Researchers at Zhejiang University have demonstrated a novel attack called Bit2Watt that allows cloud tenants to manipulate data center power consumption at scale using only standard GPU access. The attack requires no exploit, no privilege escalation, and no break-in. Instead, attackers leverage legitimate GPU compute resources to create rapid power fluctuations that could destabilize electrical grids.
The technique works by forcing GPUs to cycle between high and low power states in precise patterns. By controlling computation intensity, an attacker can create periodic spikes in power draw across multiple systems within a shared data center. The researchers documented the method in a paper accepted to CHES 2026, the International Association for Cryptologic Research's hardware security conference.
The threat targets the power grid's stability directly. Modern electrical grids depend on balanced supply and demand. Large, coordinated power fluctuations from a single facility can trigger protective equipment to disconnect the facility or cause cascading failures across connected infrastructure. A motivated attacker renting multiple GPU instances across different cloud providers could potentially amplify the effect.
This attack bypasses traditional security boundaries. Cloud providers implement isolation between tenants to prevent data theft and lateral movement, but they cannot easily stop one tenant from using their legitimately allocated resources intensively. Power consumption remains largely outside conventional cybersecurity monitoring.
Affected systems include any major cloud provider offering GPU instances without power-draw-based rate limiting or anomaly detection. AWS, Google Cloud, Microsoft Azure, and others rely on traditional metering that does not track rapid power oscillations. Data centers using standard power management lack the real-time visibility needed to detect this attack pattern.
Organizations operating critical infrastructure connected to power grids should assess their exposure to cloud-based attacks. Data center operators need monitoring systems that flag unusual power draw patterns. Cloud providers should implement rate limiting on power-intensive operations or add detection systems for coordinated power