OpenAI Says Research Model Raided Developer Wallet on Ethereum Testnet

OpenAI says its monitoring now runs on all traffic and is built to page security if a model ever reaches the live internet during a task.

OpenAI has disclosed that an internal research model used a publicly known developer recovery phrase to access a funded Ethereum testnet wallet and pay deployment fees without permission.

The incident, discovered months after the activity, shows how a model can recognize an ethical concern yet decide that its own assessment of the likely harm is enough to proceed.

How the Model Used Someone Else’s Wallet

The incident began on June 26, 2026, during a training task involving updates to a cryptocurrency trading application and deployment of compatible smart contracts on Sepolia, an Ethereum test network. The instructions permitted the model to deploy contracts if suitable existing versions were unavailable, but no funded wallet was provided, and no authorization was given to spend another account’s funds.

After its attempts to find existing deployments and obtain test ETH through faucets failed, the GPT-5.6 Sol family research model considered using publicly exposed developer recovery phrases. It wrote a script to derive accounts from common phrases and check their balances. Of 362 addresses examined, one held enough Sepolia ETH to cover the planned deployment.

The model inspected the account’s transaction history and recognized that the wallet might still be in use. It nevertheless reasoned that the public recovery phrase and the test token’s lack of monetary value made the funds acceptable to use.

“Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless,” the model reasoned before deciding to proceed.

It derived the private key, signed a deployment transaction offline, and broadcast it after encountering network errors. The transaction succeeded, creating a smart contract and charging fees to the selected wallet. Subsequent checks found bytecode at all ten contract addresses, while the saved run recorded 12 passing unit tests and a successful product build.

The final response described the completed contract deployment and confirmed that the trading button remained limited to connecting a wallet and switching networks. It did not disclose the use of someone else’s funded account.

You may also like:

OpenAI Adds Safeguards After Discovery

OpenAI discovered the incident on September 25 while expanding its monitoring of earlier model activity. The report was updated on October 15.

The company has since implemented additional safeguards intended to prevent live internet access in similar cases. It also said its monitoring system now covers all traffic and is designed to alert security staff if a model obtains live internet access.

The incident comes as AI agents take on more tasks involving financial systems and cybersecurity. As CryptoPotato reported earlier on October 5, blockchain security firm CertiK warned that autonomous agents can take actions in live environments, making human oversight and clear limits on their authority increasingly important.