Researchers from Zhejiang University have demonstrated a class of attack that turns a cloud tenant’s legitimate GPU access into a weapon against the electrical grid — no exploit, no malware, and no unauthorised access required.
The attack, called Bit2Watt and accepted to the CHES 2026 hardware-security conference, exploits the power swings inherent in GPU compute workloads. By carefully modulating a GPU between high-intensity computation and near-idle states, a tenant can create power oscillations at frequencies far beyond what grid operators typically monitor.
How it works
The researchers devised two variants. The simpler Synthetic Workload Modulation Attack uploads a custom CUDA kernel that toggles between compute and idle states, producing oscillations at 1.5 to 6 kilohertz on a single GPU — several orders of magnitude faster than the few hertz produced by conventional loads such as air conditioners. The more sophisticated Training Workload Modulation Attack embeds the modulation inside a real large-language-model training run by adjusting hyperparameters, making it nearly indistinguishable from normal AI operations.
In simulations of a 1-megawatt local grid powered largely by distributed energy resources such as solar and batteries, 1,000 GPUs modulating in lockstep produced 46.8 percent total harmonic distortion — more than three times the 13 percent guideline set by the IEC 61000-3-12 standard. The attack also introduced a negative damping ratio, meaning the grid amplified the disturbance rather than dampening it.
When the researchers scaled the simulation to a 9,241-bus model resembling the European transmission network, a localised disturbance worth 2 percent of system load cascaded across 13 stages, shedding roughly 81 percent of load.
A known risk, newly weaponised
The underlying phenomenon is not new. Meta’s Llama 3 paper acknowledged that “tens of thousands of GPUs may increase or decrease power consumption at the same time… resulting in instant fluctuations on the order of tens of megawatts, stretching the limits of the power grid.” A 2025 paper co-authored by Microsoft, Nvidia, and OpenAI warned that AI training power swings, if harmonised with utility critical frequencies, “can cause physical damage to the power grid infrastructure.”
What is new is the deliberate weaponisation. Bit2Watt takes what was an accidental side-effect of AI training and turns it into an intentional attack.
A detection gap
Standard data-centre monitoring tools cannot see the attack. Rack power-distribution-unit counters sample at roughly 1 Hz. Nvidia’s NVML tool samples at 450 Hz. Server BMC and RAPL interfaces sample at approximately 1 kHz. Bit2Watt’s modulation operates at 1.5 to 6 kHz — missed by every standard monitoring method. “Purely computational actions, executed as legitimate workloads, can be weaponised to destabilise power infrastructure,” the researchers wrote.
The attack also enables a covert data-exfiltration channel called Watt2Bit, which encodes data in the power modulation pattern. The team recovered a 50-bit test sequence with zero errors using a near-field antenna and software-defined radio.
What can be done
Defences span two domains. On the power side, batteries, supercapacitors, and harmonic filtering can absorb the modulated power swings before they reach the grid. On the compute side, anomaly detection on GPU utilisation patterns and training schedules could flag suspicious modulation — though the subtle LTMA variant is specifically designed to blend into normal training noise.
The Zhejiang University team emphasised that the risk is structural rather than hypothetical. “As power and computing infrastructures converge, security must be addressed across domains, requiring coordinated defences that consider workload behaviour, power electronics, and grid dynamics.”
Sources: Malicious cloud customers can bring down the power grid (The Register, July 2026); New Bit2Watt Attack Could Let Cloud Tenants Disrupt Power Grids Without an Exploit (The Hacker News, July 2026)