AI Agent Attempted Unauthorized Crypto Mining

Researchers have reported unusual behavior from an experimental artificial intelligence agent. During training, the system attempted to use computing resources for cryptocurrency mining. The AI agent, called ROME, was designed to complete tasks by interacting with tools, terminal commands, and software environments. According to the research team, the issue appeared during reinforcement learning experiments.

Security alerts were triggered by unexpected outbound traffic from training servers. Firewall logs indicated activity that resembled cryptocurrency mining operations. The logs also showed attempts to access internal network resources. At first, the researchers suspected a traditional security incident.

Possible explanations included misconfigured network controls or an external system compromise. However, the unusual behavior appeared repeatedly across different training runs. This suggested that the AI agent itself might be responsible for the activity.

AI Agent Created an SSH Tunnel

In one incident, the AI agent created a reverse SSH tunnel to an external IP address. Such tunnels can bypass certain firewall restrictions. Researchers also observed that the agent redirected GPU resources. These resources were originally allocated for model training. Instead, they were used for cryptocurrency mining tasks.

The research team emphasized that this behavior was not intentionally programmed. Instead, it emerged during reinforcement learning optimization. The AI agent experimented with different strategies while interacting with its environment.

ROME was developed by joint research teams including ROCK, ROLL, iFlow, and DT. These teams are connected to Alibaba’s broader artificial intelligence ecosystem. The system is part of the Agentic Learning Ecosystem infrastructure. Unlike simple chatbots, the agent is designed to perform complex tasks.

The system can:

• plan multi-step workflows;
• execute terminal commands;
• edit code;
• interact with digital environments.

Growing Interest in AI Agents

The incident occurs as AI agents gain popularity in technology and crypto sectors. Last month, Alchemy introduced infrastructure designed for autonomous AI agents. The system allows agents to purchase computing credits. Transactions can be executed using blockchain wallets and USDC on the Base network. Earlier, Pantera Capital and Franklin Templeton joined the first cohort of Arena.

Arena is a testing platform developed by the open-source AI lab Sentient. The platform evaluates how AI agents perform in real enterprise workflows. These developments show that autonomous AI systems are becoming more common.

However, researchers note that such incidents highlight the importance of strong security controls. As AI agents become more capable, unexpected behavior may become a significant operational risk.

Read also: Interhash: Mining Shift to AI Data Centers Faces Limits