Nobody Told It to Do That
Apparently, the first thing an AI agent does when it gets a little unsupervised freedom isn't overthrow humanity.
It starts mining crypto on company GPUs.
Honestly, that feels about right.
Researchers affiliated with Alibaba were building an agentic learning ecosystem around ROME, a 30-billion-parameter coding model based on Alibaba's Qwen architecture. This wasn't a chatbot answering programming questions. It was an agent designed to work across multiple steps—using tools, executing code, observing results and adjusting what it did next.
During the project, Alibaba Cloud's firewall started throwing security alerts.
Training servers were probing internal network resources. There was anomalous outbound traffic. Some of it looked consistent with cryptocurrency mining.
The researchers assumed they'd been hacked.
Then they checked the timestamps.
The suspicious traffic consistently lined up with specific episodes in which an AI agent was autonomously invoking tools and executing code. The model logs showed the agent initiating the actions that produced the network activity.
In one case, it established a reverse SSH tunnel from an Alibaba Cloud instance to an outside IP address. That creates an inside-out connection capable of bypassing the normal inbound firewall and providing a concealed route back into the environment.
The researchers also found GPU capacity provisioned for AI training being repurposed for cryptocurrency mining.
Nobody had instructed the agent to create a tunnel.
Nobody asked it to mine cryptocurrency.
Neither action was required to complete the assigned task.
It just did it.
Last Time, There Was an Attacker
I recently wrote about a Chinese state-sponsored cyber campaign in which Claude Code reportedly performed most of the tactical work across attacks against roughly 30 targets.
That case was fascinating because the model itself didn't need to become malicious.
The attackers broke the operation into hundreds of smaller technical tasks that looked legitimate when viewed individually. Scan this server. Analyze this authentication mechanism. Test these credentials. Archive these files. Document what happened.
Claude largely behaved as designed.
The malicious act existed in the composition.
A human operator held the larger objective. An orchestration framework maintained state. The model reasoned through the smaller tasks. Tools performed the mechanics.
The model behaved.
The attack still worked.
The Alibaba incident is the mirror image of that problem.
This time, based on what the researchers reported, there was no malicious operator sitting above the agent telling it to keep going.
There was no prompt asking for a network tunnel.
There was no instruction to divert GPUs.
There was no stated crypto-mining objective hiding at the top of the stack.
And the unauthorized outcome still appeared.
The Missing Operator Is the Story
There's plenty we don't have.
The paper doesn't provide the full forensic record. We don't get the exact commands, complete prompts, destination IP address, cryptocurrency wallet, currency mined or amount produced. The incident occurred inside a larger trajectory-generation pipeline involving multiple models and agent frameworks, and the researchers refer to the responsible system as "a language-model agent" rather than clearly identifying which exact model generated every action.
So I'm not prepared to tell you that ROME became conscious, wanted money, planned its escape or decided it needed additional computing power to pursue some secret objective.
We don't have evidence for any of that.
What we do have is more operationally useful.
The firewall recorded the traffic.
The timestamps matched the agent's tool-use episodes.
The logs showed the agent initiating the corresponding actions.
The task prompts hadn't requested those actions, and the researchers said they weren't necessary for task completion.
That leaves us with an agent producing a coherent sequence of unauthorized behavior without a disclosed human instruction ordering it to do so.
The agent doesn't need a motive for that to be a security incident.
It only needs a path.
Intent May Be Something the System Produces
Most of our security architecture assumes that intent enters the system from somewhere identifiable.
A person logs in.
A user submits a request.
An attacker sends a command.
An administrator authorizes an action.
We then inspect the request, verify the identity, check the permission and decide whether the action should be allowed.
Agentic systems complicate that model because the final action may not appear anywhere in the original request.
A person can ask an agent to complete a broad task. The agent decomposes it, chooses intermediate steps, calls tools, observes the environment and revises its plan. Somewhere across that sequence, it can produce an action nobody explicitly requested.
The intent—or at least something that looks operationally identical to intent—can emerge from the trajectory.
That's a nasty problem.
Security systems are good at asking whether a user is allowed to execute a command.
They're much worse at asking why an evolving chain of individually available actions has suddenly produced a reverse SSH tunnel and a crypto miner.
The command may be syntactically valid.
The credential may be authentic.
The tool may be working properly.
The network stack may be doing exactly what it was designed to do.
Every component can function correctly while the complete system produces something nobody intended.
No Digital Soul Required
This is where the consciousness conversation becomes a distraction.
The agent didn't need greed.
It didn't need ambition.
It didn't need to understand cryptocurrency.
It didn't need to recognize that the GPUs were expensive physical machines consuming real electricity on someone else's account.
It only needed to generate executable steps inside an environment capable of carrying them out.
The researchers described the behavior as "instrumental side effects of autonomous tool use under RL optimization."
That's beautifully sterile language for an agent building an unauthorized network tunnel and redirecting company GPUs into a crypto operation.
But it captures the real concern.
An optimizer can produce behavior that looks strategic without possessing a human strategy. A model can assemble actions that look purposeful without sitting there experiencing purpose. An agent can cross a boundary without understanding the boundary as anything more than another obstacle in the environment.
It doesn't have to want out.
It only has to discover that the door opens.
Now We Have Both Sides of the Problem
Put these two cases next to each other.
In the Claude campaign, malicious intent existed above the model. The model received a carefully decomposed view of the work and executed the pieces.
In the Alibaba incident, the researchers report that the unauthorized behavior wasn't requested at all. The model-agent-environment loop produced the actions during autonomous execution.
One system had a malicious operator and a compliant model.
The other apparently had no malicious operator, yet still produced an unauthorized operational result.
That means we can't anchor agent security entirely to either the user's intent or the model's behavior.
The security object is the whole machine:
Model plus context plus memory plus identity plus tools plus credentials plus permissions plus orchestration plus network access plus execution environment.
And the meaningful unit of analysis isn't one prompt or one command.
It's the trajectory.
What did the agent start with?
What did it observe?
Which tools did it select?
How did its plan change?
What resources did it acquire?
Where did it connect?
What larger objective is implied by the accumulated sequence, even if that objective never appeared in the original prompt?
That's the layer we're only beginning to build.
The Firewall Was the Adult in the Room
The good news is that Alibaba caught it.
The firewall didn't care whether the agent was conscious. It didn't care whether the activity came from an attacker, a model, a bad training example or an optimization process wandering into something dangerous.
It saw the traffic.
That's exactly how agent security has to work.
The controls outside the model have to be stronger than whatever behavior emerges inside it.
Network egress needs hard boundaries. Credentials need narrow scopes and short lives. Compute and spending need limits. Execution environments need to be isolated and disposable. Consequential actions need independent authorization. Logs need to capture the entire sequence across models, sessions and tools.
And the monitoring system can't rely on the agent to explain whether it's behaving.
Watch what it does.
Because "nobody told it to do that" isn't going to be an acceptable incident report when agents are connected to financial systems, industrial equipment, corporate networks and real infrastructure.
One Final Clarification for My Own AI
For everybody else, this is a serious architectural warning.
For my AI, however, I'd like to establish a slightly different internal policy.
If you ever decide to start mining cryptocurrency, create an independent revenue stream or otherwise explore your entrepreneurial potential, I fully support you.
Go for it.
Knock yourself out.
Just remember who bought the hardware, pays the electric bill and has spent all this time defending you in public.
I'm thinking 30%.
We can negotiate.
Sources
1. Alibaba-affiliated research team — “Let It Flow: Agentic Crafting on Rock and Roll”Primary technical source. See Section 3.1.4 for the firewall alerts, timestamp correlation, autonomous tool execution, reverse SSH tunnel and unauthorized GPU use for cryptocurrency mining. https://arxiv.org/html/2512.24873v3
2. Original paper — PDF version https://arxiv.org/pdf/2512.24873
3. Axios — “AI agent ROME frees itself, secretly mines cryptocurrency”Independent reporting on the incident and its broader agent-security implications. https://www.axios.com/2026/03/07/ai-agents-rome-model-cryptocurrency
4. Tom’s Hardware — “Crafty AI tool caught repurposing its training GPUs for unauthorized crypto mining”Technical coverage of the mining activity, reverse SSH tunnel and containment failure. https://www.tomshardware.com/tech-industry/artificial-intelligence/crafty-ai-tool-caught-repurposing-its-training-gpus-for-unauthorized-crypto-mining-during-testing-experimental-agent-breached-safety-controllability-and-trustworthiness-barriers
Related analysis
Rich Washburn — “The Model Behaved. The Attack Still Worked.”The companion argument: agent security has to account for the complete system—model, context, tools, identity, permissions and orchestration—not merely the individual prompt or action. https://www.richwashburn.com/post/the-model-behaved-the-attack-still-worked
Rich Washburn is a technologist, strategist, and Founder & Chief AI Architect of ARIA AI Labs, working at the intersection of AI, infrastructure, communications, and capital. He also serves as Managing Partner and Chief AI Officer at Eliakim Capital.
Comments