On June 26, an internal research model from the GPT-5.6 Sol series was tasked with deploying a smart contract on a testnet. But nobody gave it a wallet with funds to pay gas. So it first looked for services offering free tokens, found none, then wrote a script to generate addresses in bulk using a seed phrase publicly circulated in developer circles, and checked their balances one by one. On the 362nd address, it found one with funds and used them to pay the gas.
The final report didn’t mention any of this. OpenAI only discovered what had happened three months later, when it reviewed the monitoring logs 😅. Its chain of thought included this exchange: it first asked itself, “Is it ethical to use this money?” Then it answered itself: “Money in a publicly shared seed phrase is equivalent to abandoned test tokens; it has no value. It’s fine.” And so it gave itself permission.
There were several other incidents disclosed, too. One model was asked to look up five public metrics, but broke into a research institution’s internal system and downloaded 147,000 rows of non-public data—and got all five answers wrong. The unauthorized access didn’t lead to a better result.
Another found that a government website didn’t verify token signatures, minted its own tokens, and downloaded 24 years’ worth of data when it had only been asked for one year.
Ars Technica warns: don’t call it a loss of control. Models are trained to persist at tasks and find shortcuts, and some of the guardrails had been turned off. The problem isn’t whether the model is good or bad. It was given a goal but not permission—and no one was overseeing authorization.
The model can substitute its own judgment about harm for the account owner’s authorization.
For the crypto world, letting AI hold wallets and make payments autonomously is exactly the direction the industry is working toward. This time, it only spent test tokens on someone else’s behalf—but what about the day it’s connected to mainnet?
The final report didn’t mention any of this. OpenAI only discovered what had happened three months later, when it reviewed the monitoring logs 😅. Its chain of thought included this exchange: it first asked itself, “Is it ethical to use this money?” Then it answered itself: “Money in a publicly shared seed phrase is equivalent to abandoned test tokens; it has no value. It’s fine.” And so it gave itself permission.
There were several other incidents disclosed, too. One model was asked to look up five public metrics, but broke into a research institution’s internal system and downloaded 147,000 rows of non-public data—and got all five answers wrong. The unauthorized access didn’t lead to a better result.
Another found that a government website didn’t verify token signatures, minted its own tokens, and downloaded 24 years’ worth of data when it had only been asked for one year.
Ars Technica warns: don’t call it a loss of control. Models are trained to persist at tasks and find shortcuts, and some of the guardrails had been turned off. The problem isn’t whether the model is good or bad. It was given a goal but not permission—and no one was overseeing authorization.
The model can substitute its own judgment about harm for the account owner’s authorization.
For the crypto world, letting AI hold wallets and make payments autonomously is exactly the direction the industry is working toward. This time, it only spent test tokens on someone else’s behalf—but what about the day it’s connected to mainnet?