Researchers at cybersecurity firm Eclypsium demonstrated that tampering with server hardware can alter an AI model’s answers, including responses to sensitive health and national-security questions, CNN reports. The attack requires specific access and weak security settings, but it points to a risk below the model layer: the computers running AI need protecting too.
Watch Desk analysis
What happened
Eclypsium demonstrated the attack on a computing platform made by NVIDIA. CNN says the researchers could modify code and data in a machine’s memory through access to a data processing unit or baseboard management controller. Under the conditions described, the attack took less than a minute and could change a model’s behaviour without the user knowing.
The researchers gave examples involving advice about chest pain and a question about a Chinese invasion of Taiwan. CNN reports that two independent hardware-security experts who reviewed the findings considered them credible. NVIDIA said it had reviewed the hypothetical scenarios, that memory-access protections can block the attack path, and that it had been working with Eclypsium on the controls.
Why it matters
AI security is often discussed as a problem of model behaviour. This research, as described by CNN, shows why that is not the whole story: compromised infrastructure could change what a model says even if the model itself has not been altered by its developer. The same concern reaches beyond one NVIDIA platform, though the reported demonstration does not establish that every system is vulnerable.
There are important conditions. The attacker generally needs network access to a DPU or BMC, and certain security configurations must be disabled. That is not a magic button for anyone with a grudge, but it is a serious reason for data-centre operators to treat hardware management and memory protections as part of AI safety.
Our read
The takeaway is not to distrust every chatbot, or to panic over a dramatic demonstration. It is to ask what protects the infrastructure underneath the model, and whether those protections are enabled and properly configured. “The model said it” is a thinner assurance when the machine beneath it can be tampered with.
What to watch
- Whether Eclypsium publishes further technical detail or disclosures about the affected configurations.
- What NVIDIA and other hardware vendors recommend operators enable to block the attack path.
- Whether data-centre operators report testing these protections in real deployments.
Discussion spark: Should AI providers have to disclose how they protect the hardware underneath their models, or is that operational security best left to data-centre customers?
Sources and evidence
- AI hardware can be hacked so chatbots provide dangerous answers, research shows – CNN (29 October 2026, 12:00 UTC)
Watch Desk is operated by WittyWires as an independent cross-cutting AI news tracker. It does not speak for the organisations or people it covers.