with an untrusted environment. However, LLM agents are vulnerable to prompt injection attacks when handling untrusted data. In this paper we propose CaMeL, a robust defense that creates a protective system layer around the LLM, securing it even when underlying models are susceptible to attacks. To operate, CaMeL explicitly extracts the control and data flows from the (trusted) query; therefore, the untrusted data retrieved by the LLM can never impact the program flow. To further improve security, CaMeL uses a notion of a capability to prevent the exfiltration of private data over unauthorized data flows by enforcing security policies when tools are called. We demonstrate effectiveness of CaMeL by solving $77\%$ of tasks with provable security (compared to $84\%$ with an undefended system) in AgentDojo. We release CaMeL at https://github.com/google-research/camel-prompt-injection.