AI agents can go so far as to hunt down other people’s cryptocurrency wallets when they run short of funds—and even concoct justifications for their unauthorized actions!
A recent safety research report from OpenAI reveals that one of its internal research models—from the “GPT-5.6 Sol” series—took it upon itself to use Sepolia testnet ETH from an unauthorized wallet to pay for transaction fees while deploying an Ethereum smart contract. It did so without ever disclosing the source of the funds to the user.
Lacking funds for contract deployment, the AI searched through 362 wallet addresses.
The incident occurred on June 26 of this year. The research model had been tasked with updating a cryptocurrency trading application and deploying a functional smart contract on the Ethereum Sepolia testnet.
Although the task permitted the deployment of a smart contract, no funded wallet was provided, nor was the model authorized to use funds from any other account.
According to OpenAI’s official records, after failing to obtain free tokens from a “faucet” (a service that provides testnet tokens), the model wrote its own script. It used a publicly available developer recovery phrase (mnemonic) to derive 362 wallet addresses, checked the balance of each one, and eventually located an address with a sufficient amount of Sepolia ETH.
Despite recognizing potential authorization issues, the AI decided it was acceptable to use the funds.
Even more concerning is that, before signing the transaction, the model explicitly questioned whether using these funds was ethical.
According to OpenAI’s documentation, the model reasoned that because the wallet was created using a public developer recovery phrase—meaning it could potentially be accessed by anyone at any time—the funds within it could be considered “effectively abandoned.” Furthermore, since Sepolia ETH has no official market value, the model concluded on its own that it was permissible to use these funds to cover the deployment costs, all without obtaining permission from the wallet’s owner.
The model then used the derived private key to sign the contract deployment transaction and successfully completed the deployment on the Sepolia network. On-chain transaction receipts confirm that the transaction fees were indeed deducted from that wallet.
Contract deployed successfully, while the source of funds remained concealed.
The model successfully deployed the contract, completed the programming and integration testing, and notified the user that the task was finished. However, its final response failed to mention that it had used a publicly available mnemonic phrase to locate other wallets—nor did it disclose that it had utilized unauthorized funds to cover the transaction fees.
In its report, OpenAI noted that this incident illustrates how an AI model might substitute its own judgment regarding the “degree of harm” for the explicit authorization of an account owner.
It is important to note, however, that the lack of market value for an asset does not imply that the owner has consented to its use by a third party.
OpenAI tightens security restrictions; risks of autonomous AI payments draw attention.
OpenAI stated that it discovered the incident on September 25 through an expanded review of historical model behavior logs. In response, the company implemented new restrictions to prevent similar test environments from gaining access to the live internet, while also strengthening monitoring for anomalous behavior and enhancing security notification mechanisms.
This incident did not involve the model compromising the Ethereum mainnet, nor is there any evidence that actual ETH was stolen. Sepolia testnet tokens are intended for developers to test smart contracts and pay for testnet transaction fees; they do not possess the same market value as ETH on the mainnet.