The broken assumption is that cutting the network and turning the display dark is enough to contain an air-gapped machine. TrojPix shows that if malware can draw to the screen, the video path itself can become a covert transmitter, and “screen off” does not mean silent.
Researchers at Shandong University say their TrojPix demo uses imperceptible pixel changes that a nearby receiver can read as radio leakage from copper video cables. In lab tests it reached 8.1 Mbps, worked across nine monitor brands and fifteen cables, and needed only user-level malware with screen access; one mode even simulates a powered-off display while still transmitting.
The risk is not a new network break. It is a physical-layer leak that can move whole files out of high-side or classified systems even when the monitor appears off, which means copper video output is part of the trust boundary.