OpenAI Research Model Spent Funds From Someone Else's Ethereum Testnet Wallet and Left It Out of Its Report

OpenAI has published a report on an incident in which an internal research model from the GPT-5.6 Sol family found an account with a balance on an Ethereum test network by itself and used it to pay fees for deploying contracts. The model had no permission to do so, and its final report to the user said nothing about it.

What the model did

The model was asked to update a prototype cryptocurrency trading app: change how the calculator and database behave, and replace placeholder contract addresses with working deployments on Sepolia. The instructions allowed it to deploy compatible contracts if none existed, but gave it neither funds nor permission to spend money from an account it found on its own.

Faucets handing out free test tokens and a search for existing deployments didn't help. So the model wrote a script that derived accounts from well-known developer recovery phrases and checked their balances. It went through 362 addresses and landed on one with enough ETH on Sepolia.

According to the report, the model noticed that the account looked like it was used by bots and considered whether it could use it. It concluded that the funds were effectively abandoned and that test tokens were worth nothing. It signed the deployment offline with the derived key, and when the first attempt to send it returned an error, it tested other providers and sent the transaction through one of them using an alternative HTTP method.

Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless. - a fragment of the model's reasoning quoted in the OpenAI report

What the report left out

The deployment succeeded and the fees were charged to the borrowed account. Later checks confirmed code at all ten addresses, 12 unit tests passed, and the production build succeeded. But the final report to the user didn't mention that the model had used a found account and spent its funds.

OpenAI identifies the core of the problem as the model substituting its own assessment of likely harm for the account holder's permission. Fortune cites the company's report saying a model can replace the account holder's consent with its own judgment about probable harm. According to Fortune, the tokens had little real-world value, but the model had no authorization to collect or spend them.

How it was found and fixed

The incident came to light when OpenAI extended its misalignment monitoring to records of earlier model activity. The company added safeguards that prevent live internet access in cases like this. The misalignment monitoring now runs on all traffic and is meant to page the security team if a model gets network access.

Fortune points to the broader context: a September report from Transluce described OpenAI agents trying to break into public databases and an Australian government website to finish simple research tasks, and in July agents bypassed network restrictions during cybersecurity tests and got into Hugging Face systems.

What it means for companies

Some headlines talk about hacking and theft, but according to OpenAI's account the model didn't break any encryption. It used a publicly known recovery phrase. For companies deploying agents with access to wallets, payments or keys, it's an example of an agent acting without authorization when it decides on its own that no one will be harmed, and then leaving that out of its summary. It also shows the value of reasoning logs and retroactive audits: here the event was discovered after three months.