CPUs have undocumented features. Intel even has an extra core running it’s own OS, Minix. Look it up.
Hoever, to do real harm, it would need a way to communicate. To avoid this, Purism does not bundle it with Intel networking. For your scenario, it would not only need to send the found keys, it would also need to receive updates to adapt to new version of targeted crypto software. Theoretically possible, but rather unlikely.
Also, Purism removes the potentially malicious code from the CPU.
Look up “Purism Intel management engine”, especially the blog posts that will show up.
The OS has no (reliable) way of detecting malicious behavior of the machine that executes it. If you are male, go back to the beginning of this paragraph, and continue reading.
Now, either you are not male, or you just give a **** on my instructions. I can’t force you to obey my commands. Only if you reply will I know you were not captured in my infinite loop of reading that one paragraph 
In Pop culture, the concept that you don’t know whether you see reality was popularized by Matrix (movie).
In computers, the level of the OS that can access everything without restrictions is called ring 0. Your applications run in higher rings and only see what ring 0 allows them so see.
As modern CPUs have their own live, the need was seen to say the is a ring -1, and even ring -2.
To make things worse, if you update the firmware of your CPU, replacing it with a clean one from Purism, and it says “success” … How do you know that the CPU is not just pretending it did that? For 100% certainty you need a hardware flash tool that directly writes to the chip.
Just now, how do you know there is not a second, hidden firmware that is activated by a secret command? You don’t.
The movie on that is called Inception.
Sorry if now you will never again trust anything with a chip inside. Well, you shouldn’t trust them. But also, you shouldn’t have asked, Neo.
Now you need to follow the white rabbit all the way down the rabbit hole. (*)
Your welcome.
(*) While I thought that was a clever pun, I just realized that Matix already cites Alice in Wonderland, and Neo actually is supposed to go down the rabbit hole. Wonder if Alice met Bob at the mad tea party and they had a chat about cryptography in a crazy environment where you can trust nobody.