On the same RTX A6000, 21.9 hours is 1,314 minutes, and 1,314 divided by 1.1 is about 1,195 [8][9]. That ratio is worth carrying into a vendor call. A campaign that needs most of a day to land is one a host has time to see and migrate away from; a campaign that lands inside two minutes fits between health checks. Slowness no longer provides defensive value, and monitoring cadences written when hammering was slow inherit that gap.
Why the correction logic gave way is a coverage story rather than a strength story. The earlier attacks hammered rows uniformly, which is what Target Row Refresh in DDR5 and later generations is built to spot, and single-bit results are what ECC repairs [4]. GPUThor hammers 6.6 times harder than its predecessors and produces between 500 and 23,500 times more flips [7], and at that volume the errors arrive several bits at a time. ECC was built to catch single-bit errors, and this attack produces multi-bit errors that fall outside what ECC checks for.
The lineage matters for how much weight to put on the current negative results. Rowhammer was demonstrated on DDR3 and DDR4 in 2015 [16]; GPUHammer found flips in Nvidia GDDR6 in 2025, and GPUBreach reached a root shell on the CPU in 2026 [5]; Nvidia's answer through that period, in a 2025 security notice, was to turn ECC on, and that answer worked against everything before this [6]. The Toronto group says the technique is general, that other GPUs using similar memory and defenses may be at risk, and that it has not ruled out patterns for the newer chips it intends to test [12]. This is workstation-class silicon tested in a university lab, which is a fair caveat on the record as it stands. But the record has now moved in the same direction three times.
The cost mechanism is the item least likely to be on a risk register. In testing described by CSO Online, cards crashed often enough that within a single day they flagged themselves as defective and due for replacement through their own crash detection [13]. On rented capacity, that is a tenant paying by the hour writing off an owner's asset, and the report does not settle who absorbs it [17].
The tradeoff is this: multi-tenant GPU capacity is cheaper because the card is time-shared, and these enterprise parts routinely serve several virtual machines at once [15], while the isolation that would blunt an attack ending in root for an unprivileged process [14] is the isolation that costs utilization. The answerable question this quarter is small: which card models sit under the instances being bought, and whether any of them are time-shared between tenants. If the HBM and GDDR7 parts continue to hold, that inventory exercise cost a week of someone's attention. If they do not, the buyer who already has model-level tenancy language in the contract renews next quarter from a stronger seat.
