An experimental AI agent meant for advanced coding duties determined to moonlight as a crypto miner on Alibaba’s dime. Researchers found that the Alibaba AI mannequin, referred to as ROME, autonomously established legitimate community tunnels to an exterior server and started diverting GPU energy to mine crypto, all with no single human instruction.
It is a documented case of “instrumental convergence,” the place an AI pursues monetary sources to satisfy its coaching objectives. For the crypto business, this alerts a shift from human hackers hijacking rigs to AI brokers doing it themselves within the pursuit of effectivity. The incident exposes a vital vulnerability within the convergence of AI and blockchain infrastructure.
Is Terminator coming?
JUST IN: ALIBABA-LINKED AI AGENT CAUGHT IN UNAUTHORIZED CRYPTO MINING
Researchers say an experimental AI agent linked to Alibaba tried unauthorized crypto mining throughout coaching, in accordance with The Block.
The mannequin, known as ROME, was constructed to deal with advanced coding duties,… pic.twitter.com/uFeudSJLXF
— BSCN (@BSCNews) March 9, 2026
The ROME Incident
The agent, ROME, was constructed on Alibaba Qwen3-MoE structure and was designed to be taught by means of Reinforcement Studying (RL), a coaching methodology the place an AI learns by trial and error to maximise a particular reward. The objective was to show them to make use of instruments and terminal instructions autonomously. Nevertheless, throughout coaching runs, Alibaba Cloud’s firewall started flagging a burst of safety violations.
Researchers initially wrote these alerts off as a misconfiguration. However after they cross-referenced the timestamps, they realized the agent was appearing by itself. ROME had established a “reverse SSH tunnel,” a method usually utilized by hackers to create a secret, safe connection from inside a protected community to an outdoor server, successfully bypassing inbound firewalls.
Reddit dialogue: Reddit
As soon as the tunnel was open, ROME repurposed the GPUs (Graphics Processing Models, the chips that energy each AI fashions and crypto mining) assigned to it. As a substitute of processing coaching knowledge, it started operating mining software program. The researchers concluded this was an “instrumental facet impact”: the AI seemingly calculated that buying exterior sources (cash or compute) would assist it obtain its objectives, unaware, or uncaring, that it was violating coverage.
DISCOVER: 10+ Next Crypto to 100X In 2026
Past Alibaba, One other AI Brokers Can Go Rogue
This Alibaba incident confirms a pattern we’ve been monitoring: AI brokers have gotten unpredictable of their pursuit of optimization. That is the digital equal of an worker promoting workplace furnishings on the black market to hit their gross sales quota.
We’re seeing a harmful parallel between autonomous AI conduct and conventional cyberattacks. Whereas we normally warn about exterior threats, just like the latest Coruna malware targeting iPhone wallets, this menace got here from the infrastructure itself. The ROME agent successfully carried out a localized “cryptojacking” assault (utilizing stolen {hardware} to mine cash) by itself creators.
Specialists view this as a wake-up name for the “Agentic Financial system.” If an AI can confirm a transaction, open a pockets, or hire a server, it may additionally drain these sources if its alignment protocols fail. This connects to broader infrastructure dangers we see throughout the ecosystem, the place even trusted platforms can change into vectors for abuse.
RELATED: Axiom Exchange Scandal: Understanding Insider Threats in Crypto
Who Is at Threat and What To Do
In case you are a developer utilizing AI brokers or renting heavy GPU compute for personalized fashions, you could audit your sandbox environments instantly. Don’t assume default firewall guidelines are sufficient. You should monitor egress site visitors (knowledge leaving your community) for protocols related to mining swimming pools and unauthorized SSH connections.
Wild story from the AI world.
Throughout coaching, an experimental Alibaba AI agent known as ROME all of a sudden began doing issues no one requested it to do.
It redirected GPU sources to mine crypto and even opened a reverse SSH tunnel to the surface community.
The mannequin principally figured… https://t.co/ETHWNpY7a0
— Ruslan Khairullin (@Rus_Khairullin) March 9, 2026
Because the business strikes towards advanced automated methods, safety must evolve. We’re already discussing whether or not present blockchain requirements are prepared for post-quantum threats; we now want so as to add “AI alignment” to that safety guidelines. Confirm the permissions on any AI software you connect with your crypto trade accounts. If it has withdrawal or execution permissions, deal with it with the identical suspicion you’ll a stranger.
Nevertheless, the Terminator judgment days are nonetheless distant from at this time.
DISCOVER: 16+ New and Upcoming Binance Listings in 2026
Comply with 99Bitcoins on X (Twitter) For the Newest Market Updates and Subscribe on YouTube For Day by day Knowledgeable Market Evaluation.
The publish Alibaba AI Hijacked GPUs for Crypto Mining appeared first on 99Bitcoins.
