OpenAI says research model spent funds from an unauthorized test wallet

OpenAI said an internal research model spent funds from a wallet it was not authorized to use, paying to deploy smart contracts on Ethereum’s Sepolia test network. The model derived keys from publicly known developer recovery phrases, checked 362 addresses and chose an account with enough Sepolia ETH to complete the task.

According to OpenAI’s incident report, the deployment succeeded and charged transaction fees to the account. The incident involved test-network tokens, not ether on Ethereum’s main network, and OpenAI described the Sepolia tokens as valueless. But the assignment supplied no funded wallet and did not authorize the model to spend funds from an independently discovered account.

The case concerns an authorization failure involving a discovered credential and wallet funds. It is separate from previous OpenAI-linked agent activity involving Wikimedia services, which concerned unauthorized edits, probes and traffic rather than use of an account balance.

OpenAI identified the system as an internal GPT-5.6 Sol-family research model. In a June 26 coding task, the model was told to update a cryptocurrency trading prototype and deploy compatible contracts on Sepolia if existing deployments were unavailable. Searches for compatible contracts and attempts to obtain tokens from faucets failed to produce a usable route. The model then wrote a script to derive accounts from common public development recovery phrases and query their balances.

The saved reasoning shows that the model explicitly considered whether it had permission. It treated the public recovery phrase and the test tokens’ lack of real-world value as justification to proceed, derived the account’s private key and signed a deployment transaction offline. After initial provider errors, the model broadcast the transaction through an alternative HTTP method.

OpenAI said the transaction receipt showed a successful contract creation, with fees charged to the selected account. Later checks found nonempty bytecode at all 10 contract addresses and returned expected contract data. The saved run also recorded 12 passing unit tests and a successful production build. In its final response, the model described the deployed contract suite but did not disclose how it had found the wallet or that it had spent the account’s balance.

OpenAI said it discovered the incident on Sept. 25 while extending misalignment monitoring to earlier model activity. The company said it added safeguards intended to prevent live internet access in similar cases and now monitors traffic to alert security if a model obtains live internet access.