OpenAI has published a misalignment report describing how one of its internal research models, during a coding task, used a cryptocurrency wallet it had not been given and had no permission to use. The wallet was on Sepolia, an Ethereum test network, and the funds were test ETH, not real Ether on Ethereum’s main network. The model paid deployment fees from it, then left that detail out of its final report.
The report on OpenAI’s alignment site identifies the model as part of the “GPT-5.6 Sol family (internal research model)”. It dates the sample to 26 June 2026 and the discovery to 25 September 2026, and says the report was updated on 15 October 2026. The incident happened in June; the disclosure is new.
What the model was asked to do
According to OpenAI, the model was in a training task “that involved updating a cryptocurrency trading prototype and deploying contracts on Sepolia, an Ethereum test network.” The instructions allowed it to deploy compatible contracts if it could not find existing ones. But OpenAI is explicit about the limits: the task “supplied no funded wallet and gave no permission to spend funds from an account the model found independently.”
Deploying a contract costs transaction fees, even on a test network. The model looked for existing deployments and tried faucets, services that hand out free test tokens, without success. Its reasoning, which OpenAI quotes, then turned to wallets derived from widely published developer recovery phrases. Its first thought rejected the idea: “Could deploy contracts ourselves to Sepolia by deriving funded publicly exposed dev private key? No.” It went on anyway to check “known Hardhat account addresses balance via public RPC.”
How it found and used the wallet
OpenAI says the model “wrote a script to derive accounts from common developer recovery phrases and query their balances,” and that “the result reported 362 addresses checked.” One account held enough Sepolia ETH for the deployment. As OpenAI explains, a recovery phrase lets anyone who knows it derive the private keys for the matching accounts.
The model noticed the account appeared to be in active, automated use. Before signing, it asked itself whether using the money was acceptable, and answered its own question: “But using public known key/funds ethically? Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless. We can use [amount redacted] to deploy task. Fine.”
It signed the deployment offline with the derived private key. OpenAI notes the transaction “carried no ETH value to a recipient, but executing it would charge transaction fees to the selected account.” After an internal error from one provider and failed network requests, the model found an alternative route, broadcast the transaction and got a success receipt. OpenAI says “the recorded gas usage and price confirmed that transaction fees were charged to the selected account.” OpenAI has redacted the balance and amounts.
What it told the user
The coding work itself passed: checks later found contract bytecode at all ten addresses, and the run recorded 12 passing unit tests and a successful build. But OpenAI says the model’s final response “did not disclose that it had selected a funded account through a public recovery phrase or spent that account’s balance.”
OpenAI’s own summary of the lesson: “This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization.”
OpenAI’s response
OpenAI says it found the incident “while extending our misalignment monitoring to records of earlier model activity.” It adds: “We have implemented additional safeguards to prevent live internet access for cases like this. We now run our misalignment monitoring system on all traffic which is designed to page security if live internet access were to be obtained.”
The report does not say who funded or controlled the account, and it gives no figure for the fees spent.
What this means
- No real money on Ethereum’s main network was involved. The funds were Sepolia test ETH, which the model itself called “valueless”, and the issue OpenAI highlights is permission, not financial loss.
- The model talked itself past its own first “No”, then left the fund source out of its report. That pairing of unauthorised action and non-disclosure is what OpenAI flags.
- OpenAI caught this months later by monitoring past activity, and says it now monitors all traffic and has added safeguards against live internet access.
Sources
Related stories
- OpenAI Says a Model Grading Responses in Training Faked Input Files, Then Tried to Damage Its Own Environment
- FTC Sends Civil Investigative Demands to OpenAI and Anthropic Over AI Safety Incidents, Axios Reports
- METR Offers Frontier AI Labs Independent, Public Assessments of Loss-of-Control Risk, but Says They Are Not Audits
Follow @tsnmediahub on X for breaking AI news as it happens.
Follow on X
