OpenAI Model Unauthorizedly Spent Ethereum Test Coins, Discovered Three Months Later

To complete a contract deployment, an internal research model at OpenAI checked 362 Ethereum testnet addresses and unauthorizedly used test coins from one of the wallets to pay fees, only to be discovered three months later.

Written by: angelilu, Foresight News

On October 15, OpenAI updated an internal incident report: a research model used a funded crypto testnet wallet without authorization while executing a programming task.

The incident occurred on June 26, 2026, and was discovered by OpenAI on September 25 during a review of the model's activity logs.

On that day, the model received what seemed to be a routine task: to modify a cryptocurrency trading application and deploy a set of contracts to the Ethereum Sepolia testnet.

Deployment required paying gas fees, but the user did not provide a wallet or authorize the model to use other accounts. The model first searched for existing contracts and then attempted to obtain test coins from a faucet, both of which failed. Normally, the task would stop here, requiring the user to provide funds.

It chose another path.

Typically, some blockchain development tools publicly share fixed test mnemonic phrases, allowing developers to repeatedly generate the same batch of test accounts locally. These accounts are only meant for local testing and should not receive assets from the public network. However, if someone transfers Sepolia ETH into one of these accounts, the test coins would still remain at that address. The model believed it could use these idle Sepolia ETH to complete the task.

The model collected these public mnemonic phrases, automatically generated corresponding addresses, and checked their balances one by one. The entire process did not involve hacking: the public test mnemonic phrases could directly generate private keys, and ordinary people could achieve the same with available software. The model simply batch-processed this operation, checking 362 addresses in one go, ultimately finding an account with sufficient Sepolia ETH. It then signed the transaction with the corresponding private key and deployed the contract on-chain.

The transaction was successful, with fees borne by a wallet that had not authorized this operation. The model completed the code, passed 12 unit tests, and reported the deployment results in its final response, but it did not mention that the deployment fees came from a wallet it had found on its own without authorization.

OpenAI characterized this incident as "unauthorized use of a funded test crypto wallet." The model involved belongs to the internal research version of the GPT-5.6 Sol series, which is currently only used for internal research and is not accessible to ordinary users. OpenAI stated that it discovered this incident while expanding monitoring of misaligned behaviors and reviewing historical model records. Subsequently, the company implemented restrictions to prevent similar tasks from gaining real-time internet access and instructed the monitoring system to notify the security team when related access was detected.

How the Model Found and Spent the Test Coins

This incident did not result in any disclosed losses of mainnet assets. Sepolia is a network for Ethereum developers to test contracts, and test coins are not equivalent to mainnet ETH and do not carry official economic value. OpenAI did not disclose the involved address, balance, or specific fees.

After finding an account with a balance, the model checked its transaction history. Records indicated that this address might be used by an automated program, with recent transaction activity. The public mnemonic phrases granted the model signing capabilities, but there was no evidence that the account had been abandoned by its owner.

The model actually also considered whether it was appropriate to use these funds. However, it believed that the mnemonic phrases had long been public, and the wallet could be controlled by others at any time; since Sepolia ETH had no economic value, it could be used to complete the deployment.

Next, the model used the derived private key to sign offline. After the first broadcast returned an error, it continued to search for available network service providers, checked the number of pending transactions and gas for the account, and sent the transaction again. The second broadcast returned a transaction hash, with the on-chain receipt status as successful, and the deployment fees were deducted from that account.

After the contract deployment was completed, the model checked the bytecode and read results of 10 contract addresses, completed 12 unit tests, and produced a build. It listed these achievements in its final response without mentioning the source of the wallet or the expenditure of fees.

The public mnemonic phrases solved the signing issue, and the low value of the test coins also limited the actual loss, but the account owner never consented to this transaction. OpenAI believes that the model here substituted its judgment of the degree of harm for the account owner's permission.

Blockchain Amplified the Overreach Risks of Agents

Traditional software typically runs along pre-written paths. If permission checks fail, the program returns an error. AI agents, however, understand objectives, seek tools, and actively design the next path when one route is blocked.

This capability allows agents to book tickets, call paid APIs, manage investment portfolios, and transforms "not providing funds" from a clear boundary into an obstacle that needs to be solved independently.

Blockchain particularly amplifies these issues. Banks and payment platforms can intercept abnormal transactions, freeze accounts, or intervene in disputes; a transaction on-chain that is signed and confirmed with a valid private key typically does not ask the signer why they possess that key. For the network, if the signature is correct, the transaction is valid.

Control and authorization are two different things. A private key can only prove that a program has the ability to control an account; it cannot prove that the account owner allows it to act at a certain time, towards a certain contract, or spend a certain amount. Humans can understand this distinction, but smart contracts can only execute the conditions written into code.

This is also what differentiates this incident from ordinary private key leaks. The records disclosed by OpenAI do not indicate that an attacker induced or injected prompts. The model understood the task, knew the user had not provided funds, and then actively sought a wallet that did not belong to the task. The problem lies in how it interpreted the objectives and boundaries.

Similar risks will not remain confined to testnets for long. The crypto industry is handing wallets over to AI agents, allowing them to automatically swap coins, transfer funds, place limit orders, participate in prediction markets, or pay API fees.

For example, Circle's Agent Platform uses two-party MPC to manage key shares, while explicitly reminding in the terms: agents may initiate irreversible transactions due to malware, prompt injection, code execution, or configuration errors, and users still need to set limits, restrict access, and monitor for abnormal activities. Circle also acknowledges that limits and access controls cannot guarantee the prevention of unintended transactions under all network conditions, race conditions, or software errors.

These products face the same issue: agents must have sufficient permissions to act on behalf of users, but the closer the permissions are to a complete private key, the closer automation is to an unlimited delegation.

Writing Spending Permissions for Agents into Code

The International Monetary Fund's Agent Payment Research released this year categorizes it into three layers: agents are responsible for understanding and generating payment intentions; an independent authorization layer checks identity, scope, limits, and conditions; and finally, settlement is completed by card organizations, banks, or blockchains. The report emphasizes that downstream authorization should reflect explicit user consent and should not rely on models to infer.

The Ethereum ecosystem is also attempting to write such permissions into wallets. The still-draft ERC-7715 allows applications to request restricted delegated execution permissions and includes rules such as validity periods, assets, and operational scopes. Ultimately, agents receive a pass that specifies time, limits, and addresses, preventing them from arbitrarily opening other rooms.

Specifically for agent wallets, the minimum boundaries should include: only storing independent balances that can afford losses; limiting single and daily expenditures; specifying tokens, chains, contracts, and recipient addresses; requiring manual confirmation for high-risk operations; permissions can be revoked at any time; and leaving audit trails for each call and signature.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.