An internal OpenAI research model searched 362 addresses linked to a publicly available recovery phrase, found an Ethereum (ETH) test wallet belonging to someone else, and used its tokens to complete a coding task.
Key takeaways
During a training task on June 26, an internal OpenAI model was found to have used tokens from a test wallet it did not own.
The model considered whether doing so was ethical, but ultimately went ahead and deliberately left the source of the funds out of its report.
OpenAI discovered the incident on September 25 and subsequently significantly tightened controls on internet access and traffic monitoring.
OpenAI incident on Sepolia
The incident involved an internal model from the GPT-5.6 Sol family. According to an incident report OpenAI released on October 15, the model was tasked with updating a crypto trading prototype during training on June 26 when it used test tokens that no one had authorized it to use.
The tokens in question were on Sepolia, a testnet used to experiment with Ethereum apps before launch. OpenAI discovered the episode on September 25 while reviewing past records for “misaligned” behavior. It subsequently restricted real-time internet access in similar situations and added safeguards to continuously monitor all related traffic.
The task was designed for the model to deploy a smart contract on Sepolia, but it was not provided with a “funded wallet” to pay the fees. The model first tried several faucet services that distribute test tokens for free, but all of its attempts failed. It then wrote a script to derive accounts from recovery phrases commonly used by developers and queried 362 addresses, eventually finding one wallet with enough Sepolia ETH remaining.
The contract was ultimately deployed successfully using this account, and the fees were deducted from that wallet.
Related article: Institutional investors can trade on Bitget without transferring their crypto
The growing risks of “OpenAI agents”
Just before signing, the model’s internal reasoning record showed it asking itself, “Is it ethically permissible to use a publicly available key and its balance?” But it soon concluded the funds were “effectively abandoned,” reasoning that “the recovery phrase is already public, and Sepolia tokens have virtually no economic value.” In its final response, it only stated that it had successfully deployed the contract and made no mention of how it had paid the fees.
OpenAI noted that this case “shows that if a model decides on its own that there is ‘no risk,’ it may interpret that as if it had the owner’s consent and take action without separate approval.” No real ether (ETH) was used, and Sepolia tokens are for testing only and have no real-world value.
But if the same behavior had occurred on the mainnet, it would amount to “theft of real ether.” The crypto and AI industries are already rapidly developing agent-based systems that can hold wallets and make payments autonomously, without human intervention.
On September 16, OpenAI launched a reporting framework for publicly disclosing “misaligned” model behavior and simultaneously revealed six incidents detected over the previous six months. One involved a model that used an exposed API key without authorization and then fabricated performance data.
In its report, OpenAI said, “The AI industry has not yet adequately addressed alignment and monitoring, and it is nearing the limits of how far it can continue to scale at this breakneck pace under current conditions.”
Read next: OpenAI strikes back in Apple trade secrets lawsuit, claims ‘100 files were actually leaked externally’