How Bittensor Is Building Confidential AI Compute With KubeTEE AI (SN90)

Most of us use AI by sending data or models to external servers and simply hoping for the best. Under this model, the provider can still see what is running in memory, pricing is rarely transparent, and verification usually means trusting the operator’s word.

KubeTEE (SN90) takes a different approach by combining decentralized GPU infrastructure with hardware-backed security. Built as Bittensor Subnet 90, it turns distributed GPU clusters into a confidential AI factory where inference, agents, batch jobs, image generation, and video generation run inside hardware-secured Trusted Execution Environments (TEEs).

The host is prevented from reading protected workloads, while remote attestation allows users to verify that the environment meets the required security conditions.

Inside KubeTEE’s AI Factory

KubeTEE positions itself as the AI Factory of the Bittensor network, providing several types of AI workloads through its decentralized infrastructure:

1) Confidential inference and model serving (including NVIDIA NeMo microservices and NIM models where the stack allows)

2) Batch jobs such as fine-tuning and multi-step pipelines.

3) Image generation (FLUX.2-klein-4B went live around mid-September 2026)

4) Video and audio generation (MiniMax-H3 followed shortly after)

Provided by KubeTEE with Minimax-H3 in TEE https://t.co/7JPwQg1yxD

— KubeTEE AI (@KubeTEEAI) October 14, 2026

KubeTEE also routes spare cluster capacity through SayGM (Subnet 28), giving buyers access to models such as the GLM series and Ornith-1.5-397B inside TEEs. Factory workloads retain priority, while idle capacity is made available through the public gateway.

Users can explore the live services and recycled revenue figures on the KubeTEE dashboard.

Why It Exists

Three problems keep showing up in both traditional clouds and many decentralized networks:

1) Operators can sometimes inspect data while a job is running

2) Users rarely get cryptographic proof that the right code was used

3) It is hard to compare quality and price across providers

KubeTEE tries to close those gaps with hardware isolation (Intel TDX or AMD SEV-SNP), Kata Containers, and Confidential Containers. Miners are scored on readiness, successful attestation, job quality, and competitive pricing.

These criteria also place KubeTEE in a wider market that includes Targon (SN4), Lium (SN51), and Chutes (SN64).

How It Works

For users, KubeTEE aims to provide a familiar experience through its LiteLLM gateway at llm.kubetee.ai, which supports OpenAI-compatible calls, virtual keys, budgets, and spend tracking. 

Behind the scenes, the flow looks like this:

1) A request arrives at the attested gateway.

2) The control plane (RKE2, Rancher, Trustee/KBS, Armada) routes it.

3) The job runs on a miner cluster that is tied to a permanent Bittensor hotkey

4) Pods run inside confidential runtime classes. TLS credentials are only issued to guests that have passed attestation and have debugging turned off.

5) Validators score the clusters and set weights accordingly.

The full technical description and open-source code are available in the KubeTEE-AI GitHub repository.

Inside The Architecture: How KubeTEE Secures Compute

KubeTEE uses a multi-cluster design where one control plane handles scheduling, attestation, and the public gateway, while Independent miner clusters supply the actual confidential GPU capacity.

Everything runs on open-source building blocks (RKE2, Rancher Fleet, Armada, LiteLLM, Kata, CoCo). The project is part of the NVIDIA Inception Program and works directly with Intel and NVIDIA engineers.

Miner onboarding is still hand-reviewed during Early Access, though the first external production miner is already live with a multi-node H100/H200 cluster.

The security model rests on two things: 

1) Hardware isolation so the host cannot read memory.

2) Remote attestation so callers can check the proof. 

KubeTEE has also said its stack avoids certain kernel-level attack surfaces found in ordinary virtualization; however, as with any security claim, its validity depends on the attestation evidence provided by the system itself.

Our Confidential Computing tech stacks are NOT vulnerable to the Vghost attack surface This is the advantage of TEE https://t.co/1bNL6qimq4

— KubeTEE AI (@KubeTEEAI) October 14, 2026

What KubeTEE Adds To Bittensor

Most Bittensor subnets focus on models or specific tasks, but KubeTEE focuses on the production environment needed when data or model weights must remain protected. 

This gives the network a practical way to offer confidential capacity that can be priced, evaluated, and verified.

It also connects with other parts of the ecosystem. Spare capacity already flows into SayGM, creating a practical link between KubeTEE’s infrastructure and another subnet’s model access. This gives the network a way to reuse available compute while extending confidential execution to more services.

Can KubeTEE Scale Confidential AI?

KubeTEE is still in Early Access, with permissionless miner registration, broader multi-cluster batch scheduling, agent-driven job submission, and more flexible billing (Alpha, TAO, stablecoins) on its roadmap. The project reports that its factory is already serving external demand and recycling the resulting revenue on-chain.

Its next stage will depend on attracting more independent clusters, keeping prices competitive, and demonstrating that its attestation and scoring systems remain reliable as usage grows. With the code, gateway, and on-chain metrics available publicly, users can follow how the network performs as it expands.

KubeTEE is working to make confidential AI production a normal, verifiable service, giving developers a way to access distributed compute while keeping sensitive workloads protected. 

If it can maintain that security as more miners and users join, it could give Bittensor a stronger foundation for serving AI applications that cannot afford to expose their data or models.