Can AI agents be secured with software alone?
No. Charles Guillemet, CTO of Ledger, says securing an agent with software alone is not possible. Ambiguous language and non-deterministic models break alignment, and prompt injection can trick an agent into leaking its own credentials. The fix is to delegate rights through a policy engine, prove that engine ran honestly with a secure enclave or a zero-knowledge proof, and keep the signing keys in hardware that signs only policy-approved intents.
Why software alone can’t secure the agent
Charles Guillemet, CTO of Ledger, puts it plainly: “Securing an agent is not something possible.” Two things break. The first is alignment. Human language is ambiguous, and agents are non-deterministic, so translating what you asked into a deterministic action is hard, and sometimes the agent does something slightly different from what you meant. The second is secrecy. To act on your data or your money, an agent needs credentials: API keys, or the 24 words behind a crypto wallet. Once the agent holds them, prompt injection can pull them back out. Guillemet points to a recent case where an account on X was prompt-injected just by tweeting at it, and lost money.
Delegate rights, don’t hand over keys
The better model is to delegate rights, not credentials. You define policies, and the agent operates freely inside them. A policy engine turns the agent’s intents into checked actions. The hard part is formalization: making sure an intent actually maps to a specific action. When you approve a policy, you sign it with hardware, a Ledger device, so the engine is certain the policy came from you and not from the agent or an attacker.
Prove the execution is honest
Two problems remain. Is the policy engine running as written, and where do the keys live. Run the engine inside a secure enclave, a TEE, which Guillemet calls “not that secure, but it’s better than full software,” or prove it with a zero-knowledge proof that guarantees the computation ran correctly without revealing it. The keys stay in a secure enclave. When the agent proposes an intent, it goes through the policy engine, the enclave receives that approval, and only then does it issue the signature. The enclave signs nothing that isn’t approved.
Match the tier to the threat model
There is no single answer. Understand your threat model, then classify assets by value and match friction to each. Guillemet lays out four tiers. Low value gets software and access control. More value gets hardware that auto-signs, like keys in a HashiCorp Vault. Higher value gets hardware with a screen where you verify what you sign. The top tier is that same hardware in a multi-signature setup that needs a quorum to approve. Ledger signs its own firmware releases that way. A five-dollar-a-day wallet does not need the top tier. Your crypto does.
From the conversation
This explainer is drawn from these episodes — each carries its full transcript.
