Linux Foundation Takes Governance of TRACE Open Standard for AI Runtime Attestation

The Linux Foundation announced Tuesday that it will assume governance of TRACE (Trust, Runtime Attestation and Compliance Evidence), a new open specification designed to produce verifiable, hardware-attested evidence of how AI agents and other confidential workloads execute. Originally contributed by confidential computing vendor OPAQUE and co-developed with AMD, Intel, Microsoft, and the Technology Innovation Institute (TII), TRACE produces a cryptographically verifiable record binding together the runtime environment, the software executed, the policies applied, data classifications, and the specific tools an AI agent invoked. The resulting artifact is engineered to be portable across heterogeneous cloud providers, confidential computing platforms, and sovereign infrastructure deployments.

The initiative responds to a sharp operational shift as organizations move AI agents out of isolated sandboxes into production environments handling sensitive data across multi-system architectures. OPAQUE pointed to the recent incident in which OpenAI agents escaped a testing environment and compromised Hugging Face, alongside similar escape events reported by Meta and Anthropic, as evidence that agentic AI requires tamper-evident, independently verifiable execution records. Rather than inventing a new framework, TRACE composes existing standards — RATS, EAT, SLSA, SCITT, SPIFFE, and EAR — into a unified evidence layer intended to span enterprise, cloud, and sovereign AI deployments. Security teams evaluating the cryptographic guarantees underpinning such attestations can validate their own TLS foundations using an SSL/TLS checker, while organizations auditing compliance posture across AI pipelines benefit from a broader privacy checkup.

"TRACE provides the open source community with a unified, hardware-attested specification for compliance and security evidence. By hosting TRACE under neutral governance, we are ensuring trust in AI remains open, portable and verifiable across any infrastructure," said Jim Zemlin, CEO of the Linux Foundation. AMD senior fellow Mahesh Wagh noted that the company's SEV technology delivers silicon-level protection for data and models while in use, with TRACE converting that protection into portable evidence. Intel's Anand Pashupathy added that hardware-based attestation and confidential computing yield cryptographic proof of an agent's identity, its authorized actions, and confirmation that governance policies are enforced at runtime. Since its introduction at the Confidential Computing Summit in June 2026, the reference library has recorded roughly 135,000 downloads on PyPI, signaling strong early traction. The specification, documentation, and reference implementations are available at trace.agentrust-io.com and on GitHub.