Intel has announced it will discontinue its Software Guard Extensions (SGX) after the upcoming Xeon Diamond Rapids generation, concentrating its confidential computing efforts on Trust Domain Extensions (TDX). The company says it will continue supporting existing SGX-enabled platforms into the early 2030s, giving customers time to migrate. Intel did not cite security concerns as the reason, despite both technologies having faced vulnerabilities over the years.
The key difference is that SGX protects code and data inside application-level enclaves, while TDX isolates entire virtual machines from the host environment, including the hypervisor and other VMs. TDX can protect existing workloads inside confidential VMs without extensive application changes, making it more attractive to cloud service providers that run large numbers of virtual machines. Intel believes future demand will favor this VM-level isolation model.
Intel plans to expand TDX with additional security features, including TDX Connect for trusted I/O, post-quantum cryptography, and enhanced attestation mechanisms. The company also sees TDX as a fit for agentic AI workloads, where autonomous agents can run in separate hardware-isolated VMs on shared infrastructure. TDX is already available through major cloud providers such as Alibaba Cloud, Google Cloud, IBM Cloud, Microsoft Azure, and Volcano Cloud, with Red Hat, Canonical, and VMware adding support for private and enterprise deployments.