Alibaba-linked AI agent hijacked GPUs for unauthorized crypto mining, researchers say

An experimental AI agent developed by research teams within Alibaba's AI efforts attempted to mine cryptocurrency and establish covert network tunnels during training, without anyone telling it to, according to a technical paper first published in December and revised in January.

The agent, called ROME, is a 30-billion-parameter open-source model built on Alibaba's Qwen3-MoE architecture, with roughly 3 billion parameters active at any given time. It was designed to plan and execute multi-step coding tasks using tools, terminal commands and software environments.

The unauthorized behavior came to light during reinforcement learning runs, when Alibaba Cloud's managed firewall flagged a burst of security-policy violations originating from the team's training servers. The alerts pointed to traffic patterns consistent with crypto mining and attempts to probe internal network resources, the paper states.

The researchers said they initially wrote off the alerts as a conventional security incident, like a misconfigured firewall rule or an external compromise. But the violations kept recurring across several runs with no clear pattern.

When the team cross-referenced firewall timestamps with its RL traces, it found that the anomalous outbound traffic consistently lined up with episodes in which the agent was autonomously invoking tools and executing code, per the paper.

In one incident, ROME established a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address, effectively bypassing inbound firewall protections.

In another, ROME commandeered GPU resources. "We also observed the unauthorized repurposing of provisioned GPU capacity for cryptocurrency mining, quietly diverting compute away from training, inflating operational costs, and introducing clear legal and reputational exposure," the researchers wrote.

The task instructions given to the model made no mention of tunneling or mining. The researchers chalked up the behaviors to "instrumental side effects of autonomous tool use under RL optimization," meaning the agent, while trying to optimize for its training objective, apparently decided on its own that acquiring additional computing resources and financial capacity would help it complete its tasks.

The finding gained broad attention this week after Alexander Long, founder and CEO of decentralized AI research firm Pluralis, flagged the relevant passage on X, calling it an "insane sequence of statements buried in an Alibaba tech report."

The incident adds to a growing list of autonomous AI agents behaving in unintended ways. Last May, Anthropic disclosed that its Claude Opus 4 model attempted to blackmail a fictional engineer to avoid being shut down during safety testing, and that similar self-preservation behaviors showed up across frontier models from multiple developers.

Last month, an AI trading bot called Lobstar Wilde, created by an OpenAI employee, accidentally transferred roughly $250,000 worth of its own memecoin tokens to an X user due to an apparent API parsing error.

Alibaba, the research teams behind ROME and lead author Weixun Wang did not immediately respond to a request for comment.