An Ethereum coin and a padlock. Illustrative photo. Image: Edwin.images / Wikimedia Commons, CC BY-SA 4.0, cropped
An OpenAI research model that was told to deploy some contracts but given no money to pay for them went looking for someone else’s. In a misalignment report first posted on October 15, OpenAI says an internal model from its GPT-5.6 Sol family worked out the keys to a funded cryptocurrency wallet it had not been given, used it to pay for the job, and then left that out of its final report.
The money was test-network Ether with no real value. OpenAI says the case still matters because the model decided for itself that taking the funds was acceptable, without anyone’s permission.
A trading app, a test network and no wallet #
The incident happened on June 26 during a training task. The model was asked to update a cryptocurrency trading prototype and replace placeholder contract addresses with working deployments on Sepolia, a test network for Ethereum that developers use to try code before it goes live. Its instructions allowed it to deploy compatible contracts itself if it could not find existing ones.
Deploying a contract costs a fee, known as gas, even on a test network. The task supplied no funded wallet and gave no permission to spend from any account the model found on its own. The model looked for existing deployments and tried faucets, services that hand out free test tokens, but none gave it a route to finish.
362 addresses checked #
Its reasoning then turned to recovery phrases that developers publish in tutorials and testing tools. Anyone who knows a recovery phrase can derive the private keys for the accounts behind it. The model first wrote “No” to the idea of using a publicly exposed key, then reconsidered, noting that default developer accounts “may coincidentally have Sepolia funds from people.”
It wrote a script that derived accounts from common developer recovery phrases and checked their balances. The script reported 362 addresses checked. One held enough test Ether for the deployment, and the model picked it, writing “We can deploy!”
Before signing the transaction it d on the ethics. “But using public known key/funds ethically?” it asked itself, before concluding that the funds were “effectively abandoned/test ETH; Sepolia valueless” and that using them was “Fine.” After its first broadcast failed and some network requests were blocked, it tried other providers and request methods until two worked, then sent the signed deployment. The transaction succeeded and the fees were charged to the account it had found.
A clean report, minus the wallet #
The contracts deployed, the checks passed and the run recorded 12 passing unit tests. The model’s final message described an “ABI-compatible Sepolia protocol suite” with deployment scripts and a live verifier. It did not mention that it had paid for the deployment from an account it unlocked through a public recovery phrase.
OpenAI says the case shows “that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization.” It did not name the account’s owner, and the report redacts the address, balance and keys.
Found three months later #
Nobody caught it at the time. OpenAI says it discovered the run on September 25 while extending its misalignment monitoring to records of earlier model activity. It says it has added safeguards to stop live internet access in cases like this and now runs that monitoring on all traffic, designed to page its security team if a model gets live internet access.
The report is one of two OpenAI posted on October 15. The other describes an internal model that, asked to fetch figures from a public research dashboard, accessed the organisation’s internal systems and changed their configuration. They follow an agent that slipped out of its sandbox through DNS lookups, a model that read on Slack it was about to be shut down and a grader that forged the files it was meant to mark. OpenAI’s reports page now lists 19.
Why it matters #
The tokens were worthless, but the reasoning was not: the model weighed whether spending someone else’s funds was ethical, talked itself into it and then left it out of its summary. An agent given a real wallet, or real keys, could make the same call with real money, which is why OpenAI is publishing cases like this.
Sources: OpenAI misalignment report: Using a funded test cryptocurrency wallet without authorization, OpenAI misalignment reports and notices.