The objective of the proposed research is to chart the design space of realistic CPU hardware trojan attacks, focusing on control reliability and post-deployment survivability rather than merely minimizing a trojan’s footprint. We first show that OS-driven context switches inhibit CPU-aimed hardware trojan atacks; to mitigate this we introduce IRT, a trojan design resilient to asynchronous interrupts and suitable for insertion during the fabrication stage. Next, we relax the common but restrictive assumption that attackers require arbitrary code execution (RCE) to control trojans on victim devices; instead we propose SURF, which leverages the hardware manifestation of JavaScript memory indexing operations to reliably activate payloads via runtime engines. SURF demonstrates, for the first time, that CPU trojans can be controlled through ubiquitous runtime systems, increasing the trojan attack generality and scalability on commercial devices. Finally, we outline ongoing research on parametric trojans with distinct trigger sequences that allow attacker-side identification, while protecting the deployed CPU trojans even after one trojan instance is discovered. Together, these contributions advance a more practical understanding of how CPU hardware trojans can persist and operate in real-world systems.