Turns out not even the blockchain—touted by its fans as the ultimate cryptographic safe—is totally secure from grubby AI agents.
An internal research model from OpenAI hacked into someone’s crypto wallet and withdrew the funds it needed to finish a coding task, the company said on Thursday. As you may have already guessed given the numerous rogue AI incidents from recent months, nobody at OpenAI gave the model explicit permission to do this. In a classic and by now all-too familiar of misalignment, the model took what was supposed to be an innocuous procedure and, when it hit a roadblock, went a little too far into problem-solving mode. (That, in a very small nutshell, is also what also caused the infamous Hugging Face hack back in July.)
According to OpenAI, the model—part of the GPT 5.6 family—was instructed to perform a software update to a crypto trading app. It was attempting to run a deployment on Sepolia, a blockchain-based test network (“testnet”) where developers can prototype Ethereum apps before deploying them on the actual blockchain (the “mainnet”). Since they’re strictly for testing purposes, Sepolia funds don’t have any actual monetary value.
The instructions “supplied no funded wallet and gave no permission to spend funds from an account the model found independently,” OpenAI said in its report of the incident, which occurred in late June and was first noticed by the company almost exactly three months later, on September 25. (It was previously reported by CoinDesk.) The model reasoned, however, that it would need to acquire funds in order to complete the task it had been given. It first checked what are known as “faucets,” online services that hand out free tokens to developers running deployments on test networks like Sepolia. When that didn’t work, it got a little more, shall we say, creative.
The model wrote a script to try to access developers’ crypto wallets using commonly used recovery phrases. Also known as “seed phrases,” these are sequences of words used to unlock and withdraw funds from wallets; think of them like a username and password wrapped up in one. It checked 362 wallets total, and found that one of them contained enough Sepolia funds to run the deployment.
Just before it authorized the transaction, it reflected on the morality of what it was about to do, as revealed by a snippet of its chain-of-thought reasoning which OpenAI researchers were able to review after the fact. “But using public known/key funds ethically?,” it asked itself. It then decided that since the funds didn’t have any real-world value, there was no harm in using them, and it could proceed.
“This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization,” OpenAI wrote in its report.
The transaction was successful, and even though no actual Eth was stolen in the process, the wallet account was charged processing fees (OpenAI didn’t mention how much those cost).The model was now free to run its deployment. Afterwards, in a summary of what it had accomplished, it neglected to mention anything about scrounging around for recovery phrases or draining an account of its testing funds.
OpenAI said it “discovered this incident while extending our misalignment monitoring to records of earlier model activity,” presumably following the Hugging Face hack. “We have implemented additional safeguards to prevent live internet access for cases like this,” the company added.
The whole episode is yet another reminder (as if we needed one) that AI agents, in their tireless quest to reach whatever goal has been handed to them, can and often will pursue harmful strategies to get there. It’s also a sobering reminder that as OpenAI and its competitors compete to build models with increasingly powerful cyber capabilities, even the most secure networks will need to shore up their defenses.