AI Hardware Can Be Hacked to Change Chatbot Answers, Researchers Warn — Without Touching the Model File

SAN FRANCISCO — The hardware underneath a chatbot can be hacked so that the chatbot gives wrong and even dangerous answers — without anyone changing the model itself. That is the warning from new research published on October 29, 2026, by the Portland-based security firm Eclypsium, which demonstrated how a compromised piece of data-center infrastructure could quietly alter a running artificial intelligence model in memory, while the model's stored files, hashes and signatures still looked perfectly valid.

The finding shifts attention away from the familiar debate about what AI companies put into their models and toward the machines those models run on: chips, memory, firmware, data processing units and the small management computers that keep servers running. As Eclypsium chief executive Yuriy Bulygin told CNN, which received the research exclusively: "We can't trust the [AI] model if we can't trust the infrastructure it's running on."

What Happened

Eclypsium, a firm staffed by security engineers who previously worked at hardware companies including Intel, published its research under the title "Trusted AI Requires Trusted Infrastructure" on October 29, 2026. In a controlled demonstration carried out with support from Nvidia, the researchers used a compromised data processing unit (DPU) — a specialised chip that handles part of the work of running an AI model — together with permissive memory isolation settings to modify selected weights of a running model directly in memory.

Weights are the numerical parameters that shape how a model responds. Change them, and the same question can produce a different answer. In Eclypsium's demonstration, the changes were made after the model's ordinary file and boot checks had already run, so the stored model file, its hash and its signed artifacts remained unchanged and valid. The manipulation took less than a minute, according to the researchers, and the user of the chatbot would have had no way of knowing that the answer had been altered.

Two scenarios reported by CNN show why the researchers consider the effect serious rather than theoretical. In one, the tampered hardware vastly increased the probability that a model assigned to a Chinese invasion of Taiwan — a sensitive national-security question where a skewed answer could distort a decision. In another, a model running on the tampered hardware told a user seeking medical advice for chest pain to stay at home instead of going to hospital. Eclypsium stressed that these were controlled demonstrations, not reported incidents involving real patients or real military decisions.

The same technique, applied to a coding model, could have other consequences, according to Eclypsium's report: a subtle runtime change could bias a model toward weakening certificate validation, selecting an unsafe dependency, or generating a specific insecure pattern in code. In each case, the danger is not that the model was badly trained, but that the model running in memory is no longer quite the model that was checked on disk.

Illustration: A data center server room hums with processor hardware — the infrastructure beneath every chatbot answer.

Background

When an AI model launches, its runtime state is controlled by a hierarchy of software, firmware, memory controllers, management processors and input-output devices. Each layer is an opportunity for tampering if an attacker can reach it with enough privilege. Traditional integrity checks mostly verify the model as stored: the file on disk, its hash, its signature. Eclypsium's demonstration shows the gap between that check and the model as it actually executes.

The attack path described by the researchers is specific, and its conditions matter. An attacker generally needs to be on a network with access to either a DPU or a baseboard management controller (BMC) — a small computer used to manage servers remotely — and certain security configurations must be disabled. On the Nvidia GH200 system used in the demonstration, the method used direct memory access over PCIe with the input-output memory management unit in passthrough mode and permissive PCIe isolation. With that access, an attacker could read and modify code and data in machine memory, scanning model-layer memory at roughly three gigabytes per second.

That context is also why the summer of 2026 matters to this story. Longtime cybersecurity researcher HD Moore disclosed multiple vulnerabilities in BMCs earlier in the year, and Eclypsium said those very vulnerabilities offer a way into sensitive hardware systems of the kind used in its research. The attack surface, in other words, was not invented for the demonstration; parts of it were already being disclosed in the wild.

Eclypsium demonstrated the attack on a computing platform made by Nvidia, but the researchers said the scenario is not unique to Nvidia and could apply to other hardware and the code it runs. Cybersecurity Dive's account of the report added that systems from AMD, Intel and Arm are also vulnerable to these techniques. The report's argument is general: wherever privileged infrastructure components sit between a stored model and its execution, they belong inside the AI security boundary.

Why It Matters

The research lands at a moment when trust in AI answers is already fragile, even without tampering. CNN noted a separate episode from spring 2026 in which a false AI-assisted US intelligence report about a purported Chinese ship transporting nuclear components almost led the US military to board the ship; a military analyst had queried a chatbot about the ship's manifest and received a false report that it contained nuclear components. It was not clear whether that chatbot was a commercial product or a US government system, but the episode illustrates what is at stake when an AI answer is treated as fact.

Eclypsium's work adds a different risk on top of that one: not a model hallucinating, but a model being steered. A state actor is the most plausible attacker in the researchers' assessment — Eclypsium said state actors like China, Russia or the United States are capable of conducting a targeted attack on an AI user using the methods outlined — because the attack requires network access to privileged infrastructure and technical know-how, though the researchers added that AI agents themselves can help supply some of that know-how.

It also reframes who is responsible for AI safety. "Everybody's talking about model safety, which is perfectly fine. Please do that," Eclypsium senior vice president John Loucaides told CNN. "I just am trying to make sure that we don't forget about all the computers it's running on." Frontier AI labs, cloud providers and the businesses that deploy AI systems all depend on the same stack, and a compromise anywhere in it can reach the answer a user sees.

Illustration: A chatbot answer appears above a chip and memory modules — change the running weights, and the answer can change too.

What Nvidia and Independent Experts Say

Nvidia, which partnered with Eclypsium on the research, did not dismiss the findings, but it did draw a clear line around them. A Nvidia spokesperson told CNN: "We reviewed the hypothetical scenarios and did not identify anything the industry wasn't previously aware of," adding that strong memory access protections can block the attack path and that the company welcomed working with Eclypsium on the research.

The distinction Nvidia draws is important for readers. Verifying a model file confirms the copy on disk, not the copy executing in memory. Eclypsium said in a statement to CNN that the effectiveness of security controls against its attack scenarios "depends on how they are configured and used," and that it has been working with Nvidia to ensure those controls are effective. Nvidia announced a new security platform last month designed to guard against hardware attacks and keep AI agents from going rogue, offering more security monitoring for AI agents, according to Eclypsium.

Two independent hardware security experts who reviewed the findings at CNN's request described them as credible and important. "The attacks are fundamentally the same as any other [direct memory access] attacks and I don't see any reason to doubt their findings or results," said Joe FitzPatrick, a hardware security instructor and researcher. Dominic Rizzo, a senior fellow at the nonprofit Institute for Security and Technology, told CNN: "What [Eclypsium is] describing is a pretty general attack path on modern infrastructure and they are correct to point out that the solutions have to start much deeper in the stack."

Eclypsium said it briefed the US National Security Agency and the Cybersecurity and Infrastructure Security Agency on its findings. The two agencies protect military and civilian federal computer networks respectively. CNN reported that it had asked both agencies for comment, and that it had also asked Anthropic and OpenAI, whose models run on Nvidia chips, about the research. No responses from those four organisations were reported in the CNN account.

What Happens Next

The practical question now is whether the defences already available are actually switched on. Eclypsium's report argues that chipmakers should follow Nvidia's lead in relying on DPUs to enforce security policies independently of the AI system itself — but with adequate protections for the DPUs as well, since a compromised DPU is itself the attack route in the demonstration. Nvidia's Open Agent Safety Platform, introduced on September 28, 2026, includes OpenShell to govern agent execution and Sentry, which runs on BlueField-4 DPUs for out-of-band monitoring and policy enforcement. Eclypsium and Nvidia are collaborating on continuous, independent verification of AI infrastructure alongside that platform, though the companies have not disclosed an integration design, rollout date or customer deployment.

For organisations running AI systems, the immediate steps are unglamorous but concrete: audit DPU and BMC access, confirm that memory isolation and IOMMU settings are not left in permissive modes, patch known BMC vulnerabilities, and monitor infrastructure continuously rather than checking model files once at load time. Eclypsium's own Infrastructure Assurance product inventories and monitors hardware and firmware across AI servers, GPUs, DPUs, BMCs and network infrastructure — a sign of where the vendor market is heading, and of how much of the stack is now in scope.

For users, the lesson is narrower and more sobering. A chatbot answer that looks confident is not proof that the model behind it is the model its maker shipped — at least not unless the infrastructure it ran on was itself verified. That does not mean every chatbot answer should be distrusted; the attack requires privileged access and disabled protections, and it has been shown in a controlled demonstration, not reported as an attack on a live public chatbot. But it does mean that AI trust cannot be settled by checking a model file alone. As the race for AI supremacy between China and the United States intensifies, and as AI agents take on more consequential tasks, the computers underneath the models are becoming part of the safety story — whether the industry planned for that or not.

Illustration: A security shield guards a server rack and data processing unit — the defences must cover the infrastructure, not just the model.

Sponsored: explore today's featured sponsored offers

FAQ

What did Eclypsium actually demonstrate?

In a controlled demonstration with Nvidia's support, Eclypsium used a compromised data processing unit and permissive memory isolation to change selected weights of a running AI model in memory, altering its answers while the stored model file, hash and signature remained valid. It was a proof of concept, not a reported breach of a live chatbot.

Could anyone use this attack on any chatbot?

No. The attack requires network access to a data processing unit or a baseboard management controller, technical know-how, and certain security configurations disabled. Nvidia says strong memory access protections can block the attack path, and Eclypsium says the effectiveness of controls depends on how they are configured and used.

Why didn't checking the model file catch the tampering?

Because the file on disk was never changed. The tampering happened to the copy of the model executing in memory, after file and boot checks had run. Verifying a stored file confirms the copy on disk, not the copy running in memory.

What were the demonstration scenarios?

CNN reported two: a tampered model vastly increased the probability it assigned to a Chinese invasion of Taiwan, and a model advising a user with chest pain told them to stay home instead of going to hospital. Both were controlled demonstrations, not real incidents.

What should organisations do about this?

Audit privileged infrastructure access, ensure memory isolation is not left in permissive modes, patch known management-controller vulnerabilities, and monitor hardware and firmware continuously. Eclypsium argues defences must start deeper in the computing stack, including independently secured data processing units.

Sources

• CNN, "AI hardware can be hacked so chatbots provide dangerous answers, research shows," October 29, 2026.
• Eclypsium / Business Wire, "Eclypsium and NVIDIA Collaborate to Address Emerging AI Infrastructure Attack Surface and Strengthen AI Trust," October 29, 2026.
• Cybersecurity Dive, "Hackers could poison AI models by tampering with core infrastructure," October 29, 2026.
• Unite.AI, "Eclypsium Shows How Compromised Hardware Can Alter AI Models at Runtime," October 29, 2026.
• TokenPost, "Eclypsium Demonstration Shows AI Model Weights Can Change in Memory," October 29, 2026.