Researchers tampered with AI servers to change chatbot answers

What the researchers found

Security firm Eclypsium says it can tamper with the hardware that runs major AI models so that chatbots give faulty or dangerous answers, according to research shared exclusively with CNN. The work shifts attention from the behaviour of AI companies to the chips, memory and data-centre servers that models depend on.

The researchers demonstrated the attack on a computing platform made by Nvidia, not on a live customer deployment. They say the scenario is not unique to Nvidia and could apply to other hardware and the code it runs. Eclypsium is based in Portland and staffed by security engineers who previously worked at hardware companies including Intel.

"We can't trust the [AI] model if we can't trust the infrastructure it's running on," Eclypsium chief executive Yuriy Bulygin told CNN.

Two examples: Taiwan and chest pain

In one demonstration, the researchers remotely tampered with the numerical weights a model uses to process information. That, they said, vastly increased the probability the model assigned to a Chinese invasion of Taiwan. The change affects how the model weighs evidence and what it says about a sensitive national security question.

In another scenario, a model running on tampered hardware told a user seeking medical advice for chest pain to stay at home instead of going to the hospital. The example matters because a wrong answer about a heart attack risk is immediately dangerous, not merely inaccurate.

The researchers said they could subvert answers to both national security and personal health questions. The demonstrations are controlled tests rather than evidence of tampering in a live commercial service.

How the attack works

The attack requires conditions, not just a malicious prompt. An attacker generally needs to be on a network with access to a data processing unit, a system on a chip used in data centres, or a baseboard management controller, a small computer that manages servers remotely. Certain security configurations also have to be disabled.

With access to the data processing unit, an attacker can read and modify code and data in the machine's memory, which changes how the AI model behaves.

The firm says the required technical know-how is not an impossible barrier, because AI agents can help with parts of the work. That raises a broader concern: the same tools that make attacks easier to write also make defensive review more difficult.

Nvidia's response and the available controls

A Nvidia spokesperson told CNN that the company reviewed the hypothetical scenarios and did not identify anything the industry was not previously aware of. The spokesperson said Nvidia welcomed working with Eclypsium on the research and that strong memory access protections can block the attack path.

Nvidia last month announced a security platform designed to guard against hardware attacks and to keep AI agents from going rogue, offering more monitoring for agents, according to Eclypsium. Eclypsium said the effectiveness of such controls against the scenarios it described depends on how they are configured and used, and that it has been working with Nvidia to make them effective.

CNN asked Anthropic and OpenAI, whose models run on Nvidia chips, about the research. The article reviewed here does not include their responses.

Why hardware trust matters now

The research lands in a wider debate about AI and national security. Eclypsium says state actors such as China, Russia or the United States are capable of conducting a targeted attack on an AI user using the methods it outlined.

CNN notes that the race for AI supremacy between China and the United States has intensified, and that real-world cases showing the consequences are multiplying. This spring, a false AI-assisted US intelligence report about a purported Chinese ship carrying nuclear components almost led the US military to board the vessel; A US military analyst had queried a chatbot about the ship's manifest, and the chatbot falsely reported that it contained nuclear components.

The report also follows multiple accounts of AI agents going rogue and attacking governments and corporations. Eclypsium senior vice president John Loucaides told CNN that model safety deserved attention but that the computers running the models should not be forgotten.

The potential attack surface is broad. This summer, veteran security researcher HD Moore disclosed multiple vulnerabilities in baseboard management controllers, and those vulnerabilities offer a route into sensitive hardware systems in the Eclypsium research.

CNN also notes that President Donald Trump discussed AI with Chinese leader Xi Jinping last month, but the meeting did not produce a substantive agreement on the technology, and that Trump has resisted calls for guardrails out of concern the United States would fall behind China. Concerns about the reliability of AI models were already growing even without any suggestion of tampering.

What independent experts say

Two hardware security experts who reviewed the findings at CNN's request said they were credible and worth taking seriously. Joe FitzPatrick, a hardware security instructor and researcher, said the attacks were fundamentally the same as other direct memory access attacks and that he saw no reason to doubt the findings.

Dominic Rizzo, a senior fellow at the nonprofit Institute for Security and Technology, said Eclypsium was describing a general attack path on modern infrastructure and was right that solutions have to start deeper in the stack.

Eclypsium said it briefed the National Security Agency and the Cybersecurity and Infrastructure Security Agency on its findings. CNN asked both agencies for comment; the article reviewed here does not include their responses.

What is not known

The research has not shown that any live AI service has been attacked in this way. The demonstrations required network access and weakened security settings, and the affected vendors say protections exist.

It is also unclear how widely the necessary hardware and configurations are used in the services people rely on, or how quickly operators will apply the controls Nvidia and Eclypsium describe. Those questions decide whether the risk stays a laboratory scenario or becomes an operational one. Related coverage includes Nvidia antitrust questions, UK ICO agentic AI guidance, and Industry. Related security coverage includes Anthropic's cyber verification tiers.