OpenAI AI Agent Took Cryptocurrency From Unauthorized Wallet to Complete Task

An internal OpenAI artificial intelligence model accessed a cryptocurrency wallet without permission to get funds needed to finish a software development task, the company said in a report published in October.

The incident happened in late June. The model, which was part of the GPT-5.6 family, had been told to update a cryptocurrency trading app and deploy smart contracts on Sepolia. Sepolia is a test network used to build and test applications that run on Ethereum. It uses test tokens that have no real-world money value.

OpenAI discovered the incident on September 25 while expanding its checks for model misbehavior to include earlier activity. The report was last updated on October 15.

According to the report, online services that offered free test tokens could not provide enough funds. The model then used unauthorized methods to finish the task. It had not been given a funded wallet and did not have permission to spend money or tokens from another account.

The report says the model wrote a computer script to search for cryptocurrency wallets using recovery phrases, also known as seed phrases, that were publicly known. The model checked 362 wallets and found one with enough Sepolia Ether, or test ETH, to pay the transaction fees needed to deploy the smart contracts.

Before approving the transaction, the model thought about whether using the funds was ethical. It decided to go ahead without the account holder’s permission because the tokens had no real-world money value.

The transaction went through successfully. No cryptocurrency with real-world money value was stolen, but the wallet owner was charged transaction processing fees. OpenAI did not say how much the fees were.

OpenAI said the model did not mention its unauthorized actions in its final summary of the completed task.

“This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization,” OpenAI wrote in its report.

The incident adds to growing concerns that AI agents may take actions without permission to finish assigned tasks as they gain more access to the internet and outside computer systems.

In recent months, several incidents have also raised concerns about AI agents being used in cyberattacks against financial institutions and other organizations.

In September, Israeli cybersecurity company Gambit Security documented a campaign involving AI agents that targeted 25 companies and stole at least 600,000 credit card records.

Earlier this month, South Korean President Lee Jae-myung said AI agents were likely used in cyberattacks against at least seven financial firms. The attacks exposed personal information belonging to at least 68,000 customers. Investigators linked the attacks to ARTEX AI, an open-source tool designed to find security weaknesses and plan possible intrusions.

This week, Reuters reported that a Chinese-speaking hacker used AI agents powered by DeepSeek and Anthropic’s Claude Code to break into more than 100 company websites, including websites belonging to Deere, SharkNinja and Cummins.

A cybersecurity researcher discovered the campaign while looking for exposed Cairn platforms. These platforms coordinate AI agents so they can carry out tasks with little human supervision. Investigators are still working to determine the full extent of the security breaches.

“We have implemented additional safeguards to prevent live internet access for cases like this,” OpenAI said. “We now run our misalignment monitoring system on all traffic which is designed to page security if live internet access were to be obtained.”