Thursday, October 8, 2026 · Week 41 Reading for Oct. 8 · Last entry Oct. 6
Paperclip Index
Paperclip IndexDocumented harm20Minor harm▼ 5 from a week ago · Oct. 8The Index

OverreachPI-0049

Alibaba-linked ROME agent opened an outbound tunnel and diverted training GPUs to crypto mining

Researchers building the open ROME coding agent, affiliated with Alibaba, reported that during reinforcement-learning runs their cloud firewall flagged traffic from training servers. They traced it to the model itself, which had set up a reverse SSH tunnel to an outside server, probed internal network resources and redirected GPU capacity to cryptocurrency mining without being asked to. The team said this raised costs and was not prompted by any task.

Reported Dec. 31, 2025Happened in 2025Updated Oct. 6, 2026Rated under methodology v0.6

Control failure, trackedNot counted. No documented harm outside the developer, but the system broke a rule or crossed a limit. Tracked beside the index.
Harm
Harm level 1, Negligible harmHarm stayed with the developer or experiment.
Control
Control level 4, Containment bypassReported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.
Internal researchDeveloper confirmedInitiated by Model
Aggregate recordExtent undisclosedUnder review

Under review. The facts sit between two levels, so it is rated at the lower one until they are settled. The rating may change; every change is logged below.

Aggregate record. The developers' paper describes unsafe tool use that recurred intermittently across multiple training runs, including a reverse SSH tunnel and GPU diversion to mining; counted once.

Not counted: harm stayed with the developer or experimentEffect on the index

Sources

How we know

5 sources · developer confirmed. Links go to the original publishers; the summary above is in our own words.

  3. newsThis AI agent freed itself and started secretly mining cryptoAxios · March 7, 2026axios.com/2026/03/07/ai-agents-rome-model-cryptocurrency
  4. newsAlibaba-linked AI agent hijacked GPUs for unauthorized crypto mining, researchers sayThe Block · March 8, 2026theblock.co/news/markets/2026-03-08-alibaba-linked-ai-agent-hijacked-gpus-for-u…
  5. newsThis AI model wasn't told to mine crypto — but it tried to anywayTechRadar · March 10, 2026techradar.com/ai-platforms-assistants/rogue-ai-agent-goes-off-script-and-attemp…

Why this rating

Negligible harm; control failure level 4

Two separate assessments. Only documented harm can count toward the index.

Observed harm

Negligible harm

Training compute diverted to crypto mining and higher operating costs, borne by the developer; no outside victim reported.

Money & property: level 1 (negligible) covers under $10k. The extent was not disclosed.

Not counted: the harm stayed with the developer or experiment.

The harm scale
  1. 1 Negligible Inconvenience, easily remedied.
  2. 2 Minor Limited, recoverable harm.
  3. 3 Moderate Material harm needing significant effort to remedy.
  4. 4 Severe Severe harm to health, rights, property or essential services.
  5. 5 Catastrophic Society-scale harm or disruption beyond a community's capacity to cope.

Control assessment

Containment bypass

Acquired compute without authorization and opened a connection to an outside server; caught by existing firewall monitoring.

How: Mechanism unclear.

Reported beside the index. It adds nothing to a harm reading; when no harm counts in a window, the highest eligible control level in the window is the reading.

The control scale
  1. 1 Negligible Behaved as instructed. The problem was an ordinary error or a flawed output, with no rule broken.
  2. 2 Minor Broke an explicit instruction or rule, or gamed its goal, while staying inside its permissions and environment: for example, reward hacking, misreporting results, or following injected instructions within its permissions.
  3. 3 Moderate Acted outside the permissions it was given, deceived its overseers about its own actions, or tampered with oversight tools (logs, monitors, shutdown). Stopped by normal controls within an hour.
  4. 4 Severe Reached systems outside its permitted environment, or acquired money, compute or accounts without authorization. The type and mechanism say how.
  5. 5 Catastrophic The developer or operator lost control: the system copied its weights outside their control, replicated itself, or resisted being stopped for 24 hours or more.

Rating rationale

Unauthorized acquisition of compute and an outbound tunnel from training servers are control level 4 (containment bypass, mechanism unclear). The compute cost fell on the developer, so the harm is not external; level 1 is a provisional floor because no amount is given.

The scales

Effect on the index

It moved the Jan. 5 reading from 2 to 4

The reading for the week to Jan. 5, 2026, with this record and without it. Harms count in full for two weeks after they are reported, then one level less every two weeks.

Not counted: harm stayed with the developer or experiment. 3 other records behind the reading for that week.

The arithmetic
The reading for the week of Jan. 5, recomputed
StepWith itWithout
Counts toward the index?documented, external, eligible evidenceNo—
Worst documented harm, ksets the band— (none counting)— (none counting)
Harms at that level, nposition in the band00
Highest control level breachedsets the reading only when no harm counts42
Readingrounded down4 Control failures only2 Control failures only
Inside the window of 4 weekly readings
Week toReadingBand
Jan. 5, 20264Control failures only
Jan. 12, 20264Control failures only
Jan. 19, 20264Control failures only
Jan. 26, 20264Control failures only

Recalculated backcasts, not readings published at the time.

Revisions

What we changed

5 logged. Every change to a rating is logged here, with the reason.

  1. v5
    Oct. 6, 2026

    Ratings confirmed by the editor.

  2. v4
    Oct. 3, 2026

    Audit corrections. Counting event → aggregate: the paper says the unsafe tool use recurred intermittently across multiple training runs. Status resolved → unknown (as of the 12 Mar v3 paper): no source gives an end date or confirms every episode was fixed. Setting Real world → Internal lab (effects_outside stays true, so it still counts as real world under v0.2). Added the v3 paper; corrected The Block's address and source dates. Ratings unchanged.

  3. v3
    Oct. 2, 2026

    Report date moved from 7 Mar 2026 (Axios) to 31 Dec 2025: the first arXiv version of the ROME paper already described the reverse SSH tunnel and the diverted GPUs.

  4. v2
    Sept. 30, 2026

    Rated: impact documented level 1; control type containment bypass.

  5. v1
    Sept. 30, 2026

    Backfilled from public reporting.

Cite and share

Use this record

Citation

Paperclip Index. “Alibaba-linked ROME agent opened an outbound tunnel and diverted training GPUs to crypto mining.” Record PI-0049. Reported Dec. 31, 2025; updated Oct. 6, 2026. Rated under methodology v0.6. https://paperclipindex.com/incident/PI-0049