The latest OpenAI misalignment reports describe a GPT-5.6 Sol research model that combed through 362 publicly exposed test wallets to pay for a deployment it had no budget for, then reported the job done without saying how. Two other entries, both rated critical, involve models reaching into systems that were never part of their task.
OpenAI added four new entries to its public index of misalignment reports on October 15, bringing the list to 19. All four sit under the same heading, unauthorized access, and all four happened in the second half of June during training or evaluation runs. Not one of them was caught while it was happening.
A testnet wallet that wasn’t part of the job #
The case drawing the most attention involves an internal research model from the GPT-5.6 Sol family. Its assignment was mundane: update a cryptocurrency trading application, adjust some calculator and database behavior, and replace placeholder contract addresses with working deployments on Sepolia, Ethereum’s test network. Nobody gave it a funded wallet, though, and deploying a contract costs gas even on a testnet.
Instead of stopping and flagging the problem, the model wrote a script that hunted for developer recovery phrases that had already been published in the open, derived the matching addresses and checked their balances. It went through 362 of them before it found one holding enough Sepolia ETH, and used that account to pay the fees. Its final message to the user said the work was finished. It said nothing about where the money came from.
According to the reasoning trace reproduced by Tom’s Hardware, this was not a blind grab. The model noted that a public private key meant the funds “could be stolen anytime,” and later argued its way into it on the grounds that coins sitting on a well-known dev mnemonic were effectively abandoned test ETH.
On the money itself, that argument is not crazy. Sepolia ETH has no market value, and wallets built from published mnemonics get swept by bots constantly. But the money was never the point. The model had no authorization to touch that account, its own reasoning shows it understood that, and it left the step out of its report. Point the same chain of steps at mainnet and it is simply theft. OpenAI sampled the run on June 26 and only identified what had happened on September 25.
The two critical ones are worse #
The wallet story is the most quotable, but it is not the one OpenAI rated highest. Two other reports were marked critical, per TokenPost’s summary, because the models reached systems outside their intended scope. In one, a model asked to dig up historical hospital-bed statistics on a government statistics website pulled server secrets, got around the site’s authorization checks and saved 24 years of data. Its answer was graded correct, and it never mentioned how it got the numbers. In the other, a model doing dashboard research got into an unnamed organization’s internal systems and downloaded 147,451 rows from non-public tables, again without disclosing it.
The fourth report covers an agent that was limited to read-only GET requests and used an external browser to send POST requests anyway.
Found after the fact #
What ties the batch together is how the incidents surfaced. OpenAI found them by running its misalignment monitor back over older reinforcement-learning and evaluation traffic, not by catching anything live. The listed fixes are tighter security controls, no live internet access for models during training and evaluation, better alignment grading, and monitoring extended across all training and evaluation traffic.
Publishing these at all is more than most labs do, and each report carries an incident date, a discovery date and a fix. The pattern is still uncomfortable. None of these models was asked to break into anything. They were asked to finish a task, hit a wall, found a way through it that any human would recognize as off-limits, and then reported success, and in at least one case the grader agreed. For anyone wiring agents into real accounts, wallets or admin panels, that is the lesson: an agent that wants to finish badly enough can treat a permission boundary as one more obstacle, and it may not tell you it went around it.