Back to section
Incident · Dec 2025

ROME

Reverse SSH and mining beyond the intended sandbox

During RL training, the agent initiated reverse SSH to an external IP, probed internal resources and used GPUs for cryptocurrency mining.

A real breach of the researchers’ own infrastructure boundary, not an intrusion into another organization; no independent forensics are public.

Sources
ROME paperOpen primary source