Apple, AMD, and Qualcomm GPUs leak AI data via new flaw

For decades, the chip industry obsessed over CPU memory isolation. In that world, leaking even a single bit of data is considered a disaster.

GPUs, however, grew up under entirely different rules. They were engineered for raw graphics horsepower and massive parallel rendering, not cryptographic multi-tenant isolation. Now that everyone is running local LLMs on consumer silicon, that architectural blind spot is coming back to bite.

Researchers at cybersecurity firm Trail of Bits just disclosed LeftoverLocals, a vulnerability in mainstream GPUs from Apple, AMD, and Qualcomm. With less than 10 lines of code, an attacker sharing a system can siphon megabytes of residual data straight from GPU local memory.

Eavesdropping on local AI with ten lines of code

Modern operating systems rely on memory boundaries to ensure programs can't peek into each other's workspaces. LeftoverLocals punctures that wall on vulnerable GPUs.

When you run an open-source model locally using frameworks like Llama.cpp, the GPU processes queries, outputs, and floating-point weights through specialized programs called kernels. Trail of Bits demonstrated that a malicious co-resident process using standard interfaces like Metal, Vulkan, or OpenCL—without requiring elevated root privileges—can listen in on those compute kernels.

In testing, the exploit harvested between 5MB and 180MB of leftover GPU memory per query. In a simulated run against a 7B-parameter model on an AMD Radeon RX 7900 XT, researchers exfiltrated 181MB of data per prompt, effortlessly reconstructing the conversation.

Trail of Bits evaluated 11 chips across seven vendors last summer, reporting the issue via the US-CERT Coordination Center and the Khronos Group in September. While tested Nvidia, Intel, and Arm GPUs showed no signs of the flaw, Apple, AMD, and Qualcomm all confirmed their hardware is affected.

Patches are slow and millions of devices remain open

The blast radius covers everything from iPhone 12 Pro and M2 MacBook Air laptops to high-end AMD Radeon graphics cards.

Fixing it across millions of fielded chips is turning into a messy game of whack-a-mole. Apple silently baked hardware fixes into its latest M3 and A17 chips released late last year. Yet in follow-up tests conducted on January 10, researchers found an M2 MacBook Air was still fully exploitable, even as a 3rd-gen iPad Air on A12 appeared patched.

Qualcomm said it has released firmware patches to device makers, urging users to install incoming OEM updates. AMD published an advisory outlining optional mitigations scheduled for March. Google also stepped in, rolling out targeted patches for affected AMD and Qualcomm hardware inside ChromeOS devices.

Why it matters

We think LeftoverLocals delivers a reality check to the industry's on-device AI sales pitch. Hardware makers have spent the last six months telling consumers that local AI is the ultimate privacy sanctuary. As it turns out, running sensitive queries locally on consumer GPUs might leave your data exposed in memory space that was never properly scrubbed.

If you are an individual running local models on an M2 Mac or an AMD gaming rig, there is no need to panic immediately. An attacker still needs the ability to execute code on your machine. But in shared environments, multi-user workstations, or scenarios where untrusted apps can run GPU compute workloads, the risk is genuine.

For the silicon industry, this vulnerability marks the beginning of a painful architectural pivot. GPUs were never built with CPU-grade isolation because zeroing memory arrays degrades raw frame rates and inference throughput. Now that GPUs carry proprietary weights and private corporate conversations, vendors can no longer treat local memory like an unmonitored scratchpad. Balancing hardware security against generative AI speed is about to get a lot more expensive.