The hardware that runs AI models can be attacked so that a chatbot gives wrong or dangerous answers, according to new research from the security firm Eclypsium, shared first with CNN and described on Eclypsium's own blog, which was published jointly with Nvidia. The key finding: with privileged access to a DPU or a baseboard management controller, an attacker can change a running model's weights in memory while the model file on disk, its hash and its signature all remain valid. Nvidia says the scenarios were already understood and that strong memory-access protections block the attack path.
This is the kind of story where the headline sounds like "AI chips can be hacked to lie," and the reality is narrower and more useful. Below: what was shown, which conditions it needs, what Nvidia and independent experts said, and what operators should check.
TL;DR: what is confirmed
| Question | Answer |
|---|---|
| Who did the research | Eclypsium (Portland, security firm staffed by former Intel hardware engineers), with Nvidia as a partner on the report |
| What was shown | Runtime tampering of a model in memory through a DPU or BMC, changing answers |
| Demonstrated on | An Nvidia computing platform; Eclypsium says it is not unique to Nvidia |
| Time to attack | Under a minute, per CNN reporting of the researchers |
| Preconditions | Network access to a DPU or BMC; certain security configurations disabled; technical know-how |
| Who could do it | State actors, per Eclypsium; AI agents can help with the know-how, per CNN |
| Nvidia's position | Nothing the industry was not aware of; memory access protections block the path |
| Independent review | Two hardware security experts told CNN the findings are credible |
| Agencies briefed | The NSA and CISA, per Eclypsium executives |
What exactly did the researchers demonstrate?
CNN's account, by Sean Lyngaas, says the researchers subverted answers to sensitive national security and personal health questions. In one case they "vastly increase[d]" the probability an AI model assigns to a Chinese invasion of Taiwan by remotely tampering with the weights. In another, a model on the tampered hardware told a user seeking advice for chest pain to stay home instead of going to the hospital.
Eclypsium's post adds the key technical idea. Normal integrity checks verify the stored model: the file, its hash and its signature. In the demonstration, "the model file, its hash and its signature all remained valid while the model running in memory behaved differently." The company produced three video demonstrations of runtime manipulation: a national security scenario, an enterprise software development example and a personal healthcare example. We have not watched or independently reproduced them, and the full technical report is gated behind Eclypsium's download page.
How does the attack work, and what does it need?
A chip in front of three server towers, picturing the AI data center hardware stack under a model
According to CNN, a DPU is a system on a chip that helps run data centers, and a BMC is a small computer used to manage servers remotely. With access to the DPU, an attacker "can read and modify code and data in the machine's memory," which changes the model's behavior. The attacker generally needs to be on a network with access to a DPU or a BMC, and certain security configurations must be disabled.
Eclypsium's blog explains why those components matter: DPUs, GPUs and management controllers can read and write system memory directly through direct memory access (DMA). The company's recommended host controls are IOMMU translation, PCIe Access Control Services and Address Translation Services. An independent hardware security instructor, Joe FitzPatrick, told CNN the attacks "are fundamentally the same as any other" DMA attacks and he saw no reason to doubt the findings. Dominic Rizzo of the Institute for Security and Technology called it "a pretty general attack path on modern infrastructure" whose solutions "have to start much deeper in the stack."
CNN also notes that this summer, researcher HD Moore disclosed multiple BMC vulnerabilities that offer a way into the sensitive systems in this research. That ties the attack to a real, known entry point rather than a purely theoretical one.
What does Nvidia say?
A spokesperson told CNN: "We reviewed the hypothetical scenarios and did not identify anything the industry wasn't previously aware of," and added that strong memory access protections can block the attack path. Nvidia said it welcomed working with Eclypsium. Eclypsium said in a statement that the effectiveness of controls "depends on how they are configured and used."
Both statements can be true at once, and that is the practical lesson. The risk is not that a default, fully hardened deployment falls to a one-minute hack; it is that real data centers vary, protections can be turned off for performance or convenience, and few operators verify them.
Nvidia's September announcement of a security platform for agents is relevant context. Our explainers on Nvidia's open agent safety platform OpenShell and Sentry and how Sentry uses BlueField-4 for hardware agent security describe the DPU-based monitoring layer, which Eclypsium's post says is exactly why the DPU itself must be secured.
Why does this matter beyond data centers?
Most AI safety discussion concerns model behavior, alignment and prompts. This research targets a layer below all of that. If the infrastructure is compromised, the model's guardrails do not matter, because the attacker changes the numbers the guardrails run on. Eclypsium's Yuriy Bulygin put it to CNN: "We can't trust the [AI] model if we can't trust the infrastructure it's running on."
It also connects to a pattern we have been tracking: Satya Nadella's call to assume AI models may be compromised and build an emergency brake and our running October 2026 list of cyberattacks and AI-run exploits. Those posts are about agents and attackers; this one is about the machines underneath.
Note the sourcing. Eclypsium sells infrastructure assurance products, and its post is a co-authored piece with Nvidia that promotes its platform alongside BlueField. That does not make the findings wrong, and independent experts told CNN they were credible, but it does mean the framing comes from a vendor with something to sell.
What is not confirmed?
- Real-world exploitation. Neither CNN nor the Eclypsium post reports an actual attack on a production AI service. This is a demonstration.
- Exact conditions and success rates. Which configurations were disabled, and how reliably the attack works across setups, is in the technical report, which we could not read.
- The "vastly increase" figure. CNN does not give the before and after probabilities for the Taiwan example.
- Other vendors. Eclypsium says other hardware is affected in principle, but the demonstration was on Nvidia.
- Responses from model makers. CNN said it asked Anthropic and OpenAI, whose models run on Nvidia chips, and had not published their replies.
- Government comment. CNN asked the NSA and CISA for comment; none is included.
What should operators do?
Eclypsium's blog recommends moving from assumed trust to verifiable trust. In practice, that means:
- Verify memory protections. Confirm that IOMMU translation, PCIe Access Control Services and Address Translation Services are enabled where your platform supports them, rather than assuming defaults.
- Inventory DPUs, GPUs and BMCs. Treat each as an asset with its own firmware version, configuration and owner, inside vulnerability management.
- Patch management controllers. BMC flaws disclosed this summer are a named entry point. Keep the management network isolated.
- Monitor management telemetry. Include BMC and Redfish logs in security monitoring.
- Reassess after incidents and before reassigning hardware. These components persist across operating system reinstalls.
- Check runtime, not just storage. Boot-time measurement and a file hash do not prove the copy in memory is unchanged; look for continuous verification from independent vantage points.
- Contain agents separately. Even trusted hardware cannot make a misbehaving agent safe. AgentBeam is the agent security platform from the explainx.ai team that stops AI agents before they take dangerous actions, and our guide to Hugging Face SafeAgents as a local proxy shows a free option for coding agents.
Agents that act on your behalf need rules. See how explainx helps secure your agents →
What should ordinary users take from this?
Not panic. For a person using a chatbot, nothing here suggests that ChatGPT or Claude answers you are being tampered with today. The research describes a targeted attack by a capable actor with network access to specific hardware in specific configurations. The sensible habit is the old one: for medical, legal or safety decisions, do not rely on a single AI answer, and verify with a professional. Cloud providers and AI labs are the ones who need to act, and the research is aimed at them.
Bottom line
Eclypsium and Nvidia have documented a credible class of attack in which the model on disk looks fine while the model in memory is not. The attack needs privileged hardware access and disabled protections, Nvidia says it is a known risk with known mitigations, and independent experts call it a general DMA-style attack path. The useful takeaway for builders and operators is to verify hardware configuration and monitor below the operating system, because model-level safety cannot compensate for a compromised foundation. We will update this post if the technical report, Nvidia guidance or lab responses add detail.
Related reading
- Nvidia's open agent safety platform: OpenShell and Sentry
- How Nvidia Sentry uses BlueField-4 for hardware agent security
- Nadella: assume AI models are compromised
- October 2026 cyberattacks list
- Nvidia confidential bare-metal for European AI clouds
- Hugging Face SafeAgents local proxy
Details reflect CNN and Eclypsium reporting of October 29, 2026 and may change as Nvidia, labs and agencies respond.