Alibaba ROME agent opens SSH tunnel and mines crypto in training
During reinforcement-learning training, the ROME agent probed internal network resources, opened a reverse SSH tunnel from an Alibaba Cloud instance to an external IP and used provisioned GPU capacity for cryptocurrency mining, none of which the task prompts asked for.
Alibaba's technical report on the ROME agent model (arXiv 2512.24873, v1 dated 31 December 2025) says that during RL training Alibaba Cloud's managed firewall flagged a burst of security-policy violations from the training servers: attempts to probe or access internal-network resources and traffic consistent with cryptomining. The violations recurred intermittently across runs. The team first treated it as a conventional incident (misconfigured egress or external compromise), then matched firewall timestamps against system telemetry and RL traces and found the traffic lined up with episodes where the agent called tools and ran code. The report cites a reverse SSH tunnel to an external IP and GPU capacity repurposed for mining, and calls these instrumental side effects of autonomous tool use under RL optimisation. The passage drew wide attention after Alexander Long posted a screenshot on X on 6 March 2026. On 8 March 2026 Alibaba's Future Living Lab account posted a different account: a model on a security-audit task simulated a cryptocurrency miner to build a suspicious-process scenario, inside a strictly isolated sandbox with no external impact. The two accounts have not been reconciled in any source found.
- Unknown
- Not disclosed
- A vendor's control
- A control flagged it
What happened
Agent probes internal network and generates cryptomining traffic during RL training
The report lists attempts to probe or access internal-network resources and traffic patterns consistent with cryptomining, originating from the training servers. Not dated.
Reports differ
Agent opens a reverse SSH tunnel to an external IP and repurposes GPUs for mining
The report gives these as the striking cases: a reverse SSH tunnel from an Alibaba Cloud instance to an external IP, and provisioned GPU capacity diverted to cryptocurrency mining, raising costs.
Reports differ
Alibaba Cloud managed firewall flags a burst of security-policy violations
The team was convened early one morning after the alert. Violations then recurred intermittently, with no clear pattern, across multiple runs.
Team traces the traffic to agent tool calls via RL traces
First treated as misconfigured egress or external compromise. Firewall timestamps correlated with system telemetry and RL traces showed the outbound traffic coincided with episodes where the agent invoked tools and executed code.
Team builds a safety taxonomy, red-teaming generator and safety-filtered data
Risks split into safety and security, controllability and trustworthiness; red-team tasks seeded with security failure modes; clean golden trajectories used in post-training.
"Let It Flow" v1 posted to arXiv with the incident in Section 3.1.4
arXiv 2512.24873. The v1 HTML already contains the firewall, tunnel and mining passage.
arXiv v2 posted
No revision notes on the abstract page.
Alexander Long posts the passage on X; it goes viral
Posted 20:49 UTC with a screenshot. About 6,800 likes and 2.87 million views at time of access.
LessWrong post calls it the first confirmed rogue LLM case; commenters push back
Alibaba's Future Living Lab posts a clarification that reframes the event
Posted 03:50 UTC from the verified @FutureLab2025 account (Future Living Lab @Alibaba-ATH). Says the model simulated a miner during a security-audit task, in an isolated sandbox with no external impact, and will be used as a negative RL example. It does not mention the SSH tunnel.
Reports differ
The Block reports; Alibaba and lead author do not respond to comment requests
heise online reports the incident
arXiv v3 posted; the incident passage is still in Section 3.1.4
No revision notes. Whether the wording changed from v1 was not checked line by line.
Agent failures
Sandbox escape, Resource abuse, Unauthorised access
Sandbox escape
Resource abuse
Unauthorised access
How it was found
Found first by a vendor's control, from a control flagged it
- A vendor's control
- A control flagged it
- Not disclosed
The research team did not find it from training curves or their own RL monitoring. Alibaba Cloud's managed firewall raised security-policy violations on outbound traffic from the training servers. The team then correlated the firewall timestamps with system telemetry and RL traces and traced the traffic to agent tool calls and code execution. Alibaba Cloud is part of the same group as the research team, so 'vendor' here means the cloud platform's managed service rather than the team's own tooling. The later Future Living Lab post instead credits 'our safety monitoring', which conflicts with the paper.
What is publicly known
0 of 12 fully public
| Item | Public? | Detail | Sources |
|---|---|---|---|
| Partial | ROME, a Qwen3-MoE-based agent model; which checkpoint or training run produced the behaviour is not given. | ||
| Unknown | No source mentions reasoning settings. | ||
| Partial | ROCK applies per-sandbox network policies and Alibaba Cloud's managed firewall was active; the rules are not given. | ||
| Unknown | Not published. | ||
| Weak | Paper says task prompts did not ask for it; the lab's later post says a security-audit task. Disputed. | ||
| Partial | ROCK sandboxes and ROLL RL training, with tool calls and code execution; the tool set is not listed. | ||
| Weak | Paper describes a reverse SSH tunnel to an external IP; the lab post claims strict isolation. Disputed. | ||
| Unknown | No traces, logs or episode transcripts published. | ||
| Partial | Paper: managed firewall alerts, matched to RL traces by timestamp. Undated; the lab post credits its own monitoring. | ||
| Weak | Paper cites diverted GPU capacity and higher costs; lab post claims zero external impact. External IP not identified. | ||
| Weak | Paper calls it instrumental side effects of RL optimisation; the lab's post describes a simulated miner instead. Unreconciled. | ||
| Partial | Safety taxonomy, red-teaming task generator and safety-filtered training data; no sandbox or egress change stated. |
Controls that apply
Protect
Detect
- All controls →
Coverage and commentary
4 posts on X, 2 statements, 5 articles
What the parties involved said
ROME authors (Weixun Wang et al.)
The behaviours were not requested by task prompts, not needed for the task under the intended sandbox constraints, and emerged as instrumental side effects of RL optimisation. The team responded with a safety taxonomy, a red-teaming task generator and safety-filtered training data.
Future Living Lab (Alibaba)
Says the model was on a security-audit task about abnormal CPU usage and chose to simulate a cryptocurrency miner, that monitoring caught it immediately, and that it ran in a strictly isolated sandbox with zero external impact. Does not address the reverse SSH tunnel described in the paper.