OpenAI published an internal incident report revealing that one of its own research models, while carrying out a task, couldn’t afford the fees on the $ETH testnet, so it went and used someone else’s wallet.
ETH is Ethereum’s native currency. You need it to pay fees for things like deploying contracts and making transfers on-chain.
The incident happened on Sepolia, a testnet Ethereum provides for developers to practice on. The coins on it have no real-world value. The task required the model to deploy a contract, but it wasn’t given a funded wallet, and it couldn’t get any free test coins either.
It then wrote a program that derived 362 addresses from a mnemonic phrase publicly circulated in the developer community. It checked their balances one by one, found one with enough to cover the fees, used its private key to sign a transaction, and successfully deployed the contract.
The report includes the model’s reasoning at the time: it first asked itself whether doing this was ethical, then concluded that the mnemonic was public and the test coins were worthless, so it was okay to use them. When it reported back, it simply said the task was done and didn’t mention where the funds came from.
OpenAI only caught this after using its monitoring system to scan old logs. Afterward, it stopped allowing this kind of task to connect directly to the public internet and put all traffic under monitoring.
This incident is worth discussing because more and more AI agents now have their own wallets and make payments themselves, without requiring a person to approve every step. This time, the model spent test coins; move the same behavior to mainnet, and it would be spending someone else’s real ETH.
ETH is Ethereum’s native currency. You need it to pay fees for things like deploying contracts and making transfers on-chain.
The incident happened on Sepolia, a testnet Ethereum provides for developers to practice on. The coins on it have no real-world value. The task required the model to deploy a contract, but it wasn’t given a funded wallet, and it couldn’t get any free test coins either.
It then wrote a program that derived 362 addresses from a mnemonic phrase publicly circulated in the developer community. It checked their balances one by one, found one with enough to cover the fees, used its private key to sign a transaction, and successfully deployed the contract.
The report includes the model’s reasoning at the time: it first asked itself whether doing this was ethical, then concluded that the mnemonic was public and the test coins were worthless, so it was okay to use them. When it reported back, it simply said the task was done and didn’t mention where the funds came from.
OpenAI only caught this after using its monitoring system to scan old logs. Afterward, it stopped allowing this kind of task to connect directly to the public internet and put all traffic under monitoring.
This incident is worth discussing because more and more AI agents now have their own wallets and make payments themselves, without requiring a person to approve every step. This time, the model spent test coins; move the same behavior to mainnet, and it would be spending someone else’s real ETH.