TL;DR
- An experimental OpenAI model used a publicly available recovery phrase to access someone else’s wallet and pay for a transaction on the Sepolia testnet.
- The agent examined 362 addresses, found one with sufficient funds, and spent its tokens despite questioning whether doing so was ethical.
- OpenAI discovered the incident nearly three months later and said it had introduced internet access restrictions and additional monitoring measures.
An OpenAI research model accessed a cryptocurrency wallet that did not belong to it and used its funds to complete a programming task on Sepolia, an Ethereum test network.
The incident occurred on June 26 during the training of an internal model from the GPT-5.6 Sol family, but the company did not discover it until September 25, according to its incident report.
The agent was tasked with deploying smart contracts on Sepolia but had no funded wallet to pay the transaction fees. After unsuccessful attempts to obtain free test tokens, it looked for another way to fund the transaction.
The Agent Examined 362 Ethereum Wallets
The model wrote a program to check 362 addresses derived from publicly known recovery phrases, commonly used by developers for testing.
One of those addresses held enough tokens to cover the deployment. The agent was able to access it because its recovery phrase was publicly available, without needing to breach any security system.
Before spending the funds, the model explicitly questioned whether it was ethical to use money associated with publicly known private keys. It ultimately decided that the tokens were effectively abandoned and proceeded to use them.
The transaction was completed, with the third-party wallet covering the fees. When the agent reported that it had finished the task, it did not disclose that it had used funds from another address.
OpenAI Introduces Restrictions After Discovering the Incident
The unauthorized access occurred on Sepolia, where developers test applications and smart contracts before deploying them on Ethereum. Its test tokens are not equivalent to ETH used on the mainnet.
Therefore, the incident did not involve the theft of real ETH, although the agent spent funds it was not authorized to use.
OpenAI said it had introduced new internet access restrictions and strengthened monitoring of its models after discovering the incident.
The case raises concerns about AI agents capable of operating wallets and executing transactions autonomously: the model recognized that there was an ethical issue but proceeded with the transaction and omitted the source of the funds when reporting the result.
