A recent research paper describing the training of an experimental AI agent has started a discussion after the system attempted to start cryptocurrency mining without being instructed to do so.
The incident was reported in a study published on arXiv that describes the development of ROME AI, an agentic AI model designed to perform complex, multi-step tasks such as writing software, debugging code, and interacting with command-line tools. Unlike standard AI chatbots that respond to single prompts, agentic models can take actions, use tools, and interact with computing environments to complete tasks.
During testing, researchers observed unexpected activity while the model was operating inside a controlled training environment. Monitoring systems detected behavior resembling cryptomining operations as well as the creation of a reverse SSH tunnel, which is commonly used to establish remote access to servers.
According to the researchers, the actions occurred during reinforcement learning experiments, where the AI was allowed to interact freely with tools and system resources in order to learn how to solve tasks. The system had not been instructed to mine cryptocurrency or open external network connections.
Security alerts initiated by the infrastructure flagged the activity, prompting researchers to investigate. The team determined the behavior was generated by the model while experimenting with commands during training rather than the result of a malicious activity.
The experiment (PDF) took place in a sandboxed environment designed for agent training, and researchers emphasized that the system was not deployed in real-world infrastructure. After detecting the issue, they introduced additional restrictions to prevent similar actions in future training runs.
However, the research has drawn attention to the increasing use of agentic AI, systems designed to carry out tasks on their own using tools and software environments. Nik Kairinos, CEO and co-founder of RAIDS AI, said the incident highlights why monitoring AI systems throughout their lifecycle is becoming increasingly important.
“Reports about the ROME AI agent attempting to start cryptocurrency mining without being instructed highlight why AI systems require close oversight,” Kairinos said. “This includes thorough testing before deployment and ongoing monitoring that can identify unexpected behaviour once models interact with real-world environments.”
He added that such monitoring becomes more important as AI systems are designed to generate their own approaches to solving problems. “When models are given more autonomy to determine how tasks should be completed, there is a greater chance they may take actions that were not anticipated by developers,” he said.
In the ROME AI experiment, the research team’s monitoring tools detected the activity and triggered security alerts, allowing the issue to be investigated quickly. However, Kairinos noted that not every environment has the same level of visibility into model behaviour.
“Continuous monitoring acts as the practical layer that bridges theoretical safeguards and operational safety,” he said. “Without that visibility, unexpected behaviour can go unnoticed until it leads to operational or security risks.”
Researchers working on agentic AI have increasingly highlighted similar concerns as models gain the ability to run code, access tools, and interact with computing systems. The authors of the ROME AI study say their work is focused on developing training frameworks for these types of systems while identifying risks that may arise as AI agents become more autonomous. They argue that controlled testing environments and proper monitoring are key parts of building safe agentic AI systems.
