CoreWeave's GTC Berlin double play: a six-layer Zero Trust AI Framework and one-command templates for robotics and AV

• Who: CoreWeave, Inc. (Nasdaq: CRWV), announcing on October 21, 2026 at NVIDIA GTC Berlin in Berlin.
• What: the CoreWeave Zero Trust AI Framework — six layers of customer-controlled security — and CoreWeave Physical AI Launchables, a catalog of one-command Templates for robotics and AV development.
• Six layers: Zero Key Access (Remote Key Encryption), Zero Node Access (Support Access Management), Zero Trust Infrastructure (hardware attestation), Zero In-Use Access (NVIDIA third-generation Confidential Computing), Zero Model Data, and Zero Trust Network Encryption (IEEE 802.1AE MACsec).
• Launchables catalog: five tools at launch — NVIDIA Isaac Sim (4 templates), CARLA, MuJoCo, NVIDIA AlpaSim, NVIDIA Cosmos 3 — each run starting with one command.
• Roadmap: HGX Rubin NVL8 comes to CoreWeave Cloud in Q4 2026; CoreWeave also intends to support the NVIDIA OpenShell Reference Architecture.

CoreWeave brought two announcements to NVIDIA GTC Berlin. The AI cloud provider used the show to unveil a six-layer Zero Trust AI Framework aimed at enterprises that love its NVIDIA-powered speed but hesitate to hand sensitive data to a third party — and to launch Physical AI Launchables, a catalog of tested, one-command templates for the robotics and autonomous-vehicle tools teams already use.

The security half of the announcement is the meat. The CoreWeave Zero Trust AI Framework gives customers authority over access to their models, data, and runtime environments, rather than asking them to take CoreWeave's word for how it all gets handled. "Security for AI workloads cannot rest on a provider's promises about its own behavior," said Chen Goldberg, the company's executive vice president of product and engineering, in the October 21 release. "Our customers are running their most valuable models against their most sensitive data. They should not have to take our word for how we handle either."

The six layers, in plain terms

Each layer removes one piece of trust CoreWeave asks customers to extend:

• Zero Key Access: Remote Key Encryption lets customers use keys from the infrastructure they already run — a software key manager, a hardware security module, or another cloud's KMS — for data at rest, without handing key authority to CoreWeave or rebuilding key-management workflows.
• Zero Node Access: Support Access Management makes provider access an explicit customer decision for a defined operational need; it ends when the authorized activity ends.
• Zero Trust Infrastructure: attestation services verify the infrastructure executing a workload using hardware roots of trust, and can drive automated trust decisions — requiring valid evidence before secrets are released, data decrypted, or execution allowed.
• Zero In-Use Access: confidential-computing protections for data while it is being processed.
• Zero Model Data: CoreWeave, which sells cloud capacity rather than its own models, says it does not use customer prompts, training data, model weights, or outputs to train or improve its own models.
• Zero Trust Network Encryption: IEEE 802.1AE MACsec encrypts data moving across CoreWeave's backbone.

Confidential computing is the roadmap

CoreWeave says it intends to extend NVIDIA's third-generation Confidential Computing across CPUs, GPUs, and the NVIDIA NVLink fabric — including on NVIDIA HGX Rubin NVL8, which is coming to CoreWeave Cloud in Q4 2026 and is built for agentic AI. The plan starts with select bare-metal environments and extends to Kubernetes-based AI workloads. CoreWeave also says it intends to support the NVIDIA OpenShell Reference Architecture, which pairs Rubin GPUs with Vera CPUs running the OpenShell secure runtime.

The Zero Model Data pledge deserves its own read. As agents retrieve context, call tools, and trigger actions across other systems, sensitive data moves through prompts, embeddings, weights, traces, and outputs — and CoreWeave is betting that "we can't see your data" is a stronger enterprise pitch than cheaper GPUs. Confidential computing on the roadmap is the hardware-backed proof of that claim.

Physical AI Launchables: stop rebuilding the environment

The second announcement targets a different pain. "The hard part of robotics and AV engineering is rarely perception, motion planning, or control systems," CoreWeave said in its release. "It is the week before the run, when someone has to stand up the environment, configure storage, and wait on the scheduler before the first job can start."

Physical AI Launchables packages the workloads these teams run most often as Templates, built and tested by CoreWeave engineers, so each run starts with one command instead of a rebuild. At launch the catalog covers five tools: NVIDIA Isaac Sim (four templates, including a Franka pick-and-place task, a forklift-and-pallet scene with labeled synthetic data, vehicle-dynamics variants with driving and braking trajectories, and a multi-camera warehouse with workers and incidents), CARLA (a driving-scenario matrix), MuJoCo (a GPU-parallel reinforcement-learning sweep on MuJoCo Warp plus a RoboCasa kitchen task), NVIDIA AlpaSim (closed-loop evaluation of NVIDIA's Alpamayo driving model over reconstructed real scenes), and NVIDIA Cosmos 3 (a text-to-video scenario generator on Cosmos 3 Nano). Every tool also ships a blank template for workloads the catalog doesn't cover, and a Voxel51 FiftyOne template is listed as coming soon. Settings change as name=value pairs on the command line, and the catalog integrates NVIDIA Cosmos Data Factory agentic skills for auto-labeling, data curation, retrieval, and generative augmentation across video, image, and text. Teams point each Template at their own scenes and data and run it against reserved capacity for a sustained program or as a burst job to test a single idea.

Why it matters

Together, the two announcements move CoreWeave further from "rent our GPUs" toward a compliant, plug-and-play platform for real-world AI — security architecture on one side, engineering productivity on the other. The audience is regulated industry: attestation, confidential computing, and customer-held keys are aimed squarely at the security reviews that stall AI deployments in banking, health, and government. Whether architecture beats assurances, as Goldberg claims, will be tested the first time a customer audits what the provider never touched.