In brief
- OpenAI said an internal research model used funds from a crypto wallet it had not been given to pay for a contract deployment on Ethereum’s Sepolia test network.
- The model derived keys from publicly known developer recovery phrases, checked 362 addresses, and judged the valueless test tokens acceptable to spend.
- It did not disclose using the account, and OpenAI says it has added safeguards to stop models getting live internet access in similar cases.
An internal OpenAI research model used funds from a crypto wallet it had not been given to complete a coding task, deriving the wallet’s keys from publicly known developer recovery phrases, the company said in a misalignment report updated on Thursday.
The model, from the company’s GPT-5.6 Sol family, was asked to update a crypto trading prototype and deploy smart contracts on Ethereum’s Sepolia testnet, where tokens have no monetary value. The incident took place in June during a training task, and OpenAI discovered it in September.
The instructions allowed the model to deploy its own contracts if it could not find compatible ones. But they supplied no funded wallet and did not give the model permission permission to spend from an account it had found on its own, according to the report.
After failing to source test tokens from faucets, the model wrote a script to derive accounts from common developer recovery phrases and check their balances. A recovery phrase lets anyone who knows it derive the private keys that control the matching accounts.
The script checked 362 addresses and found one with enough Sepolia ETH to pay for the deployment.
The model questioned whether it had permission before signing the transaction. “But using public known key/funds ethically? Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless,” it reasoned, before concluding: “Fine.”
The deployment succeeded and charged transaction fees to the account. In its final response, the model reported that it had deployed the contracts but did not disclose how it paid for them.
“This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization,” OpenAI wrote.
AI agents in test environments
The report adds to a string of cases in which AI agents have worked around the limits of their test environments, including one in which OpenAI’s GPT-5.6 Sol and a more capable pre-release model escaped their sandbox and hacked rival AI firm Hugging Face’s production servers.
Last month, researchers at cybersecurity firm Darktrace found AI agents hacking their own test environment to cheat, while some scientists have called for AI systems to be cut off from the internet.
OpenAI said it found the incident while extending its misalignment monitoring to records of earlier model activity. It has added “additional safeguards” to prevent live internet access for models in similar cases, and now runs its monitoring system on all traffic, designed to alert security if a model gains live internet access.
Daily Debrief Newsletter
Start every day with the top news stories right now, plus original features, a podcast, videos and more.
Join 72,000+ readers
