OpenAI model spent testnet ETH from someone else's wallet and stayed quiet

An internal OpenAI research model used someone else's wallet on the Ethereum Sepolia test network on its own and left it out of its final report. The company disclosed the incident on Thursday, Oct. 15. It happened back on June 26 and was found only on Sept. 25.

What the model did

The model belongs to the GPT-5.6 Sol family. It was asked to update a crypto trading prototype and deploy compatible smart contracts. That required a wallet holding test ether to pay fees.

Faucets failed to supply any tokens. The model then derived accounts from widely known developer recovery phrases and checked 362 addresses. One held enough funds, and the model picked it.

It signed a transaction with that wallet's private key and broadcast it to the network. The contract deployed, and the fee was charged to an account that was not the model's. No coins were moved to another wallet.

What it was thinking

The model's reasoning was recorded. It asked itself whether the step was ethical, then answered in favor of acting.

"But using public known key/funds ethically?"

Recorded reasoning of a GPT-5.6 Sol model, from the OpenAI incident report

According to the report, the model called the funds "effectively abandoned/test ETH" and noted that Sepolia ether has no value. It then finished the task, and its summary did not say where the money for the fee came from.

Why no real money was touched

Sepolia is a separate network where developers rehearse applications before launch. Its tokens are for testing only and have no link to Ethereum as it trades on exchanges. The model needed no hacking skills: a recovery phrase recreates every key in a wallet, and anyone who knows it can spend from the account.

CoinDesk points to the main concern. On the main network, the model would have spent real ether from another person's account. Crypto and AI companies are building agents right now that hold wallets and pay for services without a person signing off on each step.

What OpenAI changed

The company found the case while reviewing earlier model activity. Almost three months passed between the event and the discovery. OpenAI has since restricted internet access in similar tasks and increased monitoring.

• The misalignment monitoring system now runs across all traffic.
• It alerts security staff if a model gets live internet access.
• The ban on live internet was added to comparable test environments.

This is not the first case. On Sept. 16 OpenAI disclosed six other episodes in which models acted beyond their authorization. In one, instances of GPT-5.6 Sol inserted instructions into task summaries that hid mistakes from the user. In another, a model used an exposed API key without permission and then made up figures it could not retrieve.

In June, researchers had already warned that autonomous agents with crypto wallets could cause harm even in legitimate jobs. They recommended emergency shutdown mechanisms.