CPU backdoors that work by exploiting known software are entirely imaginable. Think of a situation where the bad guys target the network stack. They make a CPU

CPU backdoors that work by exploiting known software are entirely imaginable. Think of a situation where the bad guys target the network stack. They make a CPU that always executes instructions in exactly the correct way, except that if certain registers are filled with precisely specific data, the CPU turns of protection and suddenly jumps into whatever is pointed by one of the registers. Then target a network packet handling routine with that -- so if a specific malformed packet is received, the cpu jumps into the data payload. If your magic data is long enough (4 32-bit registers would be enough), no-one will ever trigger it by accident. Doing this would be trivial with the microcode in modern x86 cpus, and while it would break (no longer trigger) if the netcode is updated (or even recompiled), that's rather rare, and cpu ucode can be updated too.