Attested #2: Phala publishes its dstack post-mortem, DeepSeek 1017 spreads (not always into an enclave)

This week in confidential inference · Oct 19–27, 2026

Two things worth your time this week. Phala wrote up how an attacker read secrets out of other tenants' containers on its TEE cloud, and it's a good read precisely because the TEE held and the plumbing around it didn't. And the DeepSeek checkpoint that only Tinfoil had in a measured enclave build in #1 is now listed by most of the providers I track, which is a nice test of how carefully you read a model page.

---

Phala's guest-agent incident: the enclave held, the plumbing didn't

Phala published a post-mortem on Oct 19 for an attack on Phala Cloud between Oct 8 and Oct 12.

Short version. dstack runs a guest-agent inside every CVM, and Phala's gateway exposes its read-only endpoints publicly so anyone can fetch the TDX quote and measurements. Same agent also served container logs. In dstack OS images v0.3.1 through v0.6.0 the /logs/<container> endpoint passed the container name straight into the Docker API path, so a crafted name turned a log read into a container inspect, which returns Config.Env. Environment variables. Where a lot of apps keep their secrets.

The attacker started from inside a customer app that runs user-submitted code, reached an unauthenticated host management API over the CVM's user-mode network, changed firewall rules on that host, pulled a shared gateway admin token out of the gateway container's config and used it to make 63 changes to DNS-credential and ACME settings on one gateway. Separately, it read logs and env vars from other tenants' apps over the public route. Phala caught it on Oct 12 at 19:28 UTC, about 21 hours after the first scan from inside that app (Oct 11, 22:03, per its timeline), when a certificate reconciliation check started failing on the tampered gateway.

What Phala says was not touched: TEE and KMS keys, sealing keys, the on-chain KMS, customer disks, host SSH. Fixes shipped Oct 13 in dstack v0.6.1 and v0.5.12. Yes, the same v0.6.1 I told you to patch to in #1 for the SEV-SNP certificate bug. Turns out it fixed more than that. Everyone has to be on a fixed image by November 19; from Nov 20 Phala auto-upgrades remaining v0.5.x/v0.6.0 CVMs and retires v0.3.x ones (enterprise plans are exempt from that retirement). Notified customers should rotate whatever was in their env vars.

Why it matters: nothing here broke TDX. It broke the management agent, the host network isolation and a token that several gateways shared, plus a console template that set public_logs=true by default while dstack itself defaults it off (Phala lists making it opt-in as still in progress). And the vulnerable guest-agent was part of the measured image: genuine, attested code doing exactly what it was built to do, badly. The secrets were sitting in the env of the workloads, readable through a side door. If your threat model ends at "it's in a TEE", this is the counterexample. Credit to Phala for publishing this much detail: timeline, root causes, the lot.

If you run on dstack yourself: check your OS image version and whether public_logs is on.

DeepSeek 1017 spreads. Read the fine print

In #1 only Tinfoil had a measured 1017 build. A week later most providers I track list it, and the labels mean different things (model APIs checked Oct 27):

• Tinfoil underneath: Redpill and NanoGPT both list theirs as running through Tinfoil (Redpill model API). Phala says it's "served inside a TDX-attested GPU TEE". I checked on Oct 27: the route I tested is Phala's TDX gateway passing requests (signed receipt and all) to Tinfoil, whose GPU enclaves matched Tinfoil's signed 1017 build, so attested yes, a Phala GPU TEE no.
• Not attested: NEAR AI serves it through OpenRouter ZDR (verifiable: false in its model API), Chutes lists it as non-TEE pay-as-you-go (model API), and Venice and PPQ's explicit 1017 ID aren't TEE routes either.
• Maple and Prem list it as confidential. My monitor has no per-model check for Maple yet, and Prem's 1017 route passes hardware and TCB but isn't tied to a measured 1017 build (Oct 27). Correction to #1: Prem's free cached tokens on confidential models now run to Dec 1, per its model table.

Why it matters: "available on X" isn't "available inside X's enclave". The model API usually tells you which one you're getting.

---

What we measured

Catalog changes this week

• Chutes is ending monthly plans and adding pay-as-you-go models that aren't TEE (Oct 26 post), and says TEE inference continues. Four of its TEE models were also gone from its public catalog in my Oct 27 check, unexplained so far.
• Tinfoil and NEAR AI added "decision" models that return probabilities and scores instead of text (Tinfoil model catalog).
• NEAR AI's new GLM 5.3, listed as attested, fails my check: the challenge nonce doesn't come back, so I can't tell a fresh quote from a replayed one (NEAR attestation page, Oct 27).

Attestation

Across all tracked checks, 68 of 94 pass hardware and TCB, and 0 pass every applicable gate (attestation monitor, Oct 27 15:16 UTC). Workload identity (23 of 94), source provenance (1 of 94) and request route (7 of 93) are still where almost everyone stops. All 7 routes are Tinfoil models; at 07:00 UTC their probes were rate-limited and the count was 0. In #1 it was 55 of 97, but don't read that as providers getting better: I fixed parts of my verifier on Oct 20 and Chutes' TEE list shrank (see above), so it's not like for like. One provider that does look different: NEAR AI passes hardware and TCB on 9 of its 10 checks, up from 1 of 9 in #1.

Post-quantum TLS

In the Oct 27 checks, 10 of 11 provider endpoints negotiated hybrid X25519MLKEM768. New since #1: Chutes, which negotiated no hybrid group in run #32 on Oct 18 and now does on llm.chutes.ai. NEAR AI is the remaining one with no hybrid group. All 11 still accept a classical handshake, and for all ten hybrid ones the site marks the result edge-only: I can't prove TLS terminates inside the attested TEE. So still nobody, on current data, with a post-quantum TLS channel that provably ends in the enclave. App-layer encryption is a separate thing (Chutes' attestation records ML-KEM-768 E2EE keys bound to the report). Raw data: /api/providers.json.

---

Elsewhere

Cloudflare leaked prompts between customers. Its post-mortem (Oct 26): between Aug 27 and Sep 9, 155 responses from GLM 5.3 on Workers AI contained pieces of other customers' recent requests, all to prompts over 681,280 tokens. The prefill GPUs' KV cache pool was smaller than the advertised 1M context, and in split prefill/decode mode SGLang passed a rejected request on to decode anyway, which read pages still holding earlier requests' data. Cloudflare says it found no evidence of deliberate exploitation; the upstream fixes shipped in SGLang v0.5.20 through v0.5.22. Why it's here: an enclave isolates the host from the workload, not one request from the next. If many tenants share one attested engine, a bug like this leaks just the same, inside a perfectly valid attestation. Same lesson as Phala, one layer up.

Tinfoil threw out OVMF. Their writeup (Oct 25) replaces about a million lines of C firmware with roughly 300 lines of assembly. Page tables, ACPI tables, kernel, initramfs and command line are built ahead of time and measured at launch (MRTD on TDX, launch digest on SEV-SNP), so the firmware no longer measures anything and only checks two host values, CPU count and memory map. Their argument: build tool bugs are in the audit TCB, runtime parser bugs are in the attack surface. I like it. It's also an honest trade, their firmware refuses to boot machine shapes they didn't build for. The code is public on a branch of cvmimage; the post doesn't say whether it's what production runs today. Timely too, given the EDK II pre-boot RCE in the PXE driver published Oct 22. Why does VM firmware have a network stack? Exactly.

Google made Confidential G4 GA. NVIDIA RTX PRO 6000 Blackwell with NVIDIA confidential computing, on Compute Engine and GKE, in 36 zones (Google Cloud blog, Oct 21). Confidential Space support for it is "rolling out to general availability in the coming weeks". More rentable confidential GPU capacity is what this market is short of.

Cohere put Model Vault behind attestation. Confidential Computing on Model Vault is in public beta since Oct 22: H100s in confidential mode on Azure, requests encrypted end to end into the enclave, attestation the customer checks before sending (Cohere blog). Free for design partners during the beta, otherwise "contact Cohere" for rates, which keeps it off my price comparison. Same week, NVIDIA announced Confidential Bare Metal (Oct 21), for model builders who want to run their own host stack on third-party GPUs. Cohere says it plans to use it, and Google says it's bringing it to its GB300 instances.

Microsoft said the quiet part. Its Azure + NVIDIA + Protopia reference architecture (Oct 19) has this line: "an attested GPU does not establish how a gateway or cache handles requests." See the two items above.

Missed last time: OPAQUE announced on Oct 13 that its team is joining Anthropic, and its site now says OPAQUE Systems is winding down; its open-source projects continue under AgenTrust. Reporting (not the companies' own posts) says Anthropic licensed the technology; neither has said if or how it ends up in Claude.

Releases. Privatemode v1.60.0 (Oct 22) fixes GLM-5.3 empty responses and moves to Contrast v1.25.1, a patch release that fixes govulncheck findings and blocklists the compromised eMudhra certs. NanoGPT added Tinfoil's PII redaction (Oct 27), with detection running in an attested enclave before your text reaches the model provider. tinfoil-go shipped v0.16.4 and v0.17.0 release candidates. Nothing new from nvtrust.

---

New names I'm looking at

Surplus (surplusllm.com) says private inference is live (Oct 21): 22 confidential models on Intel TDX + NVIDIA confidential GPUs through Phala, prompts encrypted client-side (if you use its E2EE headers; without them, its own privacy page says the gateway relays plaintext). Per its X bio it's paid in USDG on Robinhood Chain, so it's another crypto-paid router on top of Phala, same pattern as Umbra in #1. Not verified.

VoltageGPU (voltagegpu.com) is mostly a different kind of thing. Its site says it rents Intel TDX confidential VMs with H100, H200 and RTX PRO 6000 GPUs, that tenants generate the TDX quote themselves on its Confidential VM tier, and that it has run NVIDIA GPU attestation from inside its VMs on some of those configurations (not yet on B200/B300). That's the "run it yourself" option. It also advertises an OpenAI-compatible API with 10 TEE models, which I'll look at separately before it goes anywhere near the price comparison. Not verified either.

---

That's #2. Attested comes out weekly. If someone forwarded this to you, subscribe here so the next one lands in your inbox.

Every issue, plus the live provider data behind it, is archived at confidentialinference.net. You can follow attestation changes as they happen via the alerts RSS.

If you run one of these services and I got something wrong, reply to this email and I'll fix it in public.

Aljaz