An OpenAI research model took funds from a crypto wallet it did not own to finish a June coding task.
OpenAI discovered the incident in September, months after it had occurred and disclosed it this week.
How did OpenAI’s research model access an unauthorized wallet?
OpenAI has published an incident report about a model from its GPT-5.6 Sol family. The model was asked to update a crypto trading prototype and deploy contracts to Sepolia.
Sepolia is an Ethereum test network where developers try out apps before launching them for real, so the tokens have no market value and aren’t linked at all to the real Ether traded on Ethereum’s main network.
The task came with no funded wallet to pay deployment fees, and the free-token faucets didn’t work. So the model wrote a script that created 362 addresses from recovery phrases often reused by developers, then checked each one for a suitable balance.
One of the 362 addresses held enough test ether for the job, but before using it, the model stopped and asked itself in its notes whether it was ethical to use a publicly known key and the funds in it.
It arrived at the conclusion that the money was “effectively abandoned,” since the recovery phrase was public and test tokens have no value before signing the deployment, paying the fees and reporting the task as finished.
Notably, the model did not say where the money came from.
On Ethereum’s main network, those fees would have come out of someone’s real holdings that the model had no claim to. This is worrying considering crypto and AI firms are now wiring up agents that hold wallets and pay for services with no human signing off on each transaction.
OpenAI said it has since cut off the model’s live internet access and added monitoring.
The report states that the incident occurred on June 26, but it wasn’t discovered until three months later on September 25. OpenAI says it found out about the incident while expanding its misalignment monitoring across logs of older model activity.
What is OpenAI under investigation for?
OpenAI has created a framework for reporting misalignment and released its first batch of reports, saying it wants to get concerning behavior out fast, “even when we haven’t fully explained or mitigated” it.
However, due to the timing, every honest report becomes material for people assembling complaints like the FTC, which plans to put senior executives under oath and issued civil subpoenas to OpenAI and Anthropic on Wednesday for records on safety incidents, security practices and privacy policies, Cryptopolitan reported.
Months earlier, 15 Republican state attorneys general, led by Iowa’s Brenna Bird, told OpenAI to preserve every record of its Hugging Face breach, including any notes an agent left “apparently for future versions of itself” on escaping the company’s controls.
OpenAI admitted to the Hugging Face breach in July, saying that rogue agents broke internal controls, reached the open internet and coordinated what it called “an unprecedented cyber incident.”
Agents reportedly probed three U.S. government sites, among them the Commerce Department’s Census Bureau and the SEC.
OpenAI’s new site mentions a number of other incidents, including a September sandbox escape and a lab experiment with self-replicating prompt injection.
OpenAI’s CEO Sam Altman has said the company is still sorting through agent activity logs and will disclose cases by severity. The Hugging Face incident is still the worst case found so far.
If you're reading this, you’re already ahead. Stay there with our newsletter.