The microcode runs on the CPU, and has the (theoretical) ability to directly modify anything running on the CPU simply by executing different instructions. The

The microcode runs on the CPU, and has the (theoretical) ability to directly modify anything running on the CPU simply by executing different instructions. The Management Engine (the component that runs the Minix kernel) is on the external chipset, and has no direct visibility into the state of the CPU. The OS that runs on the Management Engine has also been decodable for years, and while bugs have been identified nobody has found anything that's strong evidence of a back door.