The CoreWeave Zero Trust AI Framework is a security model that CoreWeave, the American AI cloud provider, announced on October 21, 2026, at NVIDIA's GTC Berlin conference. CoreWeave describes it as a "customer-controlled security model" meant to give customers authority over access to their models, data and runtime environments, and to keep CoreWeave itself out of the customer's "trust chain" for sensitive AI workloads.[1][2][3] The framework groups six layers under names that each begin with "Zero": Zero Key Access (Remote Key Encryption), Zero Node Access (Support Access Management), Zero Trust Infrastructure (attestation), Zero In-Use Access (confidential computing), Zero Model Data (a commitment not to train on customer data) and Zero Trust Network Encryption (MACsec on the CoreWeave backbone).[1][2] The layers are not all at the same stage. Support Access Management was already documented as a CoreWeave feature in March 2026, and CoreWeave said its backbone already uses MACsec. Remote Key Encryption was due to reach limited availability in the fourth quarter of 2026, and CoreWeave described confidential computing as something it "intends" and "plans" to support, starting with select bare-metal environments.[2][3][6][8]

Background

Using a public cloud usually means trusting the provider with some part of the security boundary. In its launch post, CoreWeave listed four ways this happens: the provider may administer the encryption keys, keep privileged access to servers, manage the execution environment, or offer its own AI models that may learn from customer interactions.[1] CoreWeave argued that agentic AI makes the problem larger, because agents retrieve context, call tools, use memory and trigger actions in other systems, so sensitive data "moves through prompts, embeddings, weights, traces, outputs, evaluation records, and runtime systems" rather than sitting behind one application boundary.[1] On October 15, 2026, CoreWeave's chief information security officer, James Higgins, made the same argument in a separate blog post, writing that "Encryption is table stakes" and that the harder problem in AI is authority: who can make protected data usable, where that authority applies, and how quickly it can be revoked.[15][18]

The name borrows from zero trust security. The U.S. National Institute of Standards and Technology's Special Publication 800-207, Zero Trust Architecture (August 2020), describes zero trust as "an evolving set of cybersecurity paradigms that move defenses from static, network-based perimeters to focus on users, assets, and resources," and says it "assumes there is no implicit trust granted to assets or user accounts based solely on their physical or network location."[10] CoreWeave applies the idea to the cloud provider itself: the framework is pitched as reducing how much a customer has to trust CoreWeave's own staff, keys and infrastructure.[1][2] Dave McCarthy, group vice president for cloud and data centers at IDC, was quoted in the announcement as saying that "zero trust must extend beyond identity and network security to the entire AI infrastructure stack."[2]

Two of the six layers rely on confidential computing, in which code and data are processed inside hardware-isolated trusted execution environments, and on remote attestation, in which the hardware produces cryptographic evidence of its state before a workload or secret is released to it.[1][11] NVIDIA supports confidential computing on its Hopper, Blackwell and Rubin GPUs and says the Rubin architecture is the third generation of the technology. It describes Vera Rubin NVL72 as extending it to rack scale, creating "a unified security domain spanning 72 NVIDIA Rubin GPUs, 36 NVIDIA Vera CPUs, and interconnects."[11]

Announcement

CoreWeave announced the framework in a press release datelined Berlin on October 21, 2026, saying it was unveiled at NVIDIA GTC Berlin.[2] A longer blog post published the same day, "CoreWeave Zero Trust AI Framework: Your Model. Your Data. Your Trust.," was written by Higgins and Corey Sanders.[1] On X, CoreWeave called it "a six-layer framework built to keep us out of your trust chain for sensitive AI workloads."[3]

Chen Goldberg, CoreWeave's executive vice president of product and engineering, said in the release: "Security for AI workloads cannot rest on a provider's promises about its own behavior. Our customers are running their most valuable models against their most sensitive data. They should not have to take our word for how we handle either. The Zero Trust AI Framework replaces assurances with architecture, so the controls that matter stay in the customer's hands."[2]

Several pieces predate the launch. CoreWeave's documentation dates Support Access Management to March 26, 2026.[8] Remote Key Encryption was first announced on September 22, 2026, in a CoreWeave blog post about enterprise identity and key control, which SiliconANGLE covered the same day.[4][5] The October announcement put these existing and planned controls under one name, alongside new commitments on confidential computing and data use.[1][2]

The six layers

Layer (CoreWeave's name)	Component	What CoreWeave says it does	Status as described by CoreWeave
Zero Key Access	Remote Key Encryption (RKE)	Customers use keys from key infrastructure they already run, such as a software key manager, a hardware security module (HSM) or a key management service (KMS) in another cloud, without transferring key authority to CoreWeave[1][2]	Limited availability in Q4 2026[6]
Zero Node Access	Support Access Management (SAM)	CoreWeave staff reach customer infrastructure only after the customer approves a request for a defined need; access ends when the work does[1][2]	Documented since March 2026; opt-in[7][8]
Zero Trust Infrastructure	Attestation services	Infrastructure running a workload is verified using hardware roots of trust; a workload or key system can require valid evidence before releasing secrets[1][2]	Described in the blog as services CoreWeave "is advancing" (the press release uses the present tense); no date given[1][2]
Zero In-Use Access	Confidential computing	Hardware-based protection of models, data and code while in use, on NVIDIA Blackwell and Vera Rubin platforms[1][2]	CoreWeave "intends" to support it, starting with select bare-metal environments[1][2]
Zero Model Data	Data-use commitment	CoreWeave does not use customer prompts, training data, model weights or outputs to train or improve its own models[2]	Stated policy[1][2]
Zero Trust Network Encryption	IEEE 802.1AE MACsec	Encrypts data moving across links between CoreWeave data centers[1][2]	In use, according to CoreWeave[1][2]

Zero Key Access: Remote Key Encryption

Remote Key Encryption (RKE) is meant to let customers keep control of the keys that protect their data at rest. CoreWeave says RKE encrypts data on its platform using keys "generated, stored, and rotated entirely inside your existing key store," which can be a secrets manager, a cloud KMS or an HSM, in the cloud or on premises.[4] Encryption takes place client-side, inside the customer's trusted compute boundary. RKE does not import the customer's keys into a CoreWeave-side KMS, and CoreWeave says it "never sees plaintext and only ever holds ciphertext."[4] Key rotation, expiration and revocation stay with the customer's existing tooling, and CoreWeave says its method for using a remote key manager as the system of record is patent pending, while the underlying encryption algorithms are standard ones.[4][5] On its security page, CoreWeave says a time-to-live can be set on key derivation, so that revoking access in the customer's key source makes the next re-derivation fail.[6]

The framework post says customers' existing users, groups and identity provider can be federated to RKE-protected resources and CoreWeave IAM, so that the customer controls who can access protected data as well as who holds the keys. "If CoreWeave does not have the key or does not have the permissions to access it, CoreWeave cannot decrypt the data," it says.[1] The launch post on X put it as: "without your key, we can't decrypt your data."[3]

RKE was not yet generally available at launch. On X, CoreWeave said it was "coming later this year," and CoreWeave's security page says it "reaches Limited Availability in Q4 2026."[3][6] The first release is to protect data on CoreWeave AI Object Storage, using keys held in HashiCorp Vault Enterprise or in KMS and HSM products that support the Key Management Interoperability Protocol (KMIP).[4] SiliconANGLE reported that IBM, which acquired HashiCorp in February 2025, is a launch partner.[5] RKE is separate from an older feature: since August 4, 2025, AI Object Storage has supported server-side encryption with customer-provided keys (SSE-C), in which the customer supplies an AES-256 key with each request and CoreWeave performs the encryption and decryption.[9][6]

Zero Node Access: Support Access Management

Support Access Management (SAM) puts the customer in charge of whether CoreWeave employees can enter its environment for support work. CoreWeave's documentation says that with SAM enabled, every CoreWeave-initiated access to a customer's CoreWeave Kubernetes Service (CKS) environment is request-based, approved by the customer, time-bound and auditable.[7] Employees submit an access request through Teleport, and only a member of the customer's organization holding the Access Request Approver IAM role can approve or deny it.[7]

SAM detail	Documented behavior
Systems covered	CKS clusters (via `kubectl`) and the physical servers under a CKS cluster (via SSH)[7]
Cluster roles CoreWeave may request	`teleport-cluster-viewers` (read-only, no access to `Secret` resources) or `teleport-cluster-super-admins` (full access to Kubernetes resources)[7]
Approved access	Expires automatically after 8 hours by default, after which the session is terminated[7]
Unanswered requests	Expire after 2 hours without granting access[7]
Logs	Teleport audit logs and Kubernetes audit logs forwarded in real time through CoreWeave Telemetry Relay; Teleport session logs of commands run, on request with a 24-hour turnaround[7]
Availability	Opt-in; customers ask CoreWeave Support to enable it[7]

The documentation also says CoreWeave requires customers who turn SAM on to monitor their notification channel at all times, and that the time between a request notification and the customer's approval does not count as downtime against CoreWeave's service-level agreements.[7] The release note for the feature says CoreWeave employees do not have standing access to customer environments and must submit a time-bound request when support needs access; SAM is what gives the customer the approval decision.[8]

Zero Trust Infrastructure: attestation

The third layer is attestation: checking that the hardware and software under a workload are in an expected state before trusting it. CoreWeave says its attestation services verify the infrastructure running a workload "using hardware roots of trust," and that attestation can drive automated decisions, so that "a workload, key-management system, or orchestration layer can require valid evidence before releasing secrets, decrypting data, or allowing execution to proceed."[1][2] The blog post describes these as services CoreWeave "is advancing" and does not give a release date.[1]

Zero In-Use Access: confidential computing

Remote Key Encryption covers data at rest. The fourth layer covers data while it is being processed. CoreWeave said it intends to support confidential computing on NVIDIA Blackwell and Vera Rubin platforms, and the press release said it intends to extend NVIDIA's third-generation Confidential Computing across CPUs, GPUs and the NVLink fabric, including on NVIDIA HGX Rubin NVL8, an eight-GPU system that CoreWeave said was coming to CoreWeave Cloud in the fourth quarter of 2026.[1][2][19] CoreWeave said it plans to start with select bare-metal environments and later extend support to other deployment models, including Kubernetes-based AI workloads.[1][2] It also said it intends to support the NVIDIA OpenShell Reference Architecture, which combines Rubin GPUs and Vera CPUs running the NVIDIA OpenShell secure runtime.[2]

The blog post ties this layer to data rules, noting that much sensitive enterprise data stays on premises under requirements such as the GDPR, the EU AI Act and national data-sovereignty mandates.[1] It separates the roles of the two hardware layers: "Attestation verifies that the infrastructure is in an expected state before it is trusted. Confidential computing helps isolate and protect the workload during execution."[1] In his October 15 post, Higgins wrote that customer-held keys and confidential computing "point toward a future" in which key custody, runtime protection and infrastructure verification work more closely together, adding that they "should not be confused with what RKE does today."[15]

Zero Model Data: no training on customer data

The fifth layer is a business commitment rather than a technical control. In the press release, CoreWeave says that "as an AI cloud, not a competing model provider," it "does not use customer prompts, training data, model weights, or outputs to train or improve its own models."[2] The blog post adds that CoreWeave "is not a cloud with a foundation model business that competes with customers," and that customers' models and data remain their assets when they use CoreWeave's inference, Serverless Reinforcement Learning, Serverless Supervised Fine-Tuning and Model Distillation products.[1] The commitment matches the wording of CoreWeave's Trust Center, which says customers retain ownership and control of their data and that CoreWeave processes it "solely to deliver and operate the CoreWeave Cloud services."[17]

Zero Trust Network Encryption: MACsec

The sixth layer covers data moving between sites. CoreWeave says it uses IEEE 802.1AE MACsec to encrypt data moving across its backbone between data centers, to help defend against interception, tampering and unauthorized observation, and that building the encryption into the network means application teams do not each have to handle it.[1][2] IEEE 802.1AE, first published in 2006 with the current base edition dated 2018, specifies connectionless user data confidentiality, data integrity, data origin authenticity and privacy protection for IEEE 802 local area networks, operating at the media access control (MAC) layer.[12]

Relationship to other CoreWeave security features

The framework sits on top of security features CoreWeave already offered. Its documentation describes three security pillars: data security, network security and isolation, and identity and access management.[16] CoreWeave IAM federates with enterprise identity providers such as Microsoft Entra and Okta over SAML and OIDC, and Automated User Provisioning syncs users and groups from those providers into CoreWeave IAM.[4][6] CoreWeave's September 2026 post also described SUNK User Provisioning, which creates POSIX users, syncs SSH keys and sets up Slurm accounts for federated users on its Slurm-on-Kubernetes clusters.[4][5] On supported nodes, CoreWeave uses NVIDIA BlueField data processing units to run infrastructure services separately from the host system, and its CKS nodes are single-tenant.[6][16] CoreWeave says it aligns its security and compliance programs to the SOC 2 and ISO 27001 frameworks; its Trust Center says details of specific certifications and audit reports are available under a nondisclosure agreement.[6][17]

The framework's fifth layer leans on CoreWeave's position as a neocloud, a GPU cloud provider rather than a model developer. CoreWeave argues that because it has no foundation model business competing with its customers, it has no need to use customer data to train models or improve AI software.[1][2]

Reception

Trade coverage on October 22, 2026, in Verdict and Tech Monitor, both articles by Anwesha Pattanaik, summarized the six layers largely as CoreWeave described them. Both reported that CoreWeave planned to keep expanding confidential computing support, with specific NVIDIA hardware expected on CoreWeave Cloud from the fourth quarter of 2026.[13][14]

CoreWeave's own security writing gives a yardstick for judging such frameworks. Among nine questions Higgins proposed for reviewing an AI infrastructure platform were "Which controls are available and documented today, and which are still on the roadmap?" and "What is protected at rest, in transit, and in use, and what can I verify today?"[15] By CoreWeave's own descriptions at launch, Support Access Management, MACsec on the backbone and the data-use commitment were in place, while Remote Key Encryption, attestation services and confidential computing were described as upcoming, in development or intended.[1][2][6][7]

See also

References

Higgins, James; Sanders, Corey. "CoreWeave Zero Trust AI Framework: Your Model. Your Data. Your Trust." CoreWeave Blog, 2026-10-21. https://www.coreweave.com/blog/coreweave-zero-trust-ai-framework-your-model-your-data-your-trust
"CoreWeave Launches the CoreWeave Zero Trust AI Framework, Keeping Customers in Control of Access to Their Models, Data and Runtime Environments." CoreWeave (press release), 2026-10-21. https://www.coreweave.com/news/coreweave-launches-the-coreweave-zero-trust-ai-framework-keeping-customers-in-control-of-access-to-their-models-data-and-runtime-environments
CoreWeave (@CoreWeave). Post on X announcing the Zero Trust AI Framework, 2026-10-21. https://x.com/CoreWeave/status/2113004965832659199
Manoske, Andy; Friedman, Paul. "Bringing Enterprise Identity and Key Control to AI on CoreWeave." CoreWeave Blog, 2026-09-22. https://www.coreweave.com/blog/bringing-enterprise-identity-and-key-control-to-ai-on-coreweave
Riley, Duncan. "Exclusive: CoreWeave launches Remote Key Encryption to keep customer keys off its cloud." SiliconANGLE, 2026-09-22. https://siliconangle.com/2026/09/22/exclusive-coreweave-launches-remote-key-encryption-to-keep-customer-keys-off-its-cloud/
"Security." CoreWeave, accessed 2026-10-25. https://www.coreweave.com/security
"Support access management." CoreWeave Documentation, accessed 2026-10-25. https://docs.coreweave.com/security/support-access-management
"March 26, 2026 - Support Access Management." CoreWeave Documentation (release notes). https://docs.coreweave.com/changelog/release-notes/support-access-management
"August 4, 2025 - CoreWeave AI Object Storage SSE-C support." CoreWeave Documentation (release notes). https://docs.coreweave.com/docs/changelog/release-notes/ai-object-storage-sse-c
Rose, Scott; Borchert, Oliver; Mitchell, Stu; Connelly, Sean. "Zero Trust Architecture." NIST Special Publication 800-207, August 2020. https://csrc.nist.gov/pubs/sp/800/207/final
"NVIDIA Confidential Computing." NVIDIA, accessed 2026-10-25. https://www.nvidia.com/en-us/data-center/solutions/confidential-computing/
"802.1AE: MAC Security (MACsec)." IEEE 802.1 Working Group, accessed 2026-10-25. https://1.ieee802.org/security/802-1ae/
Pattanaik, Anwesha. "CoreWeave targets agentic AI risks with zero-trust framework." Verdict, 2026-10-22. https://www.verdict.co.uk/coreweave-launch-zero-trust-framework/
Pattanaik, Anwesha. "CoreWeave targets agentic AI risks with zero-trust framework." Tech Monitor, 2026-10-22. https://www.techmonitor.ai/news/coreweave-targets-agentic-ai-risks-with-zero-trust-framework
Higgins, James. "Why the AI Loop Will Test Every Security Assumption." CoreWeave Blog, 2026-10-15. https://www.coreweave.com/blog/why-the-ai-loop-will-test-every-security-assumption
"Introduction to CoreWeave Security." CoreWeave Documentation, accessed 2026-10-25. https://docs.coreweave.com/security
"Trust Center." CoreWeave, accessed 2026-10-25. https://www.coreweave.com/trust
"James Higgins, Chief Information Security Officer." CoreWeave Leadership, accessed 2026-10-25. https://www.coreweave.com/leadership/james-higgins
Banwait, Harsh Singh. "CoreWeave Powers Agentic AI, HPC, and Data Analytics Workloads with NVIDIA HGX Rubin NVL8." CoreWeave Blog, 2026-10-21. https://www.coreweave.com/blog/coreweave-powers-agentic-ai-hpc-and-data-analytics-workloads-with-nvidia-hgx-rubin-nvl8

Editing: CoreWeave Zero Trust AI Framework