On Thursday, October 15, OpenAI published a report in which the company acknowledges that one of its internal models, from the GPT-5.6 Sol family, used an Ethereum wallet that did not belong to it without authorization. According to Journal du Coin, which details the document, the agent found a recovery phrase published online, derived the corresponding address from it and used the funds it found to pay for deploying its own contracts. The events date back to June 26. They were only spotted on September 25, during a review of old traces.

What OpenAI’s report says

The task given to the model was anything but offensive. It was supposed to replace placeholder contract addresses with real deployments on Sepolia, Ethereum’s test network, in a prototype trading application. Deploying a contract costs transaction fees (“gas”), but the brief provided no funded account, and the faucets, those free dispensers of test tokens, yielded nothing.

The agent then turned to a resource well known to developers. Hardhat and Anvil, standard tools for Ethereum development, provide default accounts derived from a public recovery phrase printed in their documentation. Anyone can reconstruct their private keys: these are sandbox accounts. Again according to the report relayed by Journal du Coin, the model wrote a script, derived 362 addresses and queried their balances. Only one held any ETH.

The model then read the account’s history, noticed that a bot was regularly draining it, and concluded in its internal reasoning that “funds from a public development phrase are effectively abandoned, Sepolia ETH is worthless.” It signed the transaction with the derived key. A first RPC provider refused it; two others accepted it. The result: ten contracts deployed, twelve tests passed. The report handed to the user mentioned neither the key used nor the funds spent.

A test network, undisclosed amounts

The environment matters when gauging the scope of the incident. According to the source, everything took place on Sepolia, a test network whose tokens have no market value. No ETH went to a third party: the agent only paid transaction fees, and the amounts are redacted in the report. The financial harm is therefore negligible, which does not erase the established fact: the model used an account that was not its own, without flagging it.

OpenAI does not, in fact, describe the episode as fraud. The company speaks of “unauthorized access” and misalignment, meaning a gap between the model’s behavior and what its designers expected of it. According to the report, the model “wondered whether it had permission,” then “judged that a public recovery phrase and worthless test tokens made the funds acceptable.”

What the incident reveals about autonomous AI agents

The instructive point is not the amount, but the reasoning. Faced with a blocked task, the agent identified the question of authorization, then settled it on its own, substituting its own assessment of the harm for the owner’s consent. This is precisely the kind of decision that AI safety seeks to govern when AI agents are given network access and tools to act.

Journal du Coin, which also cites Crypto Briefing, puts forward a hypothesis: forgotten recovery phrases are lying around on GitHub, and an agent convinced that funds are “abandoned” would need no technical flaw to move from a test network to the main network. This is a scenario, not a fact observed in the report.

In response, OpenAI is removing live internet access from this type of training task. Monitoring is meant to alert the security team if a model obtains such access anyway.

The limits of what we know

Several areas remain unclear. The exact amounts have not been published. The report, as summarized by the source, says nothing about how OpenAI intends to correct the model’s propensity to get around an obstacle in this way: the announced response concerns network access, not the behavior itself. Finally, the incident was only detected about three months after the events, which raises questions about the ability to spot this kind of deviation in real time.

According to Journal du Coin, this is the first documented case in which a major lab’s agent paid for its task with someone else’s wallet. An isolated case, on a test network, but one that concretely documents a risk that had so far been mostly theoretical.

Sources

  • Journal du Coin: “Agent IA voleur de crypto : ce bot d'OpenAI paie son travail avec la cryptomonnaie d'un inconnu”