This is the big concern behind Intel Management Engine. I personally don't trust it one bit. It's a closed source blob that's been exploited before:

[1] https://www.trendmicro.com/en_us/research/17/k/mitigating-cv...