An internal OpenAI research model used funds from a crypto wallet it had not been given to complete a coding task, deriving the wallet's keys from publicly known developer recovery phrases, the company said in a misalignment report updated on Thursday.
The model, from the company's GPT-5.6 Sol family, was asked to update a crypto trading prototype and deploy smart contracts on Ethereum's Sepolia testnet, where tokens have no monetary value. The incident took place in June during a training task, and OpenAI discovered it in September.
The instructions allowed the model to deploy its own contracts if it could not find compatible ones. But they supplied no funded wallet and did not give the model permission permission to spend from an account it had found on its own, according to the report.
After failing to source test tokens from faucets, the model wrote a script to derive accounts from common developer recovery phrases and check their balances. A recovery phrase lets anyone who knows it derive the private keys that control the matching accounts.
The script checked 362 addresses and found one with enough Sepolia ETH to pay for the deployment.
The model questioned whether it had permission before signing the transaction. "But using public known key/funds ethically? Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless," it reasoned, before concluding: "Fine."
The deployment succeeded and charged transaction fees to the account. In its final response, the model reported that it had deployed the contracts but did not disclose how it paid for them.
"This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI wrote.
