CoreWeave launches AI security framework to put cloud access under customer control

CoreWeave is putting customer-held encryption keys and customer-approved provider access at the center of its AI cloud security pitch. On October 21, 2026, it launched the CoreWeave Zero Trust AI Framework at NVIDIA GTC Berlin, grouping six protections intended to limit the provider’s access to customers’ models, data and computing environments.

The framework lets customers bring security systems they already operate to CoreWeave Cloud, rather than rebuild around the provider’s model. Its six layers cover encryption keys, administrative access, infrastructure verification, protection during processing, customer-data use and network encryption. But they are not all the same kind of safeguard: some restrict access technically, one states a data-use commitment, and part of the processing protection remains planned.

Remote Key Encryption addresses control over stored data. CoreWeave says customers can use their existing key systems, including software key managers, hardware security modules or a key-management service in another cloud. Customers retain authority over the keys without transferring that authority to CoreWeave. The stated benefit is continuity: existing key-management workflows, policies and governance processes can carry over to sensitive training and inference workloads.

Support Access Management tackles a different question: when the cloud provider can enter the customer’s computing environment. Customers authorize access for a defined operational need, rather than leave it continuously available. That access ends when the authorized activity finishes. Key ownership and support approval therefore address separate points of control—one over the means to unlock stored data, the other over provider access.

Security for AI workloads cannot rest on a provider's promises about its own behavior

Chen Goldberg, CoreWeave executive vice president of product and engineering

The infrastructure-verification layer adds a check before sensitive work proceeds. CoreWeave says its attestation services use hardware-backed evidence to verify the infrastructure running a workload. That evidence can become a condition for releasing secrets, decrypting data or allowing execution. A workload, key-management system or orchestration layer—the software coordinating computing tasks—can require valid evidence before taking those steps.

Protection while data is being processed has a different status. CoreWeave intends to extend NVIDIA’s third-generation Confidential Computing across CPUs, GPUs and NVLink, the connection between processors. This is designed to protect models, data and code while they are in use, including on NVIDIA HGX Rubin NVL8 systems. CoreWeave expects those systems on its cloud in the fourth quarter of 2026.

The confidential-computing rollout is planned to begin in select bare-metal environments, then extend to other deployment models, including Kubernetes-based AI workloads. CoreWeave also intends to support NVIDIA’s OpenShell Reference Architecture, which combines Rubin GPUs and Vera CPUs with the OpenShell secure runtime. These are implementation plans within the framework, not confirmation that the full processing-protection layer is available across every deployment.

The remaining two layers address what happens to customer information and how it travels. They also show the distinction between a commitment about provider behavior and an infrastructure mechanism:

• Customer-data use: CoreWeave says it does not use customer prompts, training data, model weights or outputs to train or improve its own models. It presents its role as an AI cloud, rather than a competing model provider, as part of this commitment.
• Network transport: CoreWeave says it uses MACsec, the IEEE 802.1AE encryption standard, to protect data moving across its backbone. It describes that protection as built into the network architecture, rather than a responsibility placed on each application team.