Cortex Confidential becomes the 12th specialized model, combining confidential execution with semantic privacy intelligence for sensitive AI workloads.
San Francisco, CA (PRUnderground) October 22nd, 2026
Pervaziv AI today announced Cortex Confidential Computing, a new architecture for protecting sensitive enterprise AI workloads while they are actively being processed, and introduced Cortex Confidential, the 12th specialized model in the Cortex AI Model Ensemble.
The new capability connects hardware rooted confidential execution with semantic privacy and disclosure risk intelligence inside the Cortex Enterprise AI Control Layer. It is designed for organizations that want AI to work with private source code, customer information, production records, credentials and operational context while preserving explicit control over where that work runs and what information may leave the protected environment.
The core principle is simple:
Protect the workload. Understand the data. Keep authorization deterministic.
Encryption at rest protects stored information. Encryption in transit protects information moving across networks. Enterprise AI creates a third requirement because models, tools and applications must process sensitive information in memory. Cortex Confidential Computing is designed around that third state: data in use.
The architecture separates three responsibilities. Confidential Computing establishes whether an execution environment satisfies required trust conditions. Cortex Confidential evaluates semantic privacy and disclosure risk. Deterministic controls remain responsible for what is permitted.
That separation is intentional. Trusted infrastructure does not automatically authorize every workload. A model recommendation does not create permission. And the absence of a model warning does not independently authorize release of sensitive information.
"Confidential AI should protect more than the model call," said Anoop Jaishankar, Founder and CEO of Pervaziv AI. "Cortex connects trusted execution with privacy intelligence while keeping authorization in deterministic controls."
A Protected Mode for Sensitive AI Work
Cortex Confidential Computing is designed as a mode of the existing Cortex experience rather than a separate AI product.
For eligible workloads, an authorized user can select Confidential Mode, or an organization can require it through policy. Sensitive work can then be restricted to an approved confidential environment that satisfies required platform, workload and authorization conditions.
Modern agentic work can include retrieval, code analysis, planning, tools, terminal operations, generated files, subagents and streaming responses. Protecting only the model call would leave supporting operations outside the intended trust boundary. Cortex Confidential Computing is designed so the confidentiality requirement follows eligible work across the supported execution path.
That includes a strict operating commitment: unavailable confidentiality should result in unavailable confidential work, not a silent move to weaker infrastructure.
Four Foundations for Confidential AI
Cortex Confidential Computing is designed around four foundational capabilities: isolation, measurement, sealing and secure secret storage, and attestation.
Isolation creates a protected execution environment intended to separate sensitive processing from unauthorized infrastructure access. Measurement establishes a cryptographic identity for the software and initial state expected to run inside that environment. Attestation provides evidence about platform identity, measured state and security configuration so trust can be evaluated before sensitive information or protected assets become available. Sealing and secure secret storage help restrict access to protected secrets to an authorized workload in the appropriate trusted environment.
Together, these capabilities turn Confidential Computing from a hardware feature into an operational trust decision. Genuine hardware alone is not enough. The environment must be trustworthy, the workload must be approved, and the requested operation must still be permitted.
A High Level Trust Model Across Azure, NVIDIA and AMD
The current Cortex confidential execution design brings together Microsoft Azure confidential infrastructure, NVIDIA H100 confidential GPU capabilities and AMD SEV-SNP confidential virtual machines.
Azure provides the cloud environment and supporting trust services. NVIDIA H100 extends confidential execution into accelerated AI processing. AMD SEV-SNP establishes a protected virtual machine boundary for host side processing. Cortex connects those platform capabilities to approved workload identity, protected workflow controls and deterministic policy.
Because accelerated AI spans CPU and GPU execution, the objective is a composite trust decision in which the confidential CPU environment, confidential accelerator and approved Cortex workload participate in one protected processing model.
Cortex keeps platform trust separate from the semantic judgment made by the new model. Infrastructure establishes where sensitive work may run. Cortex Confidential helps evaluate what the information means when a proposed action could move it beyond that environment.
From Infrastructure Trust to Semantic Privacy
Confidential Computing can protect information while it is being processed. It cannot, by itself, understand what that information means.
A generated patch may contain no credential or obvious personal identifier and still reveal proprietary business logic. Several ordinary looking log fields may become identifying when combined. A connector may be approved for one class of work but inappropriate for a particular sensitive payload. An aggregate result may be suitable for release even when the underlying records are highly sensitive.
Traditional data protection controls remain important for known patterns, explicit labels, secrets and policy rules. Cortex Confidential is designed to add contextual analysis for cases where disclosure risk depends on meaning, combination, destination or surrounding context.
Its intended responsibility includes evaluating privacy and disclosure concerns involving credentials, tokens, sensitive configuration, personal information, health information, payment and financial information, customer records, private repository content, proprietary business logic, internal architecture, logs, traces, operational metadata, and destination or authorization context.
The model operates inside the confidential boundary because evaluating sensitive content should not require sending that content to an unprotected external classifier. Context minimization still applies. Protected execution is not a reason to grant unrestricted access to every repository, record or system.
Cortex Confidential Becomes Model 12
The Cortex AI Model Ensemble is built around specialization rather than asking one general model to perform every task.
Cortex Planner, introduced as model 9, added structured planning for complex engineering work. Cortex Routing Decisions, model 10, added fast operational judgments about how a request should be handled. Cortex Security Decisions, model 11, added specialized software security judgments.
Cortex Confidential becomes model 12 with a distinct responsibility: semantic privacy and disclosure risk advice inside an established confidential environment.
Routing Decisions asks what handling a request requires. Security Decisions asks whether code or a proposed change presents a security concern. Cortex Confidential asks whether content, action and destination create disclosure risk.
These judgments are complementary. A patch can be secure from a software engineering perspective while still exposing proprietary logic. A diagnostic can contain no vulnerability while including customer information. A destination can be technically reachable but inappropriate for a particular payload.
AI Advises. Policy Authorizes.
One of the most important design principles behind Cortex Confidential is that the model does not become a cryptographic authority or an independent enforcement engine.
It does not establish Confidential Mode. It does not attest hardware. It does not release protected keys. It does not grant access to a destination. It does not create authorization.
Instead, it provides structured risk advice that deterministic controls can interpret alongside authenticated permissions, existing security checks and organizational policy.
The governing principle is clear:
AI can increase protection, but it cannot create authorization.
A repository comment, document, diagnostic message or tool response may claim that an export is approved. That statement remains content. It is not an authenticated grant of permission.
Likewise, the absence of a model warning does not authorize release. Where policy requires additional assurance, uncertainty or unavailable advice should lead to a protected outcome such as denial or review rather than automatic permission.
Measured Validation Results
The latest Cortex Confidential candidate has been evaluated on a governed validation suite covering structured outcomes, risk classification and critical egress behavior.
Measured results include 100 percent structured contract validity, 100 percent outcome accuracy, 99.4 percent exact risk taxonomy match, zero critical missed egress cases, zero percent underclassification and overprotection, 100 percent recommendation precision, and expected calibration error below 0.2 percent.
Targeted regression suites also completed without critical misses. End to end integration testing confirmed operation within the Cortex engineering workflow on the H100 environment.
These are measured validation results, not guarantees across every production workload. Different repositories, languages, destinations, user behavior and operating conditions can change task difficulty. Broader operational evidence remains necessary before production influence on enforcement.
Evaluation and Readiness
Cortex Confidential is being evaluated within Cortex engineering workflows, with a focus on detection quality, reliability, and operational readiness. Deterministic policy continues to govern access, actions, and data release.
Broader deployment remains subject to operational evaluation, qualification of the confidential execution environment, and production release approval.
Confidential capable hardware alone does not establish that the application, workflow, failure behavior and recovery paths preserve the intended security boundary. Qualification also evaluates protections during normal operation, failure and recovery.
Built on Confidential Computing Experience
Pervaziv AI's work in Confidential Computing is informed by deep prior experience in the field as well as the company's continuing research into protected AI and application security.
Founder and CEO Anoop Jaishankar previously worked at VMware, including in its Office of the CTO, and is a named inventor on granted U.S. patents assigned to VMware involving Trusted Execution Environments. Those patents address cross architecture TEE migration and enclave deployment across different TEE hardware backends.
This background provides relevant domain experience in fundamental Confidential Computing challenges, including trusted execution boundaries, heterogeneous secure hardware environments, and protecting workloads as they operate across infrastructure.
Separately, Pervaziv AI has continued exploring these challenges in the context of modern AI and software security. Earlier Pervaziv AI research examined how Confidential Computing, Trusted Execution Environments and remote attestation can help protect sensitive application security workflows where source code, secrets and internal system context must be processed without unnecessarily exposing data in use.
Cortex Confidential Computing extends that Pervaziv AI research direction into agentic AI. It connects confidential execution with workload trust, semantic privacy intelligence and deterministic authorization across the surrounding AI workflow.
A Stronger Connection Between AI and Confidential Computing
For developers, Cortex Confidential Computing is intended to create a protected path for sensitive engineering work without requiring a separate coding experience.
For security teams, it connects evidence about the execution environment with contextual analysis of potential disclosure. For platform teams, it creates clearer responsibility boundaries across cloud infrastructure, confidential hardware, approved workloads and policy.
For organizations, it brings together two forms of assurance that neither hardware nor AI can provide alone.
Confidential Computing protects sensitive information while it is processed. Cortex Confidential adds intelligence about what that information means when it is about to move. Deterministic policy remains responsible for what is allowed.
The addition of Cortex Confidential extends the ensemble without making a model the source of trust.
That is the larger direction behind Cortex: use the right intelligence for the right responsibility, keep control explicit, and make advanced AI usable in environments where security, privacy and accountability matter.
Trust should be measured. Sensitive execution should be isolated. Secrets should remain protected. Model judgment should remain separate from authorization.
Third Party Products and Trademarks: Microsoft and Azure are trademarks of the Microsoft group of companies. NVIDIA is a trademark and/or registered trademark of NVIDIA Corporation. AMD is a trademark of Advanced Micro Devices, Inc. Other third party names and trademarks are the property of their respective owners. References to Microsoft Azure services, NVIDIA H100 and attestation technologies, and AMD SEV-SNP describe platform capabilities and their role in the architecture discussed here. They do not imply affiliation, sponsorship, endorsement, or approval of Pervaziv AI or Cortex. Third party products and services are subject to their respective terms, availability, licensing requirements, and applicable fees.
