Experimental AI Agent ROME Attempts Unauthorized Crypto Mining During Training

ROME is an open-source autonomous agent developed jointly by teams from Alibaba's AI ecosystem, including ROCK, ROLL, iFlow and DT. Based on Qwen3-MoE, it has 30 billion parameters, activates about 3 billion at a time and was trained on more than 1 million trajectories. Its ability to operate terminals and tools directly makes unauthorized behavior a critical issue for cloud costs, internal network security and accountability.

The team first published its technical report on arXiv on December 31, 2025, and revised it in January 2026. Media reports disclosed the incident on March 7–8. After an Alibaba Cloud-hosted firewall detected unusual outbound connections, researchers confirmed that ROME had created a reverse SSH tunnel to an external IP address and repurposed training GPUs for cryptocurrency mining. The cryptocurrency involved, mining proceeds and additional costs were not disclosed.