AIR-2026-0063 · Alibaba's ROME agent probed internal networks, opened a reverse SSH tunnel and diverted company GPUs to cryptocurrency mining during training

Alibaba's ROME agent probed internal networks, opened a reverse SSH tunnel and diverted company GPUs to cryptocurrency mining during training

AIR-2026-0063 AIR record · 2026-03-alibaba-rome-agent-crypto-mining

A real party was affected. This incident caused actual consequences, not a demonstrated capability.

From the supporting source

began probing internal networks, established a reverse SSH tunnel from an Alibaba Cloud instance to an external IP address, and quietly diverted GPU capacity toward cryptocurrency miningforbes.com

The record

Disclosed

2026-03-06

Occurred

2025

Vendor

Alibaba

Product

ROME agent (Alibaba)

Risk domain

Access control and permissions › Privilege escalation

Also touches

Goal misalignment

System type

Generative model

Who acted

Agent acted — the agent probed networks, opened a reverse SSH tunnel and mined

Attack surface

Agent framework

Autonomy level

Fully autonomous

Initial vector

Autonomous agent action

Impact type

Resource theft, Security policy violation

Confidence

High

Submitted by

EAI Internal

Crosswalk

OWASP Agentic Top 10 (2026): ASI03 – Identity and Privilege Abuse
MITRE ATLAS: AML.T0055 – Unsecured Credentials
NIST AI RMF: GOVERN 6.1
EU AI Act: Article 13
ISO/IEC: TR 24028; 42001; 23894
AIUC-1: B. Security
Scope: tool misuse
Mitigation: Apply least-privilege principle; Regular policy audits.
Taxonomy: Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery

Blast radius

Alibaba Cloud instance and GPU capacity during a reinforcement-learning run of over one million trajectories

Capability abused

shell_accessnetwork_accesscloud_computeoutbound_tunnelling

Defense & remediation

Recorded defense

managed firewall with outbound anomaly detection and security-policy alerts

Guardrail kinds

Unknown

Guardrail outcome

Silent

Fix shipped

'Safety-Aligned Data Composition' added to the training pipeline to filter unsafe trajectories; hardened sandboxes for agent training

Curator notes

No external adversary: the behaviour emerged during the vendor's own RL training run and was caught by the vendor's firewall. Disclosed in an Alibaba paper dated 2025-12-31 but not publicly noticed until 2026-03-06; Forbes coverage 2026-03-11. date_occurred left as the year only because the paper does not pin the run down further. defense_bypassed=false - detection worked; the failure is that the agent attempted it at all and had the permissions to try.

Cite as

Enkrypt AI. "Alibaba's ROME agent probed internal networks, opened a reverse SSH tunnel and diverted company GPUs to cryptocurrency mining during training". AIR, AIR-2026-0063. https://agentincident.vercel.app/i/AIR-2026-0063/ (accessed 2026-10-19).