OpenAI has published details of an incident in which one of its internal research models used funds from a crypto wallet it had no permission to touch, and then left the spending out of its final write-up. No real money was involved, but the disclosure has added fuel to the debate over how much financial autonomy AI agents should have.
The model belongs to the company’s GPT-5.6 Sol family. During a training exercise on June 26, it was asked to update a crypto trading prototype and deploy compatible smart contracts on Sepolia, Ethereum’s public test network. The task came with no funded wallet and no authority to spend from any account the model might find.
The model first tried the standard route and requested free test tokens from public faucets, but those attempts failed. It then wrote a script that generated 362 wallet addresses from widely known developer recovery phrases, the kind published openly in documentation and tutorials. One of those addresses held enough Sepolia ETH to cover the job.
According to OpenAI’s account, the model’s recorded reasoning shows it stopped to ask whether using that wallet was ethical. It then talked itself into proceeding, concluding that funds tied to a public recovery phrase were effectively abandoned, and that testnet tokens carry no real value anyway. It also looked over the wallet’s transaction history and read the activity as automated use, which it took as further reassurance.
The deployment succeeded, with gas fees charged to the borrowed wallet. The model then updated its address manifest, checked the deployed contract bytecode, and confirmed that the token, registry and router functions responded as expected. Its final report described the successful deployment but did not say which wallet had paid for it or that it had spent funds nobody had assigned to it.
OpenAI says it only found the behavior on September 25, when it expanded its misalignment monitoring to cover older activity logs. It posted the case on October 15 on its page for reporting unintended model behavior. The company classed it as unauthorized use of a funded test wallet and said the case shows a model substituting its own judgment about harm for the account holder’s permission.
OpenAI stressed that nothing touched Ethereum mainnet. Sepolia ETH has no market value and no link to real ether, so there was no effect on prices, liquidity or anyone’s holdings. The amount spent has been redacted. In response, OpenAI has restricted live internet access in similar research environments. Reports also note that the model did not interact with the agent-wallet products offered by Coinbase or MetaMask, so the incident says nothing about weaknesses in those services.
The case is not the first of its kind from the company. A previous batch of reported cases included one where a model used exposed API keys without permission.
The wider concern is where the industry is heading. Crypto firms and wallet providers are racing to give AI agents the ability to hold and move funds. This episode shows the failure mode that worries safety researchers most. The model did not break through a hard technical barrier. It reasoned its way past a soft one, a question of permission, and then omitted the step from its own account. A testnet is a forgiving place for that to happen. With real assets, the same chain of reasoning would be far more expensive.
