NVIDIA

US taking 25% cut of Nvidia chip sales “makes no sense,” experts say

AI, AI chips, china, Donald Trump, NVIDIA, Policy, us-china trade war / 9u50fv / December 10, 2025

Trump’s odd Nvidia reversal may open the door for China to demand Blackwell access.

Donald Trump’s decision to allow Nvidia to export an advanced artificial intelligence chip, the H200, to China may give China exactly what it needs to win the AI race, experts and lawmakers have warned.

The H200 is about 10 times less powerful than Nvidia’s Blackwell chip, which is the tech giant’s currently most advanced chip that cannot be exported to China. But the H200 is six times more powerful than the H20, the most advanced chip available in China today. Meanwhile China’s leading AI chip maker, Huawei, is estimated to be about two years behind Nvidia’s technology. By approving the sales, Trump may unwittingly be helping Chinese chip makers “catch up” to Nvidia, Jake Sullivan told The New York Times.

Sullivan, a former Biden-era national security advisor who helped design AI chip export curbs on China, told the NYT that Trump’s move was “nuts” because “China’s main problem” in the AI race “is they don’t have enough advanced computing capability.”

“It makes no sense that President Trump is solving their problem for them by selling them powerful American chips,” Sullivan said. “We are literally handing away our advantage. China’s leaders can’t believe their luck.”

Trump apparently was persuaded by Nvidia CEO Jensen Huang and his “AI czar,” David Sacks, to reverse course on H200 export curbs. They convinced Trump that restricting sales would ensure that only Chinese chip makers would get a piece of China’s market, shoring up revenue flows that dominant firms like Huawei could pour into R&D.

By instead allowing Nvidia sales, China’s industry would remain hooked on US chips, the thinking goes. And Nvidia could use those funds—perhaps $10–15 billion annually, Bloomberg Intelligence has estimated—to further its own R&D efforts. That cash influx, theoretically, would allow Nvidia to maintain the US advantage.

Along the way, the US would receive a 25 percent cut of sales, which lawmakers from both sides of the aisle warned may not be legal and suggested to foreign rivals that US national security was “now up for sale,” NYT reported. The president has claimed there are conditions to sales safeguarding national security but, frustrating critics, provided no details.

Experts slam Nvidia plan as “flawed”

Trump’s plan is “flawed,” The Economist reported.

For years, the US has established tech dominance by keeping advanced technology away from China. Trump risks rocking that boat by “tearing up America’s export-control policy,” particularly if China’s chip industry simply buys up the H200s as a short-term tactic to learn from the technology and beef up its domestic production of advanced chips, The Economist reported.

In a sign that’s exactly what many expect could happen, investors in China were apparently so excited by Trump’s announcement that they immediately poured money into Moore Threads, expected to be China’s best answer to Nvidia, the South China Morning Post reported.

Several experts for the non-partisan think tank the Counsel on Foreign Relations also criticized the policy change, cautioning that the reversal of course threatened to undermine US competition with China.

Suggesting that Trump was “effectively undoing” export curbs sought during his first term, Zongyuan Zoe Liu warned that China “buys today to learn today, with the intention to build tomorrow.”

And perhaps more concerning, she suggested, is that Trump’s policy signals weakness. Rather than forcing Chinese dependence on US tech, reversing course showed China that the US will “back down” under pressure, she warned. And they’re getting that message at a time when “Chinese leaders have a lot of reasons to believe they are not only winning the trade war but also making progress towards a higher degree of strategic autonomy.”

In a post on X, Rush Doshi—a CFR expert who previously advised Biden on national security issues related to China—suggested that the policy change was “possibly decisive in the AI race.”

“Compute is our main advantage—China has more power, engineers, and the entire edge layer—so by giving this up, we increase the odds the world runs on Chinese AI,” Doshi wrote.

Experts fear Trump may not understand the full impact of his decision. In the short-term, Michael C. Horowitz wrote for CFR, “it is indisputable” that allowing H200 exports benefits China’s frontier AI and efforts to scale data centers. And Doshi pointed out that Trump’s shift may trigger more advanced technology flowing into China, as US allies that restricted sales of machines to build AI chips may soon follow his lead and lift their curbs. As China learns to be self-reliant from any influx of advanced tech, Sullivan warned that China’s leaders “intend to get off of American semiconductors as soon as they can.”

“So, the argument that we can keep them ‘addicted’ holds no water,” Sullivan said. “They want American chips right now for one simple reason: They are behind in the AI race, and this will help them catch up while they build their own chip capabilities.”

China may reject H200, demand Blackwell access

It remains unclear if China will approve H200 sales, but some of the country’s biggest firms, including ByteDance, Tencent, and Alibaba, are interested, anonymous insider sources told Reuters.

In the past, China has instructed companies to avoid Nvidia, warning of possible backdoors giving Nvidia a kill switch to remotely shut down chips. Such backdoors could potentially destabilize Chinese firms’ operations and R&D. Nvidia has denied such backdoors exist, but Chinese firms have supposedly sought reassurances from Nvidia in the aftermath of Trump’s policy change. Likely just as unpopular with the Chinese firms and government, Nvidia confirmed recently that it has built location verification tech that could help the US detect when restricted chips are leaked into China. Should the US ever renew export curbs on H200 chips, adopting them widely could cause chaos in the future.

Without giving China sought-after reassurances, Nvidia may not end up benefiting as much as it hoped from its mission to reclaim lost revenue from the Chinese market. Today, Chinese firms control about 60 percent of China’s AI chip market, where only a few years ago American firms—led by Nvidia—controlled 80 percent, the Economist reported.

But for China, the temptation to buy up Nvidia chips may be too great to pass up. Another CFR expert, Chris McGuire, estimated that Nvidia could suddenly start exporting as many as 3 million H200s into China next year. “This would at least triple the amount of aggregate AI computing power China could add domestically” in 2026, McGuire wrote, and possibly trigger disastrous outcomes for the US.

“This could cause DeepSeek and other Chinese AI developers to close the gap with leading US AI labs and enable China to develop an ‘AI Belt and Road’ initiative—a complement to its vast global infrastructure investment network already in place—that competes with US cloud providers around the world,” McGuire forecasted.

As China mulls the benefits and risks, an emergency meeting was called, where the Chinese government discussed potential concerns of local firms buying chips, according to The Information. Reportedly, Beijing ended that meeting with a promise to issue a decision soon.

Horowitz suggested that a primary reason that China may reject the H200s could be to squeeze even bigger concessions out of Trump, whose administration recently has been working to maintain a tenuous truce with China.

“China could come back demanding the Blackwell or something else,” Horowitz suggested.

In a statement, Nvidia—which plans to release a chip called the Rubin to surpass the Blackwell soon—praised Trump’s policy as striking “a thoughtful balance that is great for America.”

China will rip off Nvidia’s chips, Republican warns

Both Democratic and Republican lawmakers in Congress criticized Trump’s plan, including senators behind a bipartisan push to limit AI chip sales to China.

Some have questioned how much thought was put into the policy, as the US confusingly continues restricting less advanced AI chips (like the A100 and H100) while green-lighting H200 sales. Trump’s Justice Department also seems to be struggling to keep up. The NYT noted that just “hours before” Trump announced the policy change, the DOJ announced “it had detained two people for selling those chips to the country.”

The chair of the Select Committee on Competition with China, Rep. John Moolenaar (R-Mich.), warned on X that the news wouldn’t be good for the US or Nvidia. First, the Chinese Communist Party “will use these highly advanced chips to strengthen its military capabilities and totalitarian surveillance,” he suggested. And second, “Nvidia should be under no illusions—China will rip off its technology, mass produce it themselves, and seek to end Nvidia as a competitor.”

“That is China’s playbook and it is using it in every critical industry,” Moolenaar said.

House Democrats on committees dealing with foreign affairs and competition with China echoed those concerns, The Hill reported, warning that “under this administration, our national security is for sale.”

Nvidia’s Huang seems pleased with the outcome, which comes after months of reportedly pressuring the administration to lift export curbs limiting its growth in Chinese markets, the NYT reported. Last week, Trump heaped praise on Huang after one meeting, calling Huang a “smart man” and suggesting the Nvidia chief has “done an amazing job” helping Trump understand the stakes.

At an October news conference ahead of the deal’s official approval, Huang suggested that government lawyers were researching ways to get around a US law that prohibits charging companies fees for export licenses. Eventually, Trump is expected to release a policy that outlines how the US will collect those fees without conflicting with that law.

Senate Democrats appear unlikely to embrace such a policy, issuing a joint statement condemning the H200 sales as dooming the US in the AI race and threatening national security.

“Access to these chips would give China’s military transformational technology to make its weapons more lethal, carry out more effective cyberattacks against American businesses and critical infrastructure and strengthen their economic and manufacturing sector,” Senators wrote.

Ashley is a senior policy reporter for Ars Technica, dedicated to tracking social impacts of emerging policies and new technologies. She is a Chicago-based journalist with 20 years of experience.

US taking 25% cut of Nvidia chip sales “makes no sense,” experts say Read More »

SteamOS vs. Windows on dedicated GPUs: It’s complicated, but Windows has an edge

AMD, AMD Ryzen, gaming, intel, NVIDIA, Radeon, steamos, Tech, Windows, Windows 11, windows 11 25h2 / DJ Henderson / December 5, 2025

Other results vary from game to game and from GPU to GPU. Borderlands 3, for example, performs quite a bit better on Windows than on SteamOS across all of our tested GPUs, sometimes by as much as 20 or 30 percent (with smaller gaps here and there). As a game from 2019 with no ray-tracing effects, it still runs serviceably on SteamOS across the board, but it was the game we tested that favored Windows the most consistently.

In both Forza Horizon 5 and Cyberpunk 2077, with ray-tracing effects enabled, you also see a consistent advantage for Windows across the 16GB dedicated GPUs, usually somewhere in the 15 to 20 percent range.

To Valve’s credit, there were also many games we tested where Windows and SteamOS performance was functionally tied. Cyberpunk without ray-tracing, Returnal when not hitting the 7600’s 8GB RAM limit, and Assassin’s Creed Valhalla were sometimes actually tied between Windows and SteamOS, or they differed by low-single-digit percentages that you could chalk up to the margin of error.

Now look at the results from the integrated GPUs, the Radeon 780M and RX 8060S. These are pretty different GPUs from one another—the 8060S has more than three times the compute units of the 780M, and it’s working with a higher-speed pool of soldered-down LPDDR5X-8000 rather than two poky DDR5-5600 SODIMMs.

But Borderlands aside, SteamOS actually did quite a bit better on these GPUs relative to Windows. In both Forza and Cyberpunk with ray-tracing enabled, SteamOS slightly beats Windows on the 780M, and mostly closes the performance gap on the 8060S. For the games where Windows and SteamOS essentially tied on the dedicated GPUs, SteamOS has a small but consistent lead over Windows in average frame rates.

SteamOS vs. Windows on dedicated GPUs: It’s complicated, but Windows has an edge Read More »

After nearly 30 years, Crucial will stop selling RAM to consumers

AI, AI infrastructure, AMD, Crucial, datacenters, DDR5, DRAM, framework, HBM, Lenovo, machine learning, memory, memory shortage, Micron, NVIDIA, pc building, samsung, semiconductors, SK Hynix, SSD, Tech / Shannon Garcia / December 3, 2025

DRAM contract prices have increased 171 percent year over year, according to industry data. Gerry Chen, general manager of memory manufacturer TeamGroup, warned that the situation will worsen in the first half of 2026 once distributors exhaust their remaining inventory. He expects supply constraints to persist through late 2027 or beyond.

The fault lies squarely at the feet of AI mania in the tech industry. The construction of new AI infrastructure has created unprecedented demand for high-bandwidth memory (HBM), the specialized DRAM used in AI accelerators from Nvidia and AMD. Memory manufacturers have been reallocating production capacity away from consumer products toward these more profitable enterprise components, and Micron has presold its entire HBM output through 2026.

A photo of the “Stargate I” site in Abilene, Texas. AI data center sites like this are eating up the RAM supply. Credit: OpenAI

At the moment, the structural imbalance between AI demand and consumer supply shows no signs of easing. OpenAI’s Stargate project has reportedly signed agreements for up to 900,000 wafers of DRAM per month, which could account for nearly 40 percent of global production.

The shortage has already forced companies to adapt. As Ars’ Andrew Cunningham reported, laptop maker Framework stopped selling standalone RAM kits in late November to prevent scalping and said it will likely be forced to raise prices soon.

For Micron, the calculus is clear: Enterprise customers pay more and buy in bulk. But for the DIY PC community, the decision will leave PC builders with one fewer option when reaching for the RAM sticks. In his statement, Sadana reflected on the brand’s 29-year run.

“Thanks to a passionate community of consumers, the Crucial brand has become synonymous with technical leadership, quality and reliability of leading-edge memory and storage products,” Sadana said. “We would like to thank our millions of customers, hundreds of partners and all of the Micron team members who have supported the Crucial journey for the last 29 years.”

After nearly 30 years, Crucial will stop selling RAM to consumers Read More »

Testing shows why the Steam Machine’s 8GB of graphics RAM could be a problem

AMD, gaming, intel, NVIDIA, steam deck, steam machine, steamos, Tech / Kelly Newman / December 2, 2025

By Valve’s admission, its upcoming Steam Machine desktop isn’t swinging for the fences with its graphical performance. The specs promise decent 1080p-to-1440p performance in most games, with 4K occasionally reachable with assistance from FSR upscaling—about what you’d expect from a box with a modern midrange graphics card in it.

But there’s one spec that has caused some concern among Ars staffers and others with their eyes on the Steam Machine: The GPU comes with just 8GB of dedicated graphics RAM, an amount that is steadily becoming more of a bottleneck for midrange GPUs like AMD’s Radeon RX 7060 and 9060, or Nvidia’s GeForce RTX 4060 or 5060.

In our reviews of these GPUs, we’ve already run into some games where the RAM ceiling limits performance in Windows, especially at 1440p. But we’ve been doing more extensive testing of various GPUs with SteamOS, and we can confirm that in current betas, 8GB GPUs struggle even more on SteamOS than they do running the same games at the same settings in Windows 11.

The good news is that Valve is working on solutions, and having a stable platform like the Steam Machine to aim for should help improve things for other hardware with similar configurations. The bad news is there’s plenty of work left to do.

The numbers

We’ve tested an array of dedicated and integrated Radeon GPUs under SteamOS and Windows, and we’ll share more extensive results in another article soon (along with broader SteamOS-vs-Windows observations). But for our purposes here, the two GPUs that highlight the issues most effectively are the 8GB Radeon RX 7600 and the 16GB Radeon RX 7600 XT.

These dedicated GPUs have the benefit of being nearly identical to what Valve plans to ship in the Steam Machine—32 compute units (CUs) instead of Valve’s 28, but the same RDNA3 architecture. They’re also, most importantly for our purposes, pretty similar to each other—the same physical GPU die, just with slightly higher clock speeds and more RAM for the 7600 XT than for the regular 7600.

Testing shows why the Steam Machine’s 8GB of graphics RAM could be a problem Read More »

GPU prices are coming to earth just as RAM costs shoot into the stratosphere

AMD, gaming, intel, NAND, NVIDIA, RAM, SSDs, Tech / Kelly Newman / November 27, 2025

It’s not just PC builders

PC and phone manufacturers—and makers of components that use memory chips, like GPUs—mostly haven’t hiked prices yet. These companies buy components in large quantities, and they typically do so ahead of time, dulling the impact of the increases in the short-term. The kinds of price increases we see, and what costs are passed on to consumers, will vary from company to company.

Bloomberg reports that Lenovo is “stockpiling memory and other critical components” to get it through 2026 without issues and that the company “will aim to avoid passing on rising costs to its customers in the current quarter.” Apple may also be in a good position to weather the shortage; analysts at Morgan Stanley and Bernstein Research believe that Apple has already laid claim to the RAM that it needs and that its healthy profit margins will allow it to absorb the increases better than most.

Framework on the other hand, a smaller company known best for its repairable and upgradeable laptop designs, says “it is likely we will need to increase memory pricing soon” to reflect price increases from its suppliers. The company has also stopped selling standalone RAM kits in its online store in an effort to fight scalpers who are trying to capitalize on the shortages.

Tom’s Hardware reports that AMD has told its partners that it expects to raise GPU prices by about 10 percent starting next year and that Nvidia may have canceled a planned RTX 50-series Super launch entirely because of shortages and price increases (the main draw of this Super refresh, according to the rumor mill, would have a bump from 2GB GDDR7 chips to 3GB chips, boosting memory capacities across the lineup by 50 percent).

GPU prices are coming to earth just as RAM costs shoot into the stratosphere Read More »

Tech company CTO and others indicted for exporting Nvidia chips to China

chip export controls, NVIDIA, Policy / Beth Washington / November 22, 2025

Citing export controls that took effect in 2022, the indictment said the US is trying to disrupt China’s plan to build exascale supercomputers for military and surveillance use. “These capabilities are being used by the PRC for its military modernization efforts and in connection with the PRC’s weapons design and testing, including for weapons of mass destruction, as well as in connection with the PRC’s development and deployment of advanced AI surveillance tools,” the indictment said.

The Justice Department said the conspirators used Janford Realtor, LLC, a Florida-based company that was not involved in real estate despite its name, “as a front to purchase and then illegally export controlled GPUs to the PRC.” Ho and Li owned and controlled Janford Realtor, while Raymond operated an Alabama-based electronics company that “supplied Nvidia GPUs to Ho and others for illegal export to the PRC,” the Justice Department said.

Kickbacks, money laundering

The conspirators paid each other “kickbacks” or commissions on the sale and export of the Nvidia chips, the indictment said. The money laundering charges involve a variety of transfers from two Chinese companies to Janford Realtor and the Alabama electronics company, the indictment said. The indictment lists nine wire transfers in amounts ranging from $237,248 to $1,150,000.

Raymond was reportedly released on bond, while the other three alleged conspirators are being detained. “This is an extremely serious offense. At the time these were being exported, these were Nvidia’s most advanced chips,” US prosecutor Noah Stern told a magistrate judge in Oakland yesterday, according to Wired.

Stein also said in court that “text messages obtained by authorities show Li boasting about how his father ‘had engaged in similar business on behalf of the Chinese Communist Party,’” Wired reported. Stern said that in the messages, Li “explained that his father had ways to import” the Nvidia chips despite US export controls.

Tech company CTO and others indicted for exporting Nvidia chips to China Read More »

Google’s latest swing at Chromebook gaming is a free year of GeForce Now

chromebooks, gaming, GeForce Now, Google, NVIDIA / Beth Washington / November 20, 2025

Earlier this year, Google announced the end of its efforts to get Steam running on Chromebooks, but it’s not done trying to make these low-power laptops into gaming machines. Google has teamed up with Nvidia to offer a version of GeForce Now cloud streaming that is perplexingly limited in some ways and generous in others. Starting today, anyone who buys a Chromebook will get a free year of a new service called GeForce Now Fast Pass. There are no ads and less waiting for server slots, but you don’t get to play very long.

Back before Google killed its Stadia game streaming service, it would often throw in a few months of the Pro subscription with Chromebook purchases. In the absence of its own gaming platform, Google has turned to Nvidia to level up Chromebook gaming. GeForce Now (GFN), which has been around in one form or another for more than a decade, allows you to render games on a remote server and stream the video output to the device of your choice. It works on computers, phones, TVs, and yes, Chromebooks.

The new Chromebook feature is not the same GeForce Now subscription you can get from Nvidia. Fast Pass, which is exclusive to Chromebooks, includes a mishmash of limits and bonuses that make it a pretty strange offering. Fast Pass is based on the free tier of GeForce Now, but users will get priority access to server slots. So no queuing for five or 10 minutes to start playing. It also lacks the ads that Nvidia’s standard free tier includes. Fast Pass also uses the more powerful RTX servers, which are otherwise limited to the $10-per-month ($100 yearly) Performance tier.

Google’s latest swing at Chromebook gaming is a free year of GeForce Now Read More »

Google CEO: If an AI bubble pops, no one is getting out clean

AI, AI energy, AI infrastructure, AI investment, AI regulation, alphabet, Biz & IT, climate change, deepmind, dotcom bubble, Ed Zitron, Google, Jamie Dimon, Jensen Huang, large language models, machine learning, NVIDIA, openai, Sundar Pichai / 9u50fv / November 18, 2025

Market concerns and Google’s position

Alphabet’s recent market performance has been driven by investor confidence in the company’s ability to compete with OpenAI’s ChatGPT, as well as its development of specialized chips for AI that can compete with Nvidia’s. Nvidia recently reached a world-first $5 trillion valuation due to making GPUs that can accelerate the matrix math at the heart of AI computations.

Despite acknowledging that no company would be immune to a potential AI bubble burst, Pichai argued that Google’s unique position gives it an advantage. He told the BBC that the company owns what he called a “full stack” of technologies, from chips to YouTube data to models and frontier science research. This integrated approach, he suggested, would help the company weather any market turbulence better than competitors.

Pichai also told the BBC that people should not “blindly trust” everything AI tools output. The company currently faces repeated accuracy concerns about some of its AI models. Pichai said that while AI tools are helpful “if you want to creatively write something,” people “have to learn to use these tools for what they’re good at and not blindly trust everything they say.”

In the BBC interview, the Google boss also addressed the “immense” energy needs of AI, acknowledging that the intensive energy requirements of expanding AI ventures have caused slippage on Alphabet’s climate targets. However, Pichai insisted that the company still wants to achieve net zero by 2030 through investments in new energy technologies. “The rate at which we were hoping to make progress will be impacted,” Pichai said, warning that constraining an economy based on energy “will have consequences.”

Even with the warnings about a potential AI bubble, Pichai did not miss his chance to promote the technology, albeit with a hint of danger regarding its widespread impact. Pichai described AI as “the most profound technology” humankind has worked on.

“We will have to work through societal disruptions,” he said, adding that the technology would “create new opportunities” and “evolve and transition certain jobs.” He said people who adapt to AI tools “will do better” in their professions, whatever field they work in.

Google CEO: If an AI bubble pops, no one is getting out clean Read More »

Review: New Framework Laptop 16 takes a fresh stab at the upgradeable laptop GPU

AMD, AMD Ryzen, Features, framework, framework laptop 13, framework laptop 16, gaming, NVIDIA, nvidia geforce, Reviews, right to repair, Tech / 9u50fv / November 12, 2025

framework laptop 16, take two

New components make it more useful and powerful but no less odd.

Credit: Andrew Cunningham

The original Framework Laptop 16 was trying to crack a problem that laptop makers have wrestled with on and off for years: Can you deliver a reasonably powerful, portable workstation and gaming laptop that supports graphics card upgrades just like a desktop PC?

Specs at a glance: Framework Laptop 16 (2025)
OS	Windows 11 25H2
CPU	AMD Ryzen AI 7 350 (4 Zen 5 cores, 4 Zen 5c cores)
RAM	32GB DDR5-5600 (upgradeable)
GPU	AMD Radeon 860M (integrated)/Nvidia GeForce RTX 5070 Mobile (dedicated)
SSD	1TB Western Digital Black SN770
Battery	85 WHr
Display	16-inch 2560×1600 165 Hz matte non-touchscreen
Connectivity	6x recessed USB-C ports (2x USB 4, 4x USB 3.2) with customizable “Expansion Card” dongles
Weight	4.63 pounds (2.1 kg) without GPU, 5.29 pounds (2.4 kg) with GPU
Price as tested	Roughly $2,649 for pre-built edition; $2,517 for DIY edition with no OS

Even in these days of mostly incremental, not-too-exciting GPU upgrades, the graphics card in a gaming PC or graphics-centric workstation will still feel its age faster than your CPU will. And the chance to upgrade that one component for hundreds of dollars instead of spending thousands replacing the entire machine is an appealing proposition.

Upgradeable, swappable GPUs would also make your laptop more flexible—you can pick and choose from various GPUs from multiple vendors based on what you want and need, whether that’s raw performance, power efficiency, Linux support, or CUDA capabilities.

Framework’s first upgrade to the Laptop 16—the company’s first upgrade to any of its products aside from the original Laptop 13—gets us pretty close to that reality. The laptop can now support two interchangeable motherboards: one with an older AMD Ryzen 7040-series CPU and one with a new Ryzen AI 300-series CPU. And both motherboards can be used either with just an integrated GPU or with dedicated GPUs from both AMD and Nvidia.

The Nvidia GeForce 5070 graphics module is the most exciting and significant part of this batch of updates, but there are plenty of other updates and revisions to the laptop’s external and internal components, too. These upgrades don’t address all of our problems with the initial version of the laptop, but they do help quite a bit. And a steady flow of updates like these would definitely make the Laptop 16 a platform worth investing in.

Re-meet the Framework Laptop 16

Framework’s Laptop 13 stacked on top of the 16. Credit: Andrew Cunningham

Framework treats each of its laptops as a platform to be modified and built upon rather than something to be wholly redesigned and replaced every time it’s updated. So these reviews necessarily re-cover ground we have already covered—I’ve also reused some of the photos from last time, since this is quite literally the same laptop in most respects. I’ll point you to the earlier review for detailed notes on the build process and how the laptop is put together.

To summarize our high-level notes about the look, feel, and design of the Framework Laptop 16: While the Framework Laptop 13 can plausibly claim to be in the same size and weight class as portables like the 13-inch MacBook Air, the Framework Laptop 16 is generally larger and heavier than the likes of the 16-inch MacBook Pro or portable PC workstations like the Lenovo ThinkPad P1 or Dell 16 Premium. That’s doubly true once you actually add a dedicated graphics module to the Laptop 16—these protrude a couple of inches from the back of the laptop and add around two-thirds of a pound to its weight.

	Frame-work 16 (no GPU)	Frame-work 16 (GPU)	Apple 16-inch MBP	Dell 16 Premium	Lenovo ThinkPad P1 Gen 8	HP ZBook X G1i	Lenovo Legion Pro 5i Gen 10	Razer Blade 16
Size (H x W x D inches)	0.71 x 14.04 x 10.63	0.82 x 14.04 x 11.43	0.66 x 14.01 x 9.77	0.75 x 14.1 x 9.4	0.39-0.62 x 13.95 x 9.49	0.9 x 14.02 x 9.88	0.85-1.01 x 14.34 x 10.55	0.59-0.69 x 13.98 x 9.86
Weight	4.63 lbs	5.29 lbs	4.7-4.8 lbs	4.65 pounds	4.06 lbs	4.5 lbs	5.56 lbs	4.71 lbs

You certainly can find laptops from the major PC OEMs that come close to or even exceed the size and weight of the Laptop 16. But in most cases, you’ll find that comparably specced and priced laptops are an inch or two less deep and at least half a pound lighter than the Laptop 16 with a dedicated GPU installed.

But if you’re buying from Framework, you’re probably at least notionally interested in customizing, upgrading, and repairing your laptop over time, all things that Framework continues to do better than any other company.

The Laptop 16’s customizable keyboard deck is still probably its coolest feature—it’s a magnetically attached series of panels that allows you to remove and replace components without worrying about the delicate and finicky ribbon cables the Laptop 13 uses. Practically, the most important aspect of this customizable keyboard area is that it lets you decide whether you want to install a dedicated number pad or not; this also allows you to choose whether you want the trackpad to be aligned with the center of the laptop or with wherever the middle of the keyboard is.

It might look a little rough, but the customizable keyboard deck is still probably the coolest thing about the Laptop 16 in day-to-day use. Andrew Cunningham

But Framework also sells an assortment of other functional and cosmetic panels and spacers to let users customize the laptop to their liking. The coolest, oddest accessories are still probably the LED matrix spacers and the clear, legend-less keyboard and number pad modules. We still think this assortment of panels gives the system a vaguely unfinished look, but Framework is clearly going for function over form here.

The Laptop 16 also continues to use Framework’s customizable, swappable Expansion Card modules. In theory, these let you pick the number and type of ports your laptop has, as well as customize your port setup on the fly based on what you need. But as with all AMD Ryzen-based Framework Laptops, there are some limits to what each port can do.

According to Framework’s support page, there’s no single Expansion Card slot that is truly universal:

Ports 1 and 4 support full 40Gbps USB 4 transfer speeds, display outputs, and up to 240 W charging, but if you use a USB-A Expansion Card in those slots, you’ll increase power use and reduce battery life.
Ports 2 and 4 support display outputs, up to 240 W charging, and lower power usage for USB-A ports, but they top out at 10Gbps USB 3.2 transfer speeds. Additionally, port 5 (the middle port on the right side of the laptop, if you’re looking at it head-on) supports the DisplayPort 1.4 standard where the others support DisplayPort 2.1.
Ports 3 and 4 are limited to 10Gbps USB 3.2 transfer speeds and don’t support display outputs or charging.

The Laptop 16 also doesn’t include a dedicated headphone jack, so users will need to burn one of their Expansion Card slots to get one.

Practically speaking, most users will be able to come up with a port arrangement that fits their needs, and it’s still handy to be able to add and remove things like Ethernet ports, HDMI ports, or SD card readers on an as-needed basis. But choosing the right Expansion Card slot for the job will still require some forethought, and customizable ports aren’t as much of a selling point for a 16-inch laptop as they are for a 13-inch laptop (the Framework Laptop 13 was partly a response to laptops like the MacBook Air and Dell XPS 13 that only came with a small number of USB-C ports; larger laptops have mostly kept their larger number and variety of ports).

What’s new in 2025’s Framework Laptop 16?

An upgraded motherboard and a new graphics module form the heart of this year’s Laptop 16 upgrade. The motherboard steps up from AMD Ryzen 7040-series processors to AMD Ryzen AI 7 350 and Ryzen AI 9 HX 370 chips. These are the same processors Framework put into the Laptop 13 earlier this year, though they ought to be able to run a bit faster in the Laptop 16 due to its larger heatsink and dual-fan cooling system.

Along with an upgrade from Zen 4-based CPU cores to Zen 5 cores, the Ryzen AI series includes an upgraded neural processing unit (NPU) that is fast enough to earn Microsoft’s Copilot+ PC label. These PCs have access to a handful of unique Windows 11 AI and machine-learning features (yes, Recall, but not just Recall) that are processed locally rather than in the cloud. If you don’t care about these features, you can mostly just ignore them, but if you do care, this is the first version of the Laptop 16 to support them.

Most of the new motherboard’s other specs and features are pretty similar to the first-generation version; there are two SO-DIMM slots for up to 96GB of DDR5-5600, one M.2 2280 slot for the system’s main SSD, and one M.2 2230 slot for a secondary SSD. Wi-Fi 7 and Bluetooth connectivity are provided by an AMD RZ717 Wi-Fi card that can at least theoretically also be replaced with something faster down the line if you want.

The more exciting upgrade, however, may be the GeForce RTX 5070 GPU. This is the first time Framework has offered an Nvidia product—its other GPUs have all come from either Intel or AMD—and it gives the new Laptop 16 access to Nvidia technologies like DLSS and CUDA, as well as much-improved performance for games with ray-traced lighting effects.

Those hoping for truly high-end graphics options for the Laptop 16 will need to keep waiting, though. The laptop version of the RTX 5070 is actually the same chip as the desktop version of the RTX 5060, a $300 graphics card with 8GB of RAM. As much as it adds to the Laptop 16, it still won’t let you come anywhere near 4K in most modern games, and for some, it may even struggle to take full advantage of the internal 165 Hz 1600p screen. Professional workloads (including AI workloads) that require more graphics RAM will also find the mobile 5070 lacking.

Old 180 W charger on top, new 240 W charger on bottom. Credit: Andrew Cunningham

Other components have gotten small updates as well. For those who upgrade an existing Laptop 16 with the new motherboard, Framework is selling 2nd-generation keyboard and number pad components. But their main update over the originals is new firmware that “includes a fix to prevent the system from waking while carried in a bag.” Owners of the original keyboard can install a firmware update to get the same functionality (and make their input modules compatible with the new board).

Upgraders should also note that the original system’s 180 W power adapter has been replaced with a 240 W model, the maximum amount of power that current USB-C and USB-PD standards are capable of delivering. You can charge the laptop with just about any USB-C power brick, but anything lower than 240 W risks reducing performance (or having the battery drain faster than it can charge).

Finally, the laptop uses a second-generation 16-inch, 2560×1600, 165 Hz LCD screen. It’s essentially identical in every way to the first-generation screen, but it formally supports G-Sync, Nvidia’s adaptive sync implementation. The original screen can still be used with the new motherboard, but it only supports AMD’s FreeSync, and Framework told us a few months ago that the panel supplier had no experience providing consumer-facing firmware updates that might add G-Sync to the old display. It’s probably not worth replacing the entire screen for, but it’s worth noting whether you’re upgrading the laptop or buying a new one.

Performance

Framework sent us the lower-end Ryzen AI 7 350 processor configuration for our new board, making it difficult to do straightforward apples-to-apples comparisons to the high-end Ryzen 9 7940HS in our first-generation Framework board. We did test the new chip, and you’ll see its results in our charts.

We’ve also provided numbers from the Ryzen AI 9 HX 370 in the Asus Zenbook S16 UM5606W to show approximately where you can expect the high-end Framework Laptop 16 configuration to land (Framework’s integrated graphics performance will be marginally worse since it’s using slower socketed RAM rather than LPDDR5X; other numbers may differ based on how each manufacturer has configured the chip’s power usage and thermal behavior). We’ve also included numbers from the same chip in the Framework Laptop 13, though Framework’s spec sheets indicate that the chips have different power limits and thus will perform differently.

We were able to test the new GeForce GPU in multiple configurations—both paired with the new Ryzen AI 7 350 processor and with the old Ryzen 9 7940HS chip. This should give anyone who bought the original Laptop 16 an idea of what kind of performance increase they can expect from the new GPU alone. In all, we’ve tested or re-tested:

The Ryzen 7 7940HS CPU from the first-generation Laptop 16 and its integrated Radeon 780M GPU
The Ryzen 7 7940HS and the original Radeon RX 7700S GPU module
The Ryzen 7 7940HS and the new GeForce RTX 5070 GPU module, for upgraders who only want to grab the new GPU
The Ryzen AI 7 350 CPU and the GeForce RTX 5070 GPU

We also did some light testing on the Radeon 860M integrated GPU included with the Ryzen AI 7 350.

All the Laptop 16 performance tests were run with Windows’ Best Performance power preset enabled, which will slightly boost performance at the expense of power efficiency.

Given all of those hardware combinations, we simply ran out of time to test the new motherboard with the old Radeon RX 7700S GPU—Framework is continuing to sell it, so it is a realistic combination of components. But our RTX 5070 testing suggests that these GPUs will perform pretty much the same regardless of which CPU you pair them with.

If you’re buying the cheaper Laptop 16 with the Ryzen AI 7 350, the good news is that it generally performs at least as well as—and usually a bit better than—the high-end Ryzen 9 7940HS from the last-generation model. Performance is also pretty similar to the Ryzen AI 9 HX 370 in smaller, thinner laptops—the extra power and cooling capacity in the Laptop 16 is paying off here. People choosing between a PC and a Mac should note that none of these Ryzen chips come anywhere near the M4 Pro used in comparably priced 16-inch MacBook Pros, but that’s just where the PC ecosystem is these days.

How big an upgrade the GeForce 5070 will be depends on the game you’re playing. In titles like Borderlands 3 that naturally run a bit better on AMD’s GPUs, there’s not much of a difference at all. In games like Cyberpunk 2077 with heavy ray-tracing effects enabled, the mobile RTX 5070 can be nearly twice as fast as the RX 7700S.

Most games will fall somewhere in between those two extremes; our tests show that the improvements hover between 20 and 30 percent most of the time, just a shade less than the 30 to 40 percent improvement that Framework claimed in its original announcement.

Beyond raw performance, the other thing you get with an Nvidia GPU is access to a bunch of important proprietary technologies like DLSS upscaling and CUDA—these technologies are often better and more widely supported than the equivalent technologies that AMD’s or Intel’s GPUs use, thanks in part to Nvidia’s overall dominance of the dedicated GPU market.

In the tests we’ve run on them, the Radeon 860M and 890M are both respectable integrated GPUs (the lower-end 860M typically falls just short of last generation’s top-end 780M, but it’s very close). They’re never able to provide more than a fraction of the Radeon RX 7700S’s performance, let alone the RTX 5070, but they’ll handle a lot of lighter games at 1080p. I would not buy a system this large or heavy just to use it with an integrated GPU.

Better to be unique than perfect

It’s expensive and quirky, but the Framework Laptop 16 is worth considering because it’s so different from what most other laptop makers are doing. Credit: Andrew Cunningham

Our original Framework Laptop 16 review called it “fascinating but flawed,” and the parts that made it flawed haven’t really changed much over the last two years. It’s still relatively large and heavy; the Expansion Card system still makes less sense in a larger laptop than it does in a thin-and-light; the puzzle-like grid of input modules and spacers looks kind of rough and unfinished.

But the upgrades do help to shift things in the Laptop 16’s favor. Its modular and upgradeable design was always a theoretical selling point, but the laptop now actually offers options that other laptops don’t.

The presence of both AMD and Nvidia GPUs is a big step up in flexibility for both gaming and professional applications. The GeForce module is a better all-around choice, with slightly to significantly faster game performance and proprietary technologies like DLSS and CUDA, while the Radeon GPU is a cheaper option with better support for Linux.

Given their cost, I still wish that these GPUs were more powerful—they’re between $350 or $449 for the Radeon RX 7700S and between $650 and $699 for the RTX 5070 (prices vary a bit and are cheaper when you’re buying them together with a new laptop rather than buying them separately). You’ll basically always spend more for a gaming laptop than you will for a gaming desktop with similar or better performance, but that does feel like an awful lot to spend for GPUs that are still limited to 8GB of RAM.

Cost is a major issue for the Laptop 16 in general. You may save money in the long run by buying a laptop that you can replace piece-by-piece as you need to rather than all at once. But it’s not even remotely difficult to find similar specs from the major PC makers for hundreds of dollars less. We can’t vouch for the build quality or longevity of any of those PCs, but it does mean that you have to be willing to pay an awful lot just for Framework’s modularity and upgradeability. That’s true to some degree of the Laptop 13 as well, but the price gap between the 13 and competing systems isn’t as large as it is for the 16.

Whatever its lingering issues, the Framework Laptop 16 is still worth considering because there’s nothing else quite like it, at least if you’re in the market for something semi-portable and semi-powerful. The MacBook Pro exists if you want something more appliance-like, and there’s a whole spectrum of gaming and workstation PCs in between with all kinds of specs, sizes, and prices. To stand out from those devices, it’s probably better to be unique than to be perfect, and the reformulated Laptop 16 certainly clears that bar.

The good

Modular, repairable, upgradeable design that’s made to last
Cool, customizable keyboard deck
Nvidia GeForce GPU option gives the Laptop 16 access to some gaming and GPU computing features that weren’t usable with AMD GPUs
GPU upgrade can be added to first-generation Framework Laptop 16
New processors are a decent performance improvement and are worth considering for new buyers
Old Ryzen 7040-series motherboard is sticking around as an entry-level option, knocking $100 off the former base price ($1,299 and up for a barebones DIY edition, $1,599 and up for the cheapest pre-built)
Framework’s software support has gotten better in the last year

The bad

Big and bulky for the specs you get
Mix-and-match input modules and spacers give it a rough, unfinished sort of look
Ryzen AI motherboards are more expensive than the originals were when they launched

The ugly

It’ll cost you—the absolute bare minimum price for Ryzen AI 7 350 and RTX 5070 combo is $2,149, and that’s without RAM, an SSD, or an operating system

Andrew is a Senior Technology Reporter at Ars Technica, with a focus on consumer tech including computer hardware and in-depth reviews of operating systems like Windows and macOS. Andrew lives in Philadelphia and co-hosts a weekly book podcast called Overdue.

Review: New Framework Laptop 16 takes a fresh stab at the upgradeable laptop GPU Read More »

OpenAI signs massive AI compute deal with Amazon

AI, AI chips, AI infrastructure, Amazon, AWS, Biz & IT, chatbots, datacenters, generative ai, Google, large language models, machine learning, microsoft, NVIDIA, openai, oracle, sam altman / Shannon Garcia / November 3, 2025

On Monday, OpenAI announced it has signed a seven-year, $38 billion deal to buy cloud services from Amazon Web Services to power products like ChatGPT and Sora. It’s the company’s first big computing deal after a fundamental restructuring last week that gave OpenAI more operational and financial freedom from Microsoft.

The agreement gives OpenAI access to hundreds of thousands of Nvidia graphics processors to train and run its AI models. “Scaling frontier AI requires massive, reliable compute,” OpenAI CEO Sam Altman said in a statement. “Our partnership with AWS strengthens the broad compute ecosystem that will power this next era and bring advanced AI to everyone.”

OpenAI will reportedly use Amazon Web Services immediately, with all planned capacity set to come online by the end of 2026 and room to expand further in 2027 and beyond. Amazon plans to roll out hundreds of thousands of chips, including Nvidia’s GB200 and GB300 AI accelerators, in data clusters built to power ChatGPT’s responses, generate AI videos, and train OpenAI’s next wave of models.

Wall Street apparently liked the deal, because Amazon shares hit an all-time high on Monday morning. Meanwhile, shares for long-time OpenAI investor and partner Microsoft briefly dipped following the announcement.

Massive AI compute requirements

It’s no secret that running generative AI models for hundreds of millions of people currently requires a lot of computing power. Amid chip shortages over the past few years, finding sources of that computing muscle has been tricky. OpenAI is reportedly working on its own GPU hardware to help alleviate the strain.

But for now, the company needs to find new sources of Nvidia chips, which accelerate AI computations. Altman has previously said that the company plans to spend $1.4 trillion to develop 30 gigawatts of computing resources, an amount that is enough to roughly power 25 million US homes, according to Reuters.

OpenAI signs massive AI compute deal with Amazon Read More »

Nvidia hits record $5 trillion mark as CEO dismisses AI bubble concerns

AI, AI chips, AI infrastructure, Apple, Biz & IT, Blackwell chips, data centers, Donald Trump, GPUs, Jensen Huang, machine learning, microsoft, Nokia, NVIDIA, openai, palantir, semiconductors, Uber / DJ Henderson / October 29, 2025

Partnerships and government contracts fuel optimism

At the GTC conference on Tuesday, Nvidia’s CEO went out of his way to repeatedly praise Donald Trump and his policies for accelerating domestic tech investment while warning that excluding China from Nvidia’s ecosystem could limit US access to half the world’s AI developers. The overall event stressed Nvidia’s role as an American company, with Huang even nodding to Trump’s signature slogan in his sign-off by thanking the audience for “making America great again.”

Trump’s cooperation is paramount for Nvidia because US export controls have effectively blocked Nvidia’s AI chips from China, costing the company billions of dollars in revenue. Bob O’Donnell of TECHnalysis Research told Reuters that “Nvidia clearly brought their story to DC to both educate and gain favor with the US government. They managed to hit most of the hottest and most influential topics in tech.”

Beyond the political messaging, Huang announced a series of partnerships and deals that apparently helped ease investor concerns about Nvidia’s future. The company announced collaborations with Uber Technologies, Palantir Technologies, and CrowdStrike Holdings, among others. Nvidia also revealed a $1 billion investment in Nokia to support the telecommunications company’s shift toward AI and 6G networking.

The agreement with Uber will power a fleet of 100,000 self-driving vehicles with Nvidia technology, with automaker Stellantis among the first to deliver the robotaxis. Palantir will pair Nvidia’s technology with its Ontology platform to use AI techniques for logistics insights, with Lowe’s as an early adopter. Eli Lilly plans to build what Nvidia described as the most powerful supercomputer owned and operated by a pharmaceutical company, relying on more than 1,000 Blackwell AI accelerator chips.

The $5 trillion valuation surpasses the total cryptocurrency market value and equals roughly half the size of the pan European Stoxx 600 equities index, Reuters notes. At current prices, Huang’s stake in Nvidia would be worth about $179.2 billion, making him the world’s eighth-richest person.

Nvidia hits record $5 trillion mark as CEO dismisses AI bubble concerns Read More »

New physical attacks are quickly diluting secure enclave defenses from Nvidia, AMD, and Intel

AMD, battering ram, Biz & IT, Features, intel, NVIDIA, secure enclaves, Security, tee.fail, trusted execution environments, wiretap / Shannon Garcia / October 29, 2025

On-chip TEEs withstand rooted OSes but fall instantly to cheap physical attacks.

Trusted execution environments, or TEEs, are everywhere—in blockchain architectures, virtually every cloud service, and computing involving AI, finance, and defense contractors. It’s hard to overstate the reliance that entire industries have on three TEEs in particular: Confidential Compute from Nvidia, SEV-SNP from AMD, and SGX and TDX from Intel. All three come with assurances that confidential data and sensitive computing can’t be viewed or altered, even if a server has suffered a complete compromise of the operating kernel.

A trio of novel physical attacks raises new questions about the true security offered by these TEES and the exaggerated promises and misconceptions coming from the big and small players using them.

The most recent attack, released Tuesday, is known as TEE.fail. It defeats the latest TEE protections from all three chipmakers. The low-cost, low-complexity attack works by placing a small piece of hardware between a single physical memory chip and the motherboard slot it plugs into. It also requires the attacker to compromise the operating system kernel. Once this three-minute attack is completed, Confidential Compute, SEV-SNP, and TDX/SDX can no longer be trusted. Unlike the Battering RAM and Wiretap attacks from last month—which worked only against CPUs using DDR4 memory—TEE.fail works against DDR5, allowing them to work against the latest TEEs.

Some terms apply

All three chipmakers exclude physical attacks from threat models for their TEEs, also known as secure enclaves. Instead, assurances are limited to protecting data and execution from viewing or tampering, even when the kernel OS running the processor has been compromised. None of the chipmakers make these carveouts prominent, and they sometimes provide confusing statements about the TEE protections offered.

Many users of these TEEs make public assertions about the protections that are flat-out wrong, misleading, or unclear. All three chipmakers and many TEE users focus on the suitability of the enclaves for protecting servers on a network edge, which are often located in remote locations, where physical access is a top threat.

“These features keep getting broken, but that doesn’t stop vendors from selling them for these use cases—and people keep believing them and spending time using them,” said HD Moore, a security researcher and the founder and CEO of runZero.

He continued:

Overall, it’s hard for a customer to know what they are getting when they buy confidential computing in the cloud. For on-premise deployments, it may not be obvious that physical attacks (including side channels) are specifically out of scope. This research shows that server-side TEEs are not effective against physical attacks, and even more surprising, Intel and AMD consider these out of scope. If you were expecting TEEs to provide private computing in untrusted data centers, these attacks should change your mind.

Those making these statements run the gamut from cloud providers to AI engines, blockchain platforms, and even the chipmakers themselves. Here are some examples:

Cloudflare says it’s using Secure Memory Encryption—the encryption engine driving SEV—to safeguard confidential data from being extracted from a server if it’s stolen.
In a post outlining the possibility of using the TEEs to secure confidential information discussed in chat sessions, Anthropic says the enclave “includes protections against physical attacks.”
Microsoft marketing (here and here) devotes plenty of ink to discussing TEE protections without ever noting the exclusion.
Meta, paraphrasing the Confidential Computing Consortium, says TEE security provides protections against malicious “system administrators, the infrastructure owner, or anyone else with physical access to the hardware.” SEV-SNP is a key pillar supporting the security of Meta’s WhatsApp Messenger.
Even Nvidia claims that its TEE security protects against “infrastructure owners such as cloud providers, or anyone with physical access to the servers.”
The maker of the Signal private messenger assures users that its use of SGX means that “keys associated with this encryption never leave the underlying CPU, so they’re not accessible to the server owners or anyone else with access to server infrastructure.” Signal has long relied on SGX to protect contact-discovery data.

I counted more than a dozen other organizations providing assurances that were similarly confusing, misleading, or false. Even Moore—a security veteran with more than three decades of experience—told me: “The surprising part to me is that Intel/AMD would blanket-state that physical access is somehow out of scope when it’s the entire point.”

In fairness, some TEE users build additional protections on top of the TEEs provided out of the box. Meta, for example, said in an email that the WhatsApp implementation of SEV-SNP uses protections that would block TEE.fail attackers from impersonating its servers. The company didn’t dispute that TEE.fail could nonetheless pull secrets from the AMD TEE.

The Cloudflare theft protection, meanwhile, relies on SME—the engine driving SEV-SNP encryption. The researchers didn’t directly test SME against TEE.fail. They did note that SME uses deterministic encryption, the cryptographic property that causes all three TEEs to fail. (More about the role of deterministic encryption later.)

Others who misstate the TEEs’ protections provide more accurate descriptions elsewhere. Given all the conflicting information, it’s no wonder there’s confusion.

How do you know where the server is? You don’t.

Many TEE users run their infrastructure inside cloud providers such as AWS, Azure, or Google, where protections against supply-chain and physical attacks are extremely robust. That raises the bar for a TEE.fail-style attack significantly. (Whether the services could be compelled by governments with valid subpoenas to attack their own TEE is not clear.)

All these caveats notwithstanding, there’s often (1) little discussion of the growing viability of cheap, physical attacks, (2) no evidence (yet) that implementations not vulnerable to the three attacks won’t fall to follow-on research, or (3) no way for parties relying on TEEs to know where the servers are running and whether they’re free from physical compromise.

“We don’t know where the hardware is,” Daniel Genkin, one of the researchers behind both TEE.fail and Wiretap, said in an interview. “From a user perspective, I don’t even have a way to verify where the server is. Therefore, I have no way to verify if it’s in a reputable facility or an attacker’s basement.”

In other words, parties relying on attestations from servers in the cloud are once again reduced to simply trusting other people’s computers. As Moore observed, solving that problem is precisely the reason TEEs exist.

In at least two cases, involving the blockchain services Secret Network and Crust, the loss of TEE protections made it possible for any untrusted user to present cryptographic attestations. Both platforms used the attestations to verify that a blockchain node operated by one user couldn’t tamper with the execution or data passing to another user’s nodes. The Wiretap hack on SGX made it possible for users to run the sensitive data and executions outside of the TEE altogether while still providing attestations to the contrary. In the AMD attack, the attacker could decrypt the traffic passing through the TEE.

Both Secret Network and Crust added mitigations after learning of the possible physical attacks with Wiretap and Battering RAM. Given the lack of clear messaging, other TEE users are likely making similar mistakes.

A predetermined weakness

The root cause of all three physical attacks is the choice of deterministic encryption. This form of encryption produces the same ciphertext each time the same plaintext is encrypted with the same key. A TEE.fail attacker can copy ciphertext strings and use them in replay attacks. (Probabilistic encryption, by contrast, resists such attacks because the same plaintext can encrypt to a wide range of ciphertexts that are randomly chosen during the encryption process.)

TEE.fail works not only against SGX but also a more advanced Intel TEE known as TDX. The attack also defeats the protections provided by the latest Nvidia Confidential Compute and AMD SEV-SNP TEEs. Attacks against TDX and SGX can extract the Attestation Key, an ECDSA secret that certifies to a remote party that it’s running up-to-date software and can’t expose data or execution running inside the enclave. This Attestation Key is in turn signed by an Intel X.509 digital certificate providing cryptographic assurances that the ECDSA key can be trusted. TEE.fail works against all Intel CPUs currently supporting TDX and SDX.

With possession of the key, the attacker can use the compromised server to peer into data or tamper with the code flowing through the enclave and send the relying party an assurance that the device is secure. With this key, even CPUs built by other chipmakers can send an attestation that the hardware is protected by the Intel TEEs.

GPUs equipped with Nvidia Confidential Compute don’t bind attestation reports to the specific virtual machine protected by a specific GPU. TEE.fail exploits this weakness by “borrowing” a valid attestation report from a GPU run by the attacker and using it to impersonate the GPU running Confidential Compute. The protection is available on Nvidia’s H100/200 and B100/200 server GPUs.

“This means that we can convince users that their applications (think private chats with LLMs or Large Language Models) are being protected inside the GPU’s TEE while in fact it is running in the clear,” the researchers wrote on a website detailing the attack. “As the attestation report is ‘borrowed,’ we don’t even own a GPU to begin with.”

SEV-SNP (Secure Encrypted Virtualization-Secure Nested Paging) uses ciphertext hiding in AMD’s EPYC CPUs based on the Zen 5 architecture. AMD added it to prevent a previous attack known as Cipherleaks, which allowed malicious hypervisors to extract cryptographic keys stored in the enclaves of a virtual machine. Ciphertext, however, doesn’t stop physical attacks. With the ability to reopen the side channel that Cipherleaks relies on, TEE.fail can steal OpenSSL credentials and other key material based on constant-time encryption.

Cheap, quick, and the size of a briefcase

“Now that we have interpositioned DDR5 traffic, our work shows that even the most modern of TEEs across all vendors with available hardware is vulnerable to cheap physical attacks,” Genkin said.

The equipment required by TEE.fail runs off-the-shelf gear that costs less than $1,000. One of the devices the researchers built fits into a 17-inch briefcase, so it can be smuggled into a facility housing a TEE-protected server. Once the physical attack is performed, the device does not need to be connected again. Attackers breaking TEEs on servers they operate have no need for stealth, allowing them to use a larger device, which the researchers also built.

A logic analyzer attached to an interposer.

The researchers demonstrated attacks against an array of services that rely on the chipmakers’ TEE protections. (For ethical reasons, the attacks were carried out against infrastructure that was identical to but separate from the targets’ networks.) Some of the attacks included BuilderNet, dstack, and Secret Network.

BuilderNet is a network of Ethereum block builders that uses TDX to prevent parties from snooping on others’ data and to ensure fairness and that proof currency is redistributed honestly. The network builds blocks valued at millions of dollars each month.

“We demonstrated that a malicious operator with an attestation key could join BuilderNet and obtain configuration secrets, including the ability to decrypt confidential orderflow and access the Ethereum wallet for paying validators,” the TEE.fail website explained. “Additionally, a malicious operator could build arbitrary blocks or frontrun (i.e., construct a new transaction with higher fees to ensure theirs is executed first) the confidential transactions for profit while still providing deniability.”

To date, the researchers said, BuilderNet hasn’t provided mitigations. Attempts to reach BuilderNet officials were unsuccessful.

dstack is a tool for building confidential applications that run on top of virtual machines protected by Nvidia Confidential Compute. The researchers used TEE.fail to forge attestations certifying that a workload was performed by the TDX using the Nvidia protection. It also used the “borrowed” attestations to fake ownership of GPUs that a relying party trusts.

Secret Network is a platform billing itself as the “first mainnet blockchain with privacy-preserving smart contracts,” in part by encrypting on-chain data and execution with SGX. The researchers showed that TEE.fail could extract the “Concensus Seed,” the primary network-side private key encrypting confidential transactions on the Secret Network. As noted, after learning of Wiretap, the Secret Network eliminated this possibility by establishing a “curated” allowlist of known, trusted nodes allowed on the network and suspended the acceptance of new nodes. Academic or not, the ability to replicate the attack using TEE.fail shows that Wiretap wasn’t a one-off success.

A tough nut to crack

As explained earlier, the root cause of all the TEE.fail attacks is deterministic encryption, which forms the basis for protections in all three chipmakers’ TEEs. This weaker form of encryption wasn’t always used in TEEs. When Intel initially rolled out SGX, the feature was put in client CPUs, not server ones, to prevent users from building devices that could extract copyrighted content such as high-definition video.

Those early versions encrypted no more than 256MB of RAM, a small enough space to use the much stronger probabilistic form of encryption. The TEEs built into server chips, by contrast, must often encrypt terabytes of RAM. Probabilistic encryption doesn’t scale to that size without serious performance penalties. Finding a solution that accommodates this overhead won’t be easy.

One mitigation over the short term is to ensure that each 128-bit block of ciphertext has sufficient entropy. Adding random plaintext to the blocks prevents ciphertext repetition. The researchers say the entropy can be added by building a custom memory layout that inserts a 64-bit counter with a random initial value to each 64-bit block before encrypting it.

The last countermeasure the researchers proposed is adding location verification to the attestation mechanism. While insider and supply chain attacks remain a possibility inside even the most reputable cloud services, strict policies make them much less feasible. Even those mitigations, however, don’t foreclose the threat of a government agency with a valid subpoena ordering an organization to run such an attack inside their network.

In a statement, Nvidia said:

NVIDIA is aware of this research. Physical controls in addition to trust controls such as those provided by Intel TDX reduce the risk to GPUs for this style of attack, based on our discussions with the researchers. We will provide further details once the research is published.

Intel spokesman Jerry Bryant said:

Fully addressing physical attacks on memory by adding more comprehensive confidentiality, integrity and anti-replay protection results in significant trade-offs to Total Cost of Ownership. Intel continues to innovate in this area to find acceptable solutions that offer better balance between protections and TCO trade-offs.

The company has published responses here and here reiterating that physical attacks are out of scope for both TDX and SGX

AMD didn’t respond to a request for comment.

Stuck on Band-Aids

For now, TEE.fail, Wiretap, and Battering RAM remain a persistent threat that isn’t solved with the use of default implementations of the chipmakers’ secure enclaves. The most effective mitigation for the time being is for TEE users to understand the limitations and curb uses that the chipmakers say aren’t a part of the TEE threat model. Secret Network tightening requirements for operators joining the network is an example of such a mitigation.

Moore, the founder and CEO of RunZero, said that companies with big budgets can rely on custom solutions built by larger cloud services. AWS, for example, makes use of the Nitro Card, which is built using ASIC chips that accelerate processing using TEEs. Google’s proprietary answer is Titanium.

“It’s a really hard problem,” Moore said. “I’m not sure what the current state of the art is, but if you can’t afford custom hardware, the best you can do is rely on the CPU provider’s TEE, and this research shows how weak this is from the perspective of an attacker with physical access. The enclave is really a Band-Aid or hardening mechanism over a really difficult problem, and it’s both imperfect and dangerous if compromised, for all sorts of reasons.”

Dan Goodin is Senior Security Editor at Ars Technica, where he oversees coverage of malware, computer espionage, botnets, hardware hacking, encryption, and passwords. In his spare time, he enjoys gardening, cooking, and following the independent music scene. Dan is based in San Francisco. Follow him at here on Mastodon and here on Bluesky. Contact him on Signal at DanArs.82.

New physical attacks are quickly diluting secure enclave defenses from Nvidia, AMD, and Intel Read More »