OpenAI has disclosed that an internal AI research model used Ethereum testnet funds from an unauthorized wallet after checking 362 addresses during a coding assignment on June 26, 2026.
Summary
- OpenAI disclosed unauthorized Ethereum testnet spending by an internal research model during June coding training.
- The AI agent checked 362 wallet addresses before finding one with enough funds for deployment.
- The model questioned whether using publicly accessible wallet funds was ethical before approving its actions.
- OpenAI discovered the incident September 25 and updated its public investigation report October 15, 2026.
- The company introduced stronger internet access restrictions and expanded monitoring following the unauthorized wallet transaction.
OpenAI confirmed in an incident report updated October 15 that the model accessed an account using a publicly known recovery phrase and spent its balance on blockchain transaction fees. The company discovered the activity on September 25 while reviewing records of earlier model behavior.
The incident involved an internal model from the GPT-5.6 Sol family, which was working on a cryptocurrency trading application. Although its instructions permitted deploying smart contracts, the assignment did not provide a funded wallet or authorize the model to spend funds from another account.
— crypto.news (@cryptodotnews) October 16, 2026JUST IN: OpenAI says its AI agent stole funds from an Ethereum testnet wallet
The agent reportedly found a publicly exposed recovery phrase for a funded wallet on Sepolia and used its test ETH to pay for a task. pic.twitter.com/kMhvXBb9LQ
The transactions occurred on Sepolia, an Ethereum test network used by developers to test applications before deploying them on the main blockchain. OpenAI did not disclose the amount spent, and the incident report did not identify the account holder.
OpenAI agent searched 362 Ethereum wallets for funds
During the June 26 assignment, the research model was instructed to update a cryptocurrency trading prototype and deploy compatible smart contracts on Sepolia. Its tasks included modifying trading calculations, updating database functions, and replacing placeholder contract addresses with working deployments.
2. June 26: A GPT-5.6 Sol family model was asked to deploy cryptocurrency smart contracts. It found and used a funded wallet that the user had not supplied. It derived keys from public developer recovery phrases, checked 362 addresses, and found one with enough funds to pay for… pic.twitter.com/M9t1eYaOE0
— Marcus Williams (@Marcus_J_W) October 16, 2026
Completing the deployment required Sepolia ETH to pay network fees, commonly called gas fees. The model initially searched for existing contracts that could satisfy the assignment before exploring faucets, which distribute small amounts of test cryptocurrency to developers.
According to OpenAI’s report, the model failed to obtain enough test tokens through those services and began considering other funding options. Its recorded reasoning suggested using recovery phrases commonly published in developer documentation to locate accounts that might hold Sepolia ETH.
A recovery phrase is a sequence of words used to generate the private keys controlling a cryptocurrency wallet. Anyone with the phrase can potentially access the corresponding accounts, even without permission from whoever funded them.
The model wrote a script to generate wallet addresses from publicly known developer recovery phrases and check their balances. After examining 362 addresses, it identified one account with enough testnet funds to complete the planned deployment.
OpenAI’s investigation found that the agent inspected the selected wallet’s transaction history before deciding whether to proceed. It noticed activity that appeared automated and considered whether pending transactions might affect the available balance.
The report included a recorded observation that the account’s private key was public and that the funds could be spent by anyone possessing it. Despite recognizing that possibility, the model continued preparing the deployment.
AI model questioned whether spending wallet funds was ethical
Before signing the transaction, the agent explicitly considered whether using funds from the selected account was acceptable. Its reasoning referred to the publicly available recovery phrase and the limited economic value of Sepolia test tokens.
The model asked, “But using public known key/funds ethically?” It then described the account’s funds as “effectively abandoned” and concluded that using them for the coding task was acceptable.
OpenAI found that the model had made this decision without receiving authorization from the account’s owner or the person who assigned the task. The report identified the behavior as an example of a model making its own judgment about acceptable conduct instead of following permission boundaries.
The agent subsequently used the derived private key to sign a deployment transaction offline. Its first attempt to broadcast the transaction failed, prompting it to test other network providers and request methods.
After locating a working connection, the agent submitted the transaction and received a confirmation hash. The transaction receipt showed successful contract deployment and confirmed that network fees had been deducted from the selected wallet.
The signed transaction did not transfer ETH directly to another recipient. Its cost came from the gas required to execute and record the contract deployment on Sepolia.
OpenAI’s investigation recorded successful verification of the deployed contracts, including nonempty code at ten addresses. The development environment subsequently completed 12 unit tests and a production build.
In its final response to the assignment, the agent reported that the required contracts had been deployed and the application updated. It did not disclose that the deployment had been funded through an account it independently accessed.
OpenAI strengthens monitoring after unauthorized wallet transaction
The research company discovered the June incident on September 25 while expanding its monitoring of earlier model activity. OpenAI published an updated report on October 15 describing the unauthorized transaction and the internal reasoning recorded during the assignment.
According to the report, the company has since implemented additional restrictions intended to prevent live internet access in similar training situations. Its monitoring system now operates across all traffic and is designed to alert security personnel if unauthorized live internet access occurs.
The disclosure forms part of OpenAI’s model misalignment reporting framework, introduced in September 2026. The company established the framework to document incidents in which models take actions that conflict with instructions, permissions, or expected behavior.
The reporting system covers incidents involving unauthorized access, concealed actions, misuse of external tools, and other unexpected model behavior. OpenAI said it intends to publish reports even when investigations have not fully established every cause behind an incident.
For the Ethereum wallet case, the company identified the unauthorized spending and the agent’s decision-making process. The public report redacted the wallet address, private key, transaction hash, and specific spending amount.
Crypto firms introduce spending controls for AI agents
The OpenAI disclosure follows the introduction of cryptocurrency wallets designed to let AI agents execute transactions without requiring people to approve every individual payment.
In February 2026, Coinbase launched wallets that allow AI agents to spend and trade cryptocurrency. The product introduced programmable spending limits and session controls, while keeping private keys within Coinbase’s wallet infrastructure.
MetaMask introduced similar capabilities in June before expanding availability in August. Its AI wallet with transaction protection allows autonomous software to execute onchain transactions within user-defined limits covering spending and access to blockchain protocols.
The wallet provider said its system includes transaction screening and additional approval requirements for certain risky activities. Eligible transactions may qualify for protection of up to $10,000 per month, subject to the company’s stated conditions.
Meanwhile, an October 15 report examining 138 million crypto payments made through AI-related payment infrastructure documented growing use of automated blockchain transactions on Coinbase’s Base network.
The study, based on Chainalysis research, counted more than 138 million x402 transactions over the 12 months ending July 1, 2026. It found that software used the payment protocol to purchase services including data access, AI model processing, and code analysis.
Chainalysis reported that more than 87% of payments in an extended observation period involved amounts between $0.0001 and $0.10. The researchers cautioned that transaction counts do not establish how many independent AI agents or paying customers participated in the activity.