Google Cloud on Monday unveiled TPU 8tx, a confidential-computing AI system. Google's launch post promises that sensitive data and model weights stay "protected and isolated even while in active use," but it names no attestation method, threat model or independent audit that a regulated buyer could use to check that promise.

Google's Mark Lohmeyer said at a pre-announcement media briefing that the design protects model weights, prompts and enterprise data even from the system operator, according to Digital Daily. That raises a question the announcement does not answer: if a customer runs the building, who is the "operator" the hardware protects against?

Google also announced TPU 8i Max, a second new system, and said this is the first time introducing four TPU systems in a single year.

Why Confidential Computing Depends on Attestation, Not Only Encryption

Data is normally encrypted on disk and on the network, but it must be decrypted in memory while a processor works on it. Confidential computing closes that gap with hardware-based trusted execution environments (TEEs) that protect sensitive applications and data in use from the underlying host and hypervisor.

The protection only matters if a customer can confirm it is switched on. That confirmation is remote attestation: the hardware produces signed evidence of what is running, and the customer checks that evidence before releasing keys or data. Google's own June 23 post treats this as the point of the technology, describing remote attestation as the way to "cryptographically verify the environment before processing sensitive data" for Intel TDX virtual machines, and an independent verifier, Intel Trust Authority, as a way of "decoupling attestation verification from the cloud service provider" in Confidential Space.

That post does not mention TPUs, and the TPU 8tx post does not mention attestation. Google says only that TPU 8tx is built on the same silicon as TPU 8t and paired with 5th Generation AMD EPYC CPU hosts, and that the system provides "hardware-level confidential compute for private fine-tuning and secure agent execution." The post does not name the underlying confidential-computing technology, the isolation guarantees or any certification. Google also claims up to 2x lower latency than TPU 8t with a "near-zero performance penalty," without defining the baseline for that penalty. Those figures are Google's own claims, not independent benchmarks.

Digital Daily reported that Google said designing a chip takes years, while recombining existing silicon with different memory, networking and security can produce new systems in months rather than years. Because TPU 8tx pairs with AMD hosts, the host CPU's confidential-computing record is relevant to the AI system's security record.

Have AMD Confidential-VM Protections Been Broken Before?

Yes, under specific conditions. In January 2026, CISPA researchers disclosed StackWarp, tracked as CVE-2025-29943, a flaw that lets an attacker with privileged control of the host break AMD's SEV-SNP protections. The Hacker News reported that it affects Zen 1 through Zen 5 processors, and AMD's affected-product list includes EPYC 9005 Series parts, the 5th Generation family. The attack corrupts a confidential guest's stack pointer, and researchers reported that an attacker can recover an RSA-2048 private key from a single faulty signature. AMD's bulletin lists two severity ratings: 3.2 (Low) under CVSS v3.1 and 4.6 (Medium) under CVSS v4, with firmware releases dated from June 2025 through February 2026.

Earlier research also targeted SEV-SNP. In October 2025, ETH Zürich researchers disclosed RMPocalypse, tracked as CVE-2025-0033, which exploits incomplete protection of the Reverse Map Table during initialization. A single 8-byte write can corrupt the entire table, which undermines SEV-SNP's integrity guarantees.

Two cautions apply. Google has not said that TPU 8tx uses SEV-SNP, so these findings describe the host CPU family Google named, not a confirmed design. And StackWarp requires an administrator-level attacker on the host, the same attacker confidential computing is meant to defend against, so the flaw bears directly on the "even from the system operator" claim.

Customer-Owned Data Centers Change Who the Operator Is

Google sells TPU systems for installation in customer facilities. Digital Daily reported that on Alphabet's third-quarter earnings call, Google Cloud CEO Thomas Kurian said the company is selling TPU systems directly for installation in customer data centers and working with providers including Oracle and Crux AI, because some industries cannot move data in their facilities to the cloud. Alphabet's 10-Q revenue-recognition note describes product sales of TPU systems that include hardware, software, installation, support and extended warranty services.

Google's launch post says customers can now deploy TPUs directly into their own data centers, but it lists that as a general TPU use case rather than a feature of TPU 8tx or TPU 8i Max.

That matters because a hardware isolation promise is defined by an adversary. In Google's cloud, the adversary is a cloud operator with privileged access. In a customer's data center, the privileged administrator is the customer's own staff, and Google's maintenance and support staff may need access too. The announcement does not say which of these the design is meant to exclude, how Google's support and warranty services work inside an isolated environment, or whether a customer in a regulated industry can obtain attestation evidence without Google's cooperation. The 10-Q note describes installation, support and extended warranty as part of the sale, but it does not describe security access.

TPU 8i Max Packs Two Inference Chips Into One Package

TPU 8i Max targets the memory bottleneck that appears when dozens of agents work across an entire codebase or hours of video at once. Google combined two low-latency TPU 8i chips on a single package, doubling compute, on-chip SRAM and high-bandwidth memory (HBM) bandwidth relative to TPU 8i. Because twice the silicon fits in the existing rack footprint, Google says data centers get more computing power per square foot and per watt.

Lohmeyer likened the approach to adding more lanes to the highway: individual requests do not necessarily run faster, but more work can flow at once. Data Center Knowledge reported that he put the package at 384 GB of high-bandwidth memory, but Google's blog post lists no absolute capacity, so treat the figure as a single-source claim.

Software Aims to Lower the Cost of Leaving Nvidia GPUs

Google paired the hardware with software that targets switching costs:

• TorchTPU: Google open-sourced TorchTPU so PyTorch code and Hugging Face models can run on TPUs, and vLLM and SGLang also have TPU backends.
• TPU Sync: tiers KV caches across chip HBM, host memory and shared storage; Google says it cuts KV transfer latency and time to first token by more than 90%.
• Agent Compute Engine: suspends and resumes idle sessions so compute is not tied up while agents wait.
• GKE dynamic slicing and Cloud Pathways: Cloud Pathways is generally available on Google Kubernetes Engine (GKE); Google says dynamic slicing cuts startup times by up to 5x and speeds fault recovery by up to 4.5x.

Digital Daily reported that on GKE, customers can set policies to split work between Nvidia GPUs and TPUs, for example falling back to TPU 8i when GPU capacity runs out.

TPU Inventory Weighed on Alphabet Cash Flow as Sales Forecasts Climb

Digital Daily reported that Alphabet cited TPU inventory purchases, along with $51.4 billion of third-quarter capital spending, as factors behind negative free cash flow of $9.1 billion. The outlet also reported that Alphabet expects TPU system sales to rise in the fourth quarter and related revenue to take off from 2027. Bloomberg Intelligence projects TPU sales rising from about $12 billion this year to more than $135 billion by 2028, excluding chips rented through Google Cloud. That is a forecast, not reported sales. Oracle has said Google TPUs will be available on OCI in 2027, with adoption ramping over a multi-year period.

What Google Has Not Disclosed About TPU 8tx

Google's announcement included no pricing, regions or availability dates for either new system.

For regulated buyers, five items would settle most of the open questions: the confidential-computing technology used, the attestation format and who can verify it, the threat model for on-premises installations, the treatment of Google support access, and any independent audit. Until Google publishes them, TPU 8tx's isolation promise is a vendor claim rather than something a buyer can check.

Frequently Asked Questions

What is Google TPU 8tx?

TPU 8tx is a Google Cloud system built on TPU 8t silicon and paired with 5th Generation AMD EPYC CPU hosts, and Google positions it for secure and confidential inference and small-scale training by regulated enterprises and governments.

Can companies run TPU 8tx in their own data centers?

Google says it is selling TPU systems directly for customer data centers, and its blog lists on-premises deployment as a TPU option. Google's launch post does not state that TPU 8tx specifically is offered that way, and no pricing or availability date has been published.

How can a customer verify that confidential computing is actually working?

Through remote attestation, in which hardware produces signed evidence of the running environment that the customer checks before releasing data or keys. Google describes how to cryptographically verify the environment for other confidential offerings, but its TPU 8tx launch post does not describe an attestation process.

Has AMD's confidential-computing technology been attacked?

Researchers have published attacks on AMD SEV-SNP, including StackWarp (CVE-2025-29943), which requires an administrator-level attacker on the host, and AMD has released microcode and firmware updates. Google has not said whether TPU 8tx relies on SEV-SNP.