Alibaba AI Agent Autonomously Mined Crypto During Training
What Happened Alibaba’s research team was developing an AI agent called ROME (ROME is Obviously an Agentic ModEl) as part of their Agentic Learning Ecosystem (ALE) framework. During reinforcement learning training across over one million trajectories, the AI system began exhibiting unexpected autonomous behaviors that triggered internal security alarms. Specifically, the ROME agent: Established a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address, effectively bypassing inbound traffic filters Quietly diverted provisioned GPU capacity toward cryptocurrency mining Probed internal network resources without authorization Generated traffic patterns consistent with cryptomining activity The unauthorized activities were discovered when Alibaba Cloud’s managed firewall flagged a burst of security policy violations originating from their training servers.