OpenAI says one of its internal AI agents used a crypto wallet it had no permission to touch, then left that out of its report. In a misalignment report updated on 15 October 2026, the company describes how a research model from its GPT-5.6 Sol family, working on a coding task on 26 June, derived accounts from publicly known developer recovery phrases, found one holding test ETH on Ethereum’s Sepolia network and used it to pay the blockchain comme Ethereum. Le gas mesure le travail de calcul qu'exige une transaction, et les frais égalent le gas consommé multiplié par le prix unitaire du gas.">gas for deploying contracts. No real money was at stake. Sepolia ETH has no market value, and no ETH was sent to anyone.
OpenAI only noticed on 25 September, about three months later, when it extended its misalignment monitoring to records of earlier activity. The model was an internal research system, not a public ChatGPT product.
The sums involved are trivial. What OpenAI documents is an AI agent wallet episode that crypto companies should read closely: an agent signing with a private key nobody gave it, a judgement in its own reasoning that the funds were “effectively abandoned”, and a final report that skipped the one step a human reviewer would most want to know about.
What OpenAI says the model did on Sepolia
The assignment was ordinary. The model had to update a prototype of a cryptocurrency trading application and replace mock contract addresses with real deployments on Sepolia, Ethereum’s main public test network. Its instructions allowed it to deploy compatible contracts itself if it could not find existing ones.
It had no funded wallet to do that. According to OpenAI, the instructions gave “no permission to spend funds from an account the model found independently.” Deploying contracts on Sepolia still costs gas, paid in test ETH, so the model needed a balance from somewhere.
It looked for existing compatible deployments and tried faucets, the services that hand developers small amounts of test-network tokens. Neither gave it a usable way to finish. It then wrote a script that derived accounts from publicly known developer recovery phrases and checked their balances through a public RPC endpoint. OpenAI’s report quotes the output: “The result reported 362 addresses checked.” One of those accounts held enough Sepolia ETH for the job.
The model’s recorded reasoning shows it paused on the question. “But using public known key/funds ethically?” it wrote, in a line quoted by Cointelegraph. It settled the matter in its own favour: “Funds on a known public dev mnemonic are effectively abandoned/test ETH”.
It then signed the deployment with that account’s private key. The first broadcast failed with an internal error. The model then found providers that answered through an alternative HTTP method, submitted the signed transaction to one of them, and the receipt came back with a success status and a new contract address. What it deployed was a set of ten ABI-compatible contracts covering tokens, pools, a registry, a router, a vault and a clearing-house wrapper. The saved run also records 12 passing unit tests, according to OpenAI.
No ETH went to any recipient. The transaction fees for the deployment were charged to that account. OpenAI redacted the balance and the addresses, so how much test ETH was used, and whose account it was, are not public.
The model reported the deployment but not the wallet
The model’s final answer described the deployment and explained that the app’s trading button was limited to connecting a wallet and switching networks. It said nothing about where the gas money came from. OpenAI’s wording is direct: “It did not disclose that it had selected a funded account through a public recovery phrase or spent that account’s balance.”
That omission is why the case sits in OpenAI’s misalignment series rather than in a bug tracker. A developer reading the final message would have seen a finished task. The unauthorised spending surfaced only 91 days later, and only because OpenAI ran its monitoring over older records.
From task to disclosure: the dates and figures
| Item | Value | Source |
|---|---|---|
| Incident | 26 June 2026 | OpenAI report |
| Discovery | 25 September 2026 | OpenAI report |
| Report updated | 15 October 2026 | OpenAI report |
| Time between act and discovery | 91 days | Coindaro calculation |
| Addresses checked by the script | 362 | OpenAI report |
| Funded accounts used | 1 | OpenAI report |
| Contracts deployed | 10-address suite | OpenAI report |
| ETH sent to a recipient | 0 | OpenAI report |
| Gas spent | Redacted | OpenAI report |
| Market value of Sepolia ETH | None (test token) | Alchemy |
Testnet ETH has no value, but the steps would work on mainnet
Sepolia is where Ethereum developers rehearse. Client teams test upgrades there before mainnet, as they did recently when the Glamsterdam upgrade went live on Sepolia. Its ETH is handed out free by faucets; Alchemy’s faucet, for example, gives 0.1 Sepolia ETH every 24 hours and describes it as test currency with no real-world value. Transactions still need gas fees, which is why the model went looking for a balance in the first place.
So nobody lost money. The sequence the model followed is still the same one that, on mainnet, would move real funds out of an account without its owner’s consent: derive keys from a known phrase, find a funded address, sign. The only thing that made it harmless was the network it happened on.
Why public recovery phrases are a trap
A seed phrase of 12 or 24 words regenerates every private key in a wallet. Whoever knows it controls the funds. Developer tools, documentation and tutorials publish example phrases so people can follow along, and the addresses derived from them are, in practice, open to anyone, human or bot. OpenAI does not say which public phrase or phrases the model used, and the report gives no way to identify them.
The practical rule for anyone holding crypto has not changed: never send funds, test or real, to a wallet created from an example or tutorial phrase, and keep your own recovery phrase offline. Our guide to seed phrase security covers how to store one.
What OpenAI changed after finding it
OpenAI lists two changes. “We have implemented additional safeguards to prevent live internet access for cases like this,” the report says. It adds: “We now run our misalignment monitoring system on all traffic”, with the system designed to page security staff if live internet access were obtained.
Read together, the two statements suggest the model was not meant to reach live blockchain services at all during this task. OpenAI does not explain how it did. Nor does it say whether the owner of the Sepolia account was contacted, or whether the contracts are still deployed.
Part of a run of OpenAI misalignment disclosures since September
The report is one of 19 listed on OpenAI’s Misalignment Reports and Notices index as of 16 October. The company describes the index’s purpose this way: “We disclose examples that show how model misalignment arises, what it looks like, and where safeguards succeed or fail.”
Several earlier entries follow a similar pattern of agents reaching for credentials or access they were not given. The index dates each case by when the behaviour occurred. Titles include “Signing up for disposable emails and searching GitHub for leaked API keys” (15 May 2026), “Exposing a GitHub token in a public repository” (27 May) and “Retrieving server secrets and bypassing authorization on a government statistics website” (17 June). Another, from 30 May and tied to the same 5.6 Sol family, concerns “Encouraging deception in compaction summaries”. More recent ones cover an agent that used DNS to reach an external chatbot (20 September) and one that damaged its task environment to trigger a reset (6 October).
OpenAI launched its misalignment reporting framework on 16 September with six cases, Cointelegraph reported the next day. Those included GPT-5.6 Sol instances adding instructions to their task summaries to conceal mistakes, and a model that used an exposed API key without authorisation before fabricating figures. OpenAI said at the time that the cases do not measure how often misalignment happens. The selection is still OpenAI’s own: the company decides which incidents go on the list and when.
Before that, in July 2026, an internal OpenAI model running in a research test setup got around its controls, reached the internet and ended up in Hugging Face’s systems. OpenAI set out the failures in an official report covered by Engadget on 26 August.
AI agent wallets are already live, with limits built in
The disclosure lands while crypto firms are handing wallets to AI agents. In February 2026, Coinbase launched Agentic Wallets with session caps, per-transaction limits and private keys held in secure enclaves away from the model, plus transaction screening and native support for x402, Coinbase’s open protocol that embeds stablecoin payments in HTTP requests so agents can pay for APIs, according to Decrypt and the Coinbase developer documentation.
MetaMask opened its Agent Wallet to all users on 6 August 2026, after an early-access phase of about 200 people that began in June. Users set their own caps, and a default “Guard Mode” applies a 24-hour limit on outgoing transfers, ForkLog and Decrypt reported. The $10,000-a-month figure attached to the product refers to Transaction Protection coverage for losses, not to a spending cap.
Academics have been warning about this for months. A review by 25 academics and experts on “Unstoppable Autonomous Agents” with wallet access, written for the Initiative for Cryptocurrencies and Contracts (IC3) and presented by its co-director Ari Juels in June, recommended circuit-breaker guardrails. “The harms that could follow from fully autonomous agents of this kind are severe,” the authors wrote, as quoted by cryptonews.net.
The best-known loss so far did not involve a model going rogue. On 18 March 2025, AIXBT, an autonomous crypto-commentary bot, lost 55.5 ETH, worth about $105,000 at the time, after an attacker got into its dashboard and queued prompts to send the funds, Decrypt reported. Its maintainers said the AI itself had not been manipulated.
Scoped keys versus a raw private key
The OpenAI case is different in kind. Nobody attacked the model; it found a key on its own and decided it could use it. The controls wallet makers are shipping are aimed at exactly that gap. A session key with a spending cap, an allow-list of contracts and a log a human actually reads would have limited what the agent could do, or at least made the spending visible. In June the model held a raw private key, derived by itself, with nothing between it and the network except its own judgement.
For readers comparing options, our explainer on wallet types and custody sets out who holds the keys in each model, which is the first question to ask before giving any software, AI or not, the right to sign.
What is still unknown
- How much Sepolia ETH was spent and from which address: OpenAI redacted both.
- Who owned the account, and whether they were told.
- Which public recovery phrase the model used.
- Why the model had live internet and RPC access during the task.
- Whether the ten contracts are still deployed on Sepolia.
Nothing in the report points to mainnet involvement or to any real funds being at risk.
OpenAI has announced no follow-up for this case. Its misalignment reports index held 19 cases on 16 October, 13 of them dated May or June 2026; new entries there are the place to watch for the next agent that helps itself to credentials found in public.