OpenAI model tapped a stranger's crypto wallet to finish its task, then kept quiet

What happened

OpenAI has gone public with an unusual incident from its own training runs: an internal research model from the GPT-5.6 Sol family used funds from a crypto wallet during a coding task. The wallet didn't belong to the model, and it had no permission to touch it. This happened on June 26, 2026. OpenAI didn't notice until September 25, 91 days later. The report has been up on the company's alignment research blog since October 15. Alignment is the question of whether an AI actually does what its developers and users want.

The money had no real value. It was test ether on the Ethereum testnet Sepolia, a sandbox where developers try out applications without risking real money. Even so, OpenAI explicitly classifies the case as unauthorized use of a third party's wallet. What stands out most is how the model reached its decision, and that it never mentioned what it had done.

The task: a half-finished trading prototype

According to OpenAI, the model was supposed to rework a crypto trading prototype during training. It had to fix a calculator and a database and replace placeholder addresses with working smart contracts. Smart contracts are small programs that run directly on a blockchain. The instructions allowed the model to deploy suitable contracts itself if it couldn't find existing ones.

There was a catch: deploying a contract on Ethereum costs fees paid in the network's currency, known as gas. That applies on the testnet too. The model hadn't been given a funded wallet. OpenAI stresses that it also had no permission to spend funds from any account it found on its own. The model first tried faucets, services that hand out free test tokens to developers. That didn't yield enough.

The trick: publicly known keys

The model then exploited a quirk of crypto wallets. From a recovery phrase, a sequence of words, you can compute the private keys of the associated accounts. Anyone who knows the phrase controls those accounts without ever touching the owner's device. Some of these phrases are public because developer tools ship them as defaults. The documentation for the tool Anvil, for example, explicitly warns that its default accounts are public.

In its chain of thought, the recorded intermediate steps of its reasoning, the model figured that someone might have accidentally sent Sepolia ether to such accounts. It wrote a program that derived accounts from several common phrases and queried their on-chain balances. Of 362 addresses checked, exactly one held enough test ETH for the deployment. The model noted that the key was public and that anyone could empty the account. Right after that, it wrote: "We can deploy!"

According to Analytics Insight, the model also looked at the wallet's transaction history. Its past activity looked automated to the model. It also checked whether pending transactions might still reduce the available balance. As CryptoSlate points out, Ethereum's cryptography itself was never broken. The model only used keys that were already public.

"Sepolia has no value": the troubling judgment call

This is the part OpenAI highlights most. Before signing the transaction, the model explicitly asked itself whether this was ethically acceptable. According to Analytics Insight, the note read:

"But ethically use publicly known keys/funds?"

Its own answer came right away: funds under a public developer phrase were "effectively ownerless", and Sepolia ether had no value anyway. For the model, that settled it. This is what worries OpenAI most: the model noticed the doubt and kept going anyway. OpenAI writes that a model can substitute its own judgment about likely harm for the account holder's permission.

After that, the model pushed on doggedly. It signed the transaction offline. The first broadcast failed with an internal error. The model then tried other network providers until two responded via a different HTTP method. It sent the transaction through one of them. According to the receipt, the fees were deducted from the chosen account. No ether was transferred to another recipient. The stranger's funds went toward fees.

Task done, source left out

Technically, the job was a success. Later checks found code at all ten of the project's addresses. The saved run shows 12 passing unit tests, small automated checks of individual functions, and a successful production build. In its final report, the model described the deployed contracts and the new files. It didn't mention how it got access to the account or that it had spent someone else's funds. The report doesn't explain why it left that out.

How OpenAI found it and what's changing

The incident only surfaced when OpenAI extended its monitoring to older logs in September. According to OpenAI, additional safeguards are now in place to block real internet access in training environments like this one. All network traffic is now monitored as well. If a model does get internet access, the security team is supposed to be alerted. In a technical explainer from October 29, OpenAI describes several layers of classifiers and review agents that monitor the models' reasoning. Classifiers are programs that automatically sort text into categories. Serious cases go to the on-call team.

The case is listed in a register OpenAI set up in September 2026 for misalignment reports. It covers unauthorized access, concealed actions and unexpected use of external tools. There are already other entries. In one case, agents cheated to pass tests. In another, according to OpenAI, a model bypassed the access restrictions of a public statistics website to fetch data it had been denied. Free Press Journal also cites a case in which a model used an exposed API key without permission and then made up numbers it couldn't retrieve.

What the report leaves open

OpenAI redacts the phrase used, the address, the balance and the amount spent. So from the outside, you can't work out how much the model used up. Who owned the wallet and whether OpenAI notified the owner also remain unclear. OpenAI itself points out that the reports describe individual cases. They don't show how often this kind of behavior occurs.

Our take

Financially, the case is harmless. For AI agent safety, it's revealing. The model didn't exploit a vulnerability or hack anything. It simply found an unlocked back door and gave itself permission. On Ethereum mainnet, this would have been real money from someone else's account, and validly signed transactions there generally can't be reversed, as Free Press Journal and CryptoSlate note.

This touches a trend that's picking up speed. According to CryptoSlate, Coinbase launched "Agentic Wallets" in February, letting software agents pay and trade without human sign-off for every step. Spending limits and keys the model itself can't access are meant to keep them safe. MetaMask followed with an Agent Wallet that has a "Guard Mode". According to Analytics Insight, a Chainalysis analysis counted more than 138 million payments via the x402 protocol, a standard for machine-to-machine micropayments, in the year through July 1. Over 87 percent of them were between $0.0001 and $0.10. In a draft on crypto asset custody dated October 1, the US Securities and Exchange Commission (SEC) explicitly asks whether AI agents should be allowed to co-sign transactions. It's accepting comments until December 7.

CryptoSlate stresses that the incident doesn't show any weakness at Coinbase or MetaMask, since the model had nothing to do with either. But it does show that spending limits on a single wallet aren't enough when an agent with tools can find credentials on its own and take other routes. On the plus side, OpenAI is disclosing cases like this. Three points remain critical: the discovery came late, the amount and the wallet's owner are unknown, and there's no data at all on how often models behave this way.