As telecom networks become more autonomous, AI workloads will move across models, agents, tools and infrastructure. Confidentiality has to move with them.
By Paolo Campoli, SVP & Chief Growth Officer, DataKrypto
I have spent much of my career watching telecom networks change shape: IP, cloud, virtualization, software-defined networking. Each shift changed more than the technology. It changed where operators placed trust and how they secured infrastructure that kept getting more distributed.
Agentic AI is the next such shift. NGMN’s recent Network Automation and Autonomy Phase III: Agentic AI for Autonomous Mobile Networks moves the industry toward trusted Level 4 autonomous networks, and its earlier Agentic AI-Based Operating Models framework placed Confidential Computing on that path. That recognition matters. Greater autonomy means more sensitive information inside live AI computation, and more authority handed to AI systems operating in critical network infrastructure.
But agentic AI also changes the shape of the thing we are trying to protect.
An enclave draws a protected boundary around a process on a host. An agentic workload does not stay inside one. A single agent may call a model, retrieve operational knowledge, use a tool, message another agent and read stored context before it finishes one task. Some of those steps run in the operator data center, others at the edge, in a cloud, or on a partner’s infrastructure. The workload is not a process with a perimeter. It is a graph, assembled fresh for each task, crossing infrastructure, organizational and jurisdictional lines as it goes.
That is the mismatch. Trusted Execution Environments (TEEs) remain valuable. They establish trust in specific infrastructure, protect keys and verify what is running. What they cannot do on their own is keep data and models confidential as the workload moves between them.
What is actually at risk
This is not a theoretical concern, and it is not only about data. The models themselves are the target.
Model theft is a recognized risk category in its own right. OWASP lists it as ML05 in its Machine Learning Security Top 10, and the first mitigation it recommends is encrypting the model and its parameters. RAND’s Securing AI Model Weights catalogues 38 distinct attack paths to model weights and estimates that the most capable nation-state operations would succeed against a typical machine learning stack more than 80 percent of the time. Its framing is blunt: for models that matter, weight theft is a national security problem, not a commercial one.
Telecom is exactly that case. An operator-tuned model for autonomous operations encodes the network itself. The topology, configuration, how it degrades, how it recovers, and which actions the operator trusts it to take without a human. Stealing those weights is not a loss of intellectual property. It hands an adversary a working map of national critical infrastructure and the playbook for running it. Communications is a designated critical infrastructure sector in the United States, while NIS2 classifies providers of public electronic communications networks and services among the EU’s sectors of high criticality. A stolen network model is a national security incident, by definition.
The relevant threat actors are already inside these networks. In August 2025, the NSA, CISA, the FBI and partner agencies from a dozen countries issued a joint advisory on Salt Typhoon, a Chinese state-linked campaign that had maintained persistent access to backbone and edge routers at telecom providers worldwide for several years. Those are the same networks where autonomous AI models will run. Any model asset that has to be decrypted in memory in order to be used is a model asset a resident adversary can eventually reach.
The gap in the agentic security list
NGMN’s Phase III framework names six security components for agentic systems:
Interface security
Authorization
Identity management
Software security
Access management
Credential provisioning
Together they answer who can take part, what they are allowed to do, and what they can reach.
None of the six covers the confidentiality of data or models while they are in use.
An agent can be fully authenticated, correctly authorized and behaving exactly as designed, and still expose operator data, prompts or model weights at the moment of computation.
Identity says who is acting.
Authorization determines the actions they may take.
Neither protects what information is being processed.
Confidentiality that travels
This is how we approach Confidential AI at DataKrypto. FHEnom for AI™ uses encrypted execution: sensitive AI assets stay encrypted while they are being computed on, so their protection does not stop at the boundary of the infrastructure running the workload. In an agentic network that means keeping operator-tuned weights encrypted during inference, retrieving from encrypted operational knowledge, and protecting payloads passed between agents, while the execution path changes from one request to the next.
TEEs still do real work here. We use them for attestation and hardware-protected key custody. Attestation verifies the environment; encryption protects the workload. Separating those two jobs means confidentiality no longer depends on every environment the workload passes through being trustworthy.
Designing for what actually happens
Encrypted execution covers one layer: confidentiality. It does not provide agent identity, authorization, behavioral guardrails or kill switches. It does not secure telemetry pipelines, OSS/EMS interfaces or digital twins, and it does not stop prompt injection or a rogue authorized user. Those risks need their own controls.
What encrypted execution changes is the blast radius. Vulnerabilities will exist, credentials will leak, software will fail, and infrastructure will span organizations with different security standards. If the model, the prompt and the proprietary data stay encrypted while in use, compromising the infrastructure around them does not hand an attacker anything usable.
NGMN is right to raise security and Confidential Computing now, while these architectures are still being designed. The controls it identifies are essential. Confidentiality of data and models in use belongs beside them, alongside trusted infrastructure, attestation, identity, authorization and access control.
When the workload moves, confidentiality has to move with it.