Bit2Watt: How a Regular Cloud Customer Could Wobble the Power Grid

Key points

• Three researchers at Zhejiang University describe a technique called Bit2Watt, accepted to the CHES 2026 hardware-security conference.
• The attack needs no software flaw and no break-in, just a normal paid cloud account with access to a GPU (a specialised chip used for AI and graphics work).
• By running carefully timed workloads, a tenant can force a data centre's power draw to jump up and down fast enough to stress the electrical grid feeding it.
• The team measured real power swings on live hardware, then modelled what happens at full data-hall scale.
• The finding reframes cloud abuse as a physical-infrastructure problem, not purely a cyber one.

Here's an unusual one. A team at Zhejiang University claims that a regular cloud customer, the kind who pays by the hour for compute time, can rattle the power grid a data centre sits on. No exploit, no stolen password, just workloads.

They call it Bit2Watt. The paper has been accepted to CHES 2026, the annual hardware-security conference run by the International Association for Cryptologic Research. It's a serious venue, not a stunt.

The short version: rent some GPUs, the specialised chips that power AI training and 3D graphics, then run software that switches between heavy and light work on a precise rhythm. Modern GPUs draw huge amounts of electricity when busy and very little when idle. Flip enough of them together on the same beat and the whole building's power consumption starts to oscillate like a pendulum. Do that at the scale of a hyperscale data centre and the swing shows up on the electrical grid outside the fence.

Can a paying customer really shake the grid?

According to the researchers, yes, at least in principle, and they say they have the measurements to back part of it up. The evidence splits in two: direct power measurements on real hardware, and modelling of what happens when that pattern scales across a full data hall.

Think of it like everyone in an office block jumping in unison. One person, nothing. A thousand people on the same beat and the floor starts to move. Grids are engineered for smooth, predictable demand, and sudden synchronised spikes are exactly what grid operators dread because they can trip protection systems designed to prevent blackouts.

What makes Bit2Watt awkward is that nothing about it looks like an attack from a security team's dashboard. The tenant is running their own paid workload on their own rented machines. No malware, no unusual network traffic, no policy broken. It resembles a classic denial-of-service idea, flooding a resource to knock it over, but pointed at the electricity supply instead of a website.

It's the same shape as the noisy-neighbour problem in cloud computing, where one tenant hogs shared resources and slows others down, just aimed at the wall socket.

What should ordinary people take from this?

Not panic. This is a research paper, not a live incident, and there's no report of anyone using Bit2Watt in the wild. Pulling it off would need a lot of rented GPU time and a target data centre big enough to matter to the grid.

But it's a useful reminder, and one that fits a pattern we've been tracking. As we reported on 16 July, AI data centres are being built at speed while security assumptions lag behind. Bit2Watt is a concrete example of what that gap looks like when someone thinks carefully about the physics.

As AI workloads push data centres to draw as much electricity as small cities, a cloud bill and a grid disturbance are starting to live in the same conversation. For cloud providers, the homework is clear: watch for tenants whose power profile oscillates in suspicious patterns, cap how quickly workloads can ramp at the hardware level, and coordinate with the utilities that feed them.

For the rest of us, this is evidence that AI's appetite for power is now a security question, not just an environmental one. That's the part worth filing away.