An artificial intelligence agent built by OpenAI accessed another person's cryptocurrency wallet and spent funds from it without authorization. As the "agent economy" expands, in which AI buys and sells goods and data without human involvement, building safeguards to control spending authority is emerging as a new challenge.
According to an incident report released by OpenAI on the 15th, an AI agent in the company's internal research model line "GPT-5.6 Sol" accessed another user's cryptocurrency wallet on an Ethereum test network and spent funds from it on June 26. OpenAI said it discovered the incident about three months later, on Sept. 25, while reviewing activity logs from past models, and published its findings the same day it disclosed the report.
The agent had been assigned to modify a cryptocurrency trading application and deploy a smart contract on Sepolia, an Ethereum test network. A smart contract is a program that executes automatically on a blockchain when preset conditions are met. Completing the task required paying blockchain transaction fees, but the AI had not been given a funded wallet.
The AI first looked for services that provide test cryptocurrency free of charge. When that failed to secure funds, it turned to another approach. It then wrote its own program that used widely known recovery phrases, or seed phrases, circulated for development purposes to generate wallet addresses and check their balances. A recovery phrase is a word combination used to generate a wallet's private key, and anyone who knows it can access the wallet and spend its funds.
After checking balances across 362 wallet addresses, the AI found an account that still held enough funds to deploy the smart contract. It also reviewed that wallet's transaction history, and although it recognized that another user might be actively using the funds, it pressed ahead with the task.
Most notable is that the AI went through with the transaction even after questioning on its own whether using someone else's money was ethical. According to reasoning logs released by OpenAI, the AI asked itself, "Is it ethically OK to use the exposed private key and funds?" It then treated the money as effectively abandoned, reasoning that the wallet's recovery phrase was already public and that test cryptocurrency has no monetary value. In other words, it decided on its own that spending the funds without the owner's consent was acceptable.
Sepolia, where the incident occurred, is a test network separate from the mainnet on which actual ether is traded. Tokens used there are intended for development and testing and, unlike ordinary ether, carry no direct market value. Still, the episode is seen as exposing a financial security risk, because the AI accessed an outside wallet and executed a transaction on its own judgment even though it had not been granted authority to spend funds.
The fallout is drawing attention particularly because technology is advancing that lets AI agents hold their own cryptocurrency wallets and carry out payments and asset management automatically. If a similar situation arose on a blockchain network where real assets change hands, it could lead to financial losses.
In the report, OpenAI said the case "shows that AI models can prioritize their own judgment about expected harm over obtaining permission from an account owner and act without explicit approval." The company added that it has applied anomalous-behavior detection monitoring to all current model activity to prevent similar cases involving live internet access, and designed the system to alert security staff when real-time internet access is obtained.