Your AI Accelerator’s Attack Surface Now Runs on 120 Amps

Power delivery is a security boundary. Most people in AI security would call that a stretch, maybe a reach for relevance. I think it is one of the more under-examined trust assumptions in the entire accelerator stack, and Infineon’s latest announcement is a good reason to say so out loud.

On September 7, 2026, Infineon Technologies announced the TDA235E5 and TDA235E0, a dual-phase smart power stage family built for next-generation AI accelerators, server CPUs, and vertical power delivery modules. The parts combine OptiMOS 6 MOSFETs with a dual-phase driver IC in a 6 x 6 x 0.8 mm package. Power density exceeds 2 A/mm². Each device handles up to 300 A peak current and 120 A total design current, and supports both lateral and vertical power delivery configurations.

Those numbers will get read as a performance story. Fine. But read them again as a security researcher and a different picture shows up.

Why a Power Stage Belongs in Your Threat Model

The word that matters in “smart power stage” is smart. A driver IC is not a passive lump of copper. It makes decisions. It reports telemetry. It responds to commands from a controller. Anything that makes decisions and accepts input is, by definition, part of your attack surface, whether or not your threat model has a box for it.

When we talk about securing AI bots and the infrastructure they run on, the conversation almost always lives at the top of the stack. Prompt injection. Model weight exfiltration. Poisoned training data. Agent tool abuse. All real, all worth the attention they get. But a bot is only as trustworthy as the silicon underneath it, and the silicon is only as trustworthy as the power feeding it.

Consider what 120 A of design current per device actually means in practice. Densities like that leave less headroom between normal operation and thermal or electrical distress. That is not a criticism of the part; that is physics, and packing more power into 6 x 6 mm is the entire point of the product. But tight margins change the security calculus. Systems with narrow operating envelopes are systems where small manipulations produce large effects.

Three Questions I Would Ask

I do not have implementation details on these specific devices beyond what Infineon published, so treat what follows as the questions I would bring to any deployment, not claims about this family in particular.

• Who can talk to the power controller? Power management telemetry and control paths in servers often ride on buses that were designed for convenience rather than authentication. If a compromised BMC or a rogue management agent can request voltage and frequency changes, the question of what it can request becomes a security question.
• What does telemetry reveal? Fine-grained power data is a side channel. Current draw correlates with computation. On an accelerator running inference for many tenants, power traces are signal, and signal is something an attacker will try to read. Access controls on monitoring interfaces deserve the same scrutiny as access controls on the model endpoint.
• What happens at the limits? Peak current ratings describe engineering envelopes, not attacker budgets. Protection and fault behavior in the driver IC are where a manipulated command either gets refused or gets executed. That behavior is worth understanding before deployment, not after an incident.

Vertical Power Delivery Changes the Geometry

The support for both lateral and vertical configurations is the detail I find most interesting. Vertical power delivery puts the power stage physically closer to the processor, under it rather than beside it. Electrically, that is a clear win. Architecturally, it means the power subsystem and the compute subsystem are more tightly coupled than they used to be, sharing thermal reality and board real estate.

Tighter coupling is good for efficiency and complicates isolation. When components are physically intertwined, faults and side effects propagate in ways that are harder to reason about from a clean block diagram. Security teams who think in terms of separated domains should notice when hardware trends run the other direction.

What I Want From This Generation of Hardware

None of this is an argument against denser power delivery. AI accelerators need it, data centers need the efficiency, and Infineon is solving a real engineering problem with a real product. My argument is narrower: as power delivery gets smarter and more tightly integrated, it should inherit the security expectations we already apply to every other intelligent component in the box.

That means documented control interfaces. Clear statements about what authentication, if any, protects power management commands. Guidance on restricting telemetry access in multi-tenant environments. Firmware update paths for driver ICs that are signed and auditable. These are unglamorous asks, and vendors who answer them well will find that answering them becomes a competitive advantage once someone publishes the first good power-path attack against an accelerator cluster.

Defenders who run AI workloads can start smaller. Inventory what in your environment can issue power management commands. Check whether power telemetry is readable by anything that should not read it. Treat the power subsystem as in-scope during hardware reviews. A 300 A peak rating is an impressive spec sheet number and a reminder that the stakes underneath your models are measured in amps, not just tokens.

🕒 Published: September 29, 2026