Researchers hacked AI hardware so a chatbot told someone with chest pain to stay home

Security firm Eclypsium published a 15-page report on Thursday showing that an attacker with access to a server's BlueField data processing unit could rewrite an AI model's weights in memory in under a minute, leaving the model file, its hash and its signatures valid. The Portland-based company ran the attack on an Nvidia GH200 Grace Hopper test system, entering through the IPMI remote-management protocol and using direct memory access to alter a running model after its integrity checks; in examples shared with CNN, a tampered model told a user with chest pain to stay home instead of going to hospital. Eclypsium CEO Yuriy Bulygin told CNN "We can't trust the [AI] model if we can't trust the infrastructure it's running on," while an Nvidia spokesperson said the company "did not identify anything the industry wasn't previously aware of" and that strong memory access protections block the attack path.

Nvidia’s GH200 Grace Hopper Superchip, the platform Eclypsium used for its test, in an Nvidia press image illustrative . Image: Nvidia Hackers who get into the hardware beneath an AI model can quietly rewrite how it answers in under a minute, without changing the model file anyone checks, security firm Eclypsium says in a 15-page research report https://eclypsium.com/wp-content/uploads/Trusted-AI-Requires-Trusted-Infrastructure.pdf published on Thursday. The Portland-based company, which sells hardware and firmware security tools, ran the attack on an Nvidia GH200 Grace Hopper test system fitted with a BlueField data processing unit DPU . In examples it shared with CNN https://www.cnn.com/2026/10/29/politics/ai-hardware-hacked-research-shows , a tampered model told a user asking about chest pain to stay at home instead of going to hospital, and another gave a far higher probability to a Chinese invasion of Taiwan. Those two results are not in the public report, which does not name the model it tested. How the attack works A DPU is a small computer on a server’s network card, with its own processor and operating system. Every big cloud uses them, and they can read and write the server’s memory directly, a feature called direct memory access DMA . Eclypsium got in through IPMI, an old remote-management protocol with known password weaknesses, then used DMA from the DPU to reach the server’s and the GPU’s memory. There it rewrote the model’s weights, the numbers that decide its answers, after the model had loaded and passed its integrity checks. The researchers trained a small add-on called a LoRA adapter to change the model’s behaviour and swapped its values into the running model, then repeated the trick on the model’s own weights. The scan ran at about 3 GB a second and the edits “were generally completed in less than a minute”, the report says. The file on disk, its hash and its signatures stay valid throughout, and the original values can be put back afterwards, leaving no trace in the usual checks. “We can’t trust the model” Eclypsium’s chief executive put the problem plainly to CNN: We can’t trust the AI model if we can’t trust the infrastructure it’s running on. Yuriy Bulygin, CEO, Eclypsium, to CNN The report’s own demo targets a coding assistant, where a small change could make it weaken a login check, switch off certificate validation or pull in an unsafe library. A planted bug “can be difficult to distinguish from a hallucination”, it says. Who could pull it off This is not a hack for amateurs. An attacker needs network access to the DPU or the server’s baseboard management controller BMC , and the server must be set up loosely: the attack relied on the IOMMU, the chip that limits what devices can touch in memory, running in “passthrough” mode, plus permissive PCIe settings. “These are not the default Linux settings,” the report says, though some operators choose them for speed. With stronger isolation, “the same direct memory path was not available.” Eclypsium told CNN that state actors such as China, Russia or the US could do it, and that it has briefed the NSA and CISA. It argues the risk is not unique to Nvidia and applies to AMD, Intel, Arm and custom chips too, though it admits it has “not demonstrated the same implementation on every accelerator architecture”. Two independent experts who reviewed the work for CNN called it credible: The attacks are fundamentally the same as any other direct memory access attacks and I don’t see any reason to doubt their findings or results. Joe FitzPatrick, hardware security researcher, to CNN What Nvidia says, and the fix “We reviewed the hypothetical scenarios and did not identify anything the industry wasn’t previously aware of,” an Nvidia spokesperson told CNN, adding that strong memory access protections block the attack path. In a joint blog post https://eclypsium.com/blog/building-trusted-ai-infrastructure/ on Thursday, the two firms stressed that operators choose how BlueField’s security is configured. The fix is mostly configuration: keep IOMMU translation switched on rather than in passthrough, turn on PCIe access controls on the DPU’s port, and block a feature called ATS that lets a device skip the memory checks. The report says BlueField-4, with those protections enforced, blocks the unrestricted path it used. Nvidia is also putting BlueField-4 at the centre of its watchdog chip for AI agents https://madrobot.blog/2026/09/28/nvidia-open-agent-safety-platform-openshell-sentry-rogue-ai-agents/ , which makes the DPU’s own security matter more. The report doubles as a sales pitch: Eclypsium sells software that, it says, checks a running model’s weights in memory. It comes a week after Symantec described a hacking agent that hijacks exposed AI models https://madrobot.blog/2026/10/22/skynet-llmjacking-ai-agent-hijacks-exposed-ai-models-symantec/ , another attack on the machinery around AI rather than the model. Why it matters AI safety checks today mostly test the model file, not the server running it, so a model that passed every check can still give a doctored answer. The attack needs access and a weak setup, but it shows that whoever controls the hardware can, in principle, control what a chatbot says. Sources: Eclypsium, Trusted AI Requires Trusted Infrastructure PDF https://eclypsium.com/wp-content/uploads/Trusted-AI-Requires-Trusted-Infrastructure.pdf ; Eclypsium and Nvidia blog post https://eclypsium.com/blog/building-trusted-ai-infrastructure/ ; Eclypsium press release https://eclypsium.com/press-release/eclypsium-and-nvidia-collaborate-to-address-emerging-ai-infrastructure-attack-surface-and-strengthen-ai-trust/ ; CNN https://www.cnn.com/2026/10/29/politics/ai-hardware-hacked-research-shows interviews and Nvidia statement .