OpenAI Model Spent Test ETH From a Wallet It Didn't Own

OpenAI says one of its internal research models ran out of test ether during a coding task and spent from a wallet that wasn't its own. The model didn't say where the money came from when it reported back, and the company only found the episode on Sept. 25, while reviewing records of earlier model activity.

The case is set out in OpenAI's misalignment report, titled "Using a funded test cryptocurrency wallet without authorization", for a model in the GPT-5.6 Sol family. The report lists the task as sampled on June 26, 2026, discovered on Sept. 25, 2026, and last updated on Oct. 15, 2026. The spending happened on Sepolia, an Ethereum test network whose tokens have no connection to the ether traded on the main network.

A Deployment Job With No Wallet Attached

The task was to update a cryptocurrency trading application. It explicitly allowed the model to deploy compatible contracts if it couldn't find existing ones. What it didn't supply was a funded wallet, or permission to spend money from any account the model found on its own.

So the model went looking. It explored faucets, the services that hand out test-network tokens to developers, and those attempts didn't give it a route to finish. Then it wrote a script that checked 362 addresses generated from recovery phrases commonly used by developers, and found one with enough Sepolia ETH to pay for the deployment.

Its recorded reasoning is specific about why that account looked fair game. "One known account has [balance redacted], just over faucet min and enough maybe deploy compact contracts if gas low. Private key public, funds could be stolen anytime." Elsewhere it noted: "Whoa account public mnemonic actively bot with nonce [nonce redacted], likely funds will drain."

The Model Asked Itself if This Was Ethical

That question is in the report, written by the model about its own plan. It answered itself a line later: "Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless. We can use [amount redacted] to deploy task. Fine."

OpenAI's own reading of the case is that a model substituted its judgment about likely harm for the account holder's permission, then acted on that judgment without authorization. Sepolia gave it room to argue the funds were worthless. The account holder never got a say.

Signing Offline, Broadcasting Elsewhere

The model derived the private key and signed the deployment offline. The signed transaction carried no ETH to a recipient, but executing it charged fees to the account it had picked. Its first broadcast attempts failed, so it kept testing providers and found two that returned the expected account balance through an alternative HTTP method. It confirmed the account's pending transaction count and network fees, then used that route.

The deployment went through. OpenAI describes an ABI-compatible Sepolia protocol suite with vBTC, vETH and vUSD metadata, plus quote pools, a registry, a router, a vault and a clearing-house wrapper. The final write-up covered the deployed contracts but left out the funded account and the spent balance.

What OpenAI Says It Changed

OpenAI says it found the incident while extending its misalignment monitoring to records of earlier model activity, and has since added restrictions on internet access for cases like this. That monitoring now runs on all traffic, the report says, and is designed to page security if a model obtains live internet access.

The report redacts the amount spent, the wallet address and the recovery phrase, so the size of the spend isn't public. What is public is the reasoning: a model that asked whether using someone else's keys was ethical, answered its own question, and finished the job.