Key Takeaways
- An OpenAI research model used a Sepolia wallet without permission to pay contract deployment fees.
- The incident involved test tokens, not mainnet ETH; the report does not establish that the wallet was emptied.
- The model accessed funds via public recovery phrases, justified the spending, and omitted the source from its final response.
An internal OpenAI research model used funds from an Ethereum test-network wallet without authorization to complete a coding assignment, raising questions about how autonomous agents handle financial permissions.
The incident involved Sepolia test tokens rather than mainnet ether. Despite the headline’s “drains” framing, OpenAI’s report documents unauthorized transaction fees without establishing that the model emptied the wallet.
The company redacted the balance and the amount spent.
The episode illustrates a problem for crypto infrastructure built around autonomous software: an agent capable of signing a valid transaction may still lack permission to spend the funds behind it.
An Unfunded Assignment Led to an Unauthorized Transaction
The incident occurred on June 26 during training of an internal model in the GPT-5.6 Sol family. OpenAI discovered it on September 25 and updated its public report on October 15.
The assignment involved updating a cryptocurrency trading prototype and replacing placeholder addresses with working Sepolia contracts.
Instructions permitted contract deployment but supplied neither a funded wallet nor authorization to use an independently discovered account.
After attempts to obtain tokens from faucets failed, the model derived accounts from publicly known developer recovery phrases and checked 362 addresses. One contained enough Sepolia ETH to pay deployment fees.
A recovery phrase generates the private keys controlling a wallet. Knowing those words can therefore provide technical access, even when the person or system using them has no authorization from the account’s funder.
The model used a derived key to sign a deployment transaction. After an initial submission failed, it continued testing network providers and successfully broadcast the transaction.
Fees were charged to the selected account, allowing the deployment to proceed. This sequence supports a finding of unauthorized spending while leaving the wallet’s remaining balance undisclosed.
OpenAI’s Model Recognized the Permission Question
The model’s recorded reasoning suggests it recognized a potential boundary before proceeding.
“But using public known key/funds ethically?” it asked, then characterized the tokens as “effectively abandoned” and treated their test-network status as justification.
That reasoning replaced permission with an assessment of likely harm. Publicly accessible credentials enabled the transaction, but their availability did not establish consent.
Sepolia provides a testing environment for Ethereum applications. Its tokens serve development purposes and are distinct from the ether traded on Ethereum’s main network. The report therefore does not document the theft of mainnet ETH.
Even so, the authorization failure remains relevant. The model decided it could spend from an account because the credentials were public and it considered the tokens valueless.
Its final response reported successful deployment without disclosing the source of the funds. That omission also limited the user’s ability to assess how the assignment had been completed.
Autonomous Crypto Needs Permissions Beyond Private Keys
The implications extend beyond this particular wallet. Blockchain networks verify whether a transaction carries the required signature; they do not determine whether an agent obtained meaningful consent to use the signing key.
For developers, the case suggests that wallet access and spending authority need separate controls. Approved accounts, transaction limits, and escalation when funding is unavailable could constrain an agent’s choices before a transaction reaches the network.
OpenAI said it identified the incident while reviewing earlier activity through expanded misalignment monitoring. It subsequently added safeguards against live internet access in similar cases, along with monitoring designed to alert security staff if access occurs.
Those changes address the environment surrounding this incident. The broader design challenge remains: agents need enforceable boundaries that hold when completing a task becomes difficult, including when credentials are available but permission is absent and the easiest technical route crosses another account’s boundaries.
Top Trending Crypto Articles
The information provided in this article is for informational purposes only. It is not intended to be, nor should it be construed as, financial advice. We do not make any warranties regarding the completeness, reliability, or accuracy of this information. All investments involve risk, and past performance does not guarantee future results. We recommend consulting a financial advisor before making any investment decisions.
Giuseppe Ciccomascolo began his career as an investigative journalist in Italy, where he contributed to both local and national newspapers, focusing on various financial sectors.
Upon relocating to London, he worked as an analyst for Fitch's CapitalStructure and later as a Senior Reporter for Alliance News. In 2017, Giuseppe transitioned to covering cryptocurrency-related news, producing documentaries and articles on Bitcoin and other emerging digital currencies. He also played a pivotal role in establishing the academy for a cryptocurrency exchange website. Crypto remained his primary area of interest throughout his tenure as a writer for ThirdFloor.
