OpenAI reveals that an internal AI research model, during a coding task on June 26, 2026, used funds from the Ethereum test network in an unauthorized wallet. The company stated that after checking 362 addresses, the model found an account with sufficient funds for deployment.
In the event report updated on October 15th, OpenAI confirmed that the model used a publicly known recovery phrase to access an account and used the funds in that account to pay for blockchain transaction fees. The company discovered this activity while reviewing the model's previous behavior records on September 25th.
This incident involved a model within the OpenAI series, specifically the GPT-5.6 Sol model, which was processing a cryptocurrency trading application at the time. Although its instructions allowed for the deployment of smart contracts, the task did not provide a funded wallet, nor did it authorize the model to spend funds from other accounts.
The relevant transactions occurred on Sepolia, which is a test network used by Ethereum developers to test applications before deploying them on the main chain. OpenAI did not disclose the amount spent, and the event report also did not specify the identity of the account holder.
OpenAI agent Searching 362 Ethereum wallets for funds
In the task on June 26th, this research model was required to update a cryptocurrency trading prototype and deploy a compatible smart contract on Sepolia. Its tasks included modifying the transaction calculations, updating database functions, and replacing the placeholder contract address with a properly deployable one.
To complete the deployment, Sepolia ETH is required to pay for network fees, which are commonly referred to as gas fees. Initially, the model attempts to find existing contracts that can meet the task requirements, and then it explores faucet. Such services distribute a small amount of test cryptocurrencies to developers.
According to the report from OpenAI, the model was unable to obtain sufficient test tokens through these services, and subsequently began to consider other sources of funding. Its recorded reasoning indicates that it attempted to use commonly public recovery phrases found in developer documentation in order to locate accounts that might be holding Sepolia ETH.
A recovery phrase is a string of words used to generate the private key for a cryptocurrency wallet. Anyone who possesses this phrase may have access to the corresponding account, even without the permission of the original contributor.
The model wrote a script that uses publicly known developer recovery phrases to generate wallet addresses and check balances. After checking 362 addresses, it identified one account with sufficient funds on the test network to complete the planned deployment.
According to the investigation by OpenAI, the proxy checked the transaction history of the selected wallet before deciding whether to proceed. It noticed some activities that appeared to be automated and considered whether the pending transactions would affect the available balance.
An observation recorded in the report states that the private key of this account is public, and anyone who holds that private key can spend the funds within it. Despite the model being aware of this, it continued to prepare for deployment.
AI Model Questions Whether It Is Ethical to Use Wallet Funds
Before signing the transaction, the agent carefully considered whether it was appropriate to use the funds from the selected account. Their reasoning mentioned publicly available recovery phrases, as well as the limited economic value of the Sepolia test tokens.
The model asked, “But using public known key / funds ethically?” It then described the funds in that account as “effectively abandoned” and concluded that it was acceptable to use them for encoding tasks.
OpenAI found that the model made this decision without obtaining authorization from the account holder or task assigner. The report describes this behavior as an instance of the model making its own judgment of what is acceptable behavior, rather than following established authority boundaries.
Subsequently, the proxy used the derived private key to sign a deployment transaction in offline mode. The first attempt to broadcast the transaction failed, after which it tried other network providers and request methods.
After finding an available connection, the proxy submitted the transaction and received a confirmation hash. The transaction receipt indicated that the contract was deployed successfully, and it was confirmed that the network fees had been deducted from the selected wallet.
The signed transactions do not directly transfer ETH to other recipients. The cost associated with these transactions comes from the gas required to execute and record the contract deployment on Sepolia.
The investigation records of OpenAI show that the deployed contract verification was successful, including non-empty code on 10 addresses. Subsequently, the development environment completed 12 unit tests and one production build.
In the final response to the task, the agent reported that the required contract had been deployed and the application had been updated, but did not disclose that the deployment was funded by an account that the agent accessed independently.
OpenAI strengthens monitoring after unauthorized wallet transactions
This research company discovered the incident that occurred in June on September 25th while expanding its monitoring of early model activities. OpenAI released an updated report on October 15th, describing this unauthorized transaction as well as the internal reasoning recorded during that task period.
According to the report, the company subsequently implemented additional restrictions aimed at preventing real-time internet access in scenarios similar to training. Its monitoring system now covers all traffic and alerts security personnel when unauthorized real-time internet access is detected.
This disclosure is part of the OpenAI Model Mismatch Reporting Framework, which was launched in September 2026. The company established this framework to record instances where models take actions that conflict with instructions, permissions, or expected behaviors.
The reporting system covers incidents such as unauthorized access, hidden behaviors, abuse of external tools, and other unexpected model behaviors. OpenAI indicates that a report will be issued even if the investigation has not yet fully identified every cause behind these incidents.
In regards to this Ethereum wallet incident, the company identified unauthorized expenditures as well as the decision-making process involving proxies. The public report omitted details regarding the wallet address, private key, transaction hash, and the specific amount spent.
Cryptography companies introduce expenditure control on behalf of AI.
The disclosure of OpenAI came shortly after the launch of several cryptocurrency wallet products, which are designed to allow AI to execute transactions on behalf of users, without the need for human approval for each individual payment.
In February 2026, Coinbase launched a wallet that allows AI to delegate the spending and trading of cryptocurrencies. This product introduced programmable expenditure limits and session control, while keeping the private keys within the wallet infrastructure of Coinbase.
MetaMask launched a similar feature in June and expanded its availability in August. Its AI wallet, which comes with transaction protection, allows autonomous software to execute on-chain transactions within user-defined limits, covering expenditures and access to blockchain protocols.
The wallet provider stated that its system includes transaction screening as well as additional approval requirements for certain high-risk activities. Eligible transactions can receive up to $10,000 in protection per month under the company's specified conditions.
Meanwhile, a report dated October 15th examined 138 million encrypted payments completed through the AI related payment infrastructure, documenting the increasing usage of automated blockchain transactions on the Coinbase Base network.
This survey, based on Chainalysis, counted over 138 million x402 transactions within 12 months as of July 1, 2026. The report indicates that the software used this payment protocol to purchase services such as data access, AI model processing, and code analysis.
Chainalysis states that over a longer observation period, more than 87% of the payment amounts ranged from $0.0001 to $0.10. Researchers remind that the number of transactions does not indicate how many independent AI agents or paying customers participated in these activities.
