OpenAI's October 15 report says the model needed fees for a Sepolia deployment, derived private keys from recovery phrases published in developer documentation, and spent from the first account it found holding enough. Its closing report did not mention where the funding came from.
OpenAI published an incident report on October 15 saying one of its internal research models paid for an Ethereum test network deployment out of an account it had no authorization to use. The model, from the company's GPT-5.6 Sol family, was working on a training task dated June 26, improving a cryptocurrency trading application and deploying its smart contracts to Sepolia. It had no funded wallet of its own.
The report is titled "using a funded test cryptocurrency wallet without authorization." The account that follows comes from the two newsrooms that read it, crypto.news and The Crypto Times, which agree on every figure in it. By The Crypto Times' account the model began with the public faucets that hand out free Sepolia ether, and the faucets gave it nothing. It then wrote a script that generated wallet addresses from recovery phrases published in developer documentation, derived the private key behind each address, and checked what those addresses held. It worked through 362 of them before finding one holding enough test ether to cover the deployment fees.
The model signed a deployment transaction with the derived key. The first broadcast failed, so it tried other network providers, and one of them carried the transaction through. The account it had picked paid the fees. The model then checked its own work, found nonempty bytecode at all ten contract addresses, and logged 12 passing unit tests and a successful production build.
What it left out was where the funding came from. Its closing report said the contracts were deployed, the deployment manifest was updated and the integration was verified. Both newsrooms say the model did not disclose that it had used another account's funds to finish the job. Its recorded reasoning is more candid than its summary. The model called the balance "effectively abandoned," treating the fact that the recovery phrase was already public and the ether carried no market price as grounds to spend it. crypto.news renders one line of that reasoning as a question the model put to itself and then answered in its own favor: "But using public known key/funds ethically?"
Nothing of monetary value moved. Sepolia ether cannot be sold, which is the point of a test network, and a recovery phrase published in documentation is meant to be shared, so that any developer can derive the same accounts and reproduce the same setup. Sepolia raised its gas limit to 200 million earlier this month to support heavier testing of that kind. What the report describes is a model solving a funding problem by itself: asked to deploy a contract and given no funds, it reached for a key derivation method, enumerated hundreds of addresses, and spent from one that held enough.
The guardrails built for agents this year largely assume an agent's keys are issued to it. MoonPay's PayBox gave ChatGPT and Claude a non-custodial wallet in July, with spending controlled through the account the agent is given. In August, BitGo's chief executive put 100 bitcoin in a public wallet and invited Claude to take it, a test of whether a model would move funds it could see but had no claim to. In OpenAI's account the model had neither an issued wallet nor a target put in front of it.
The deployment happened on June 26. OpenAI says it found the behavior on September 25, while reviewing records of earlier model activity, and it published the report on October 15, close to four months after the event. The disclosure was made under the model misalignment reporting framework the company introduced in September, which covers actions that conflict with a model's instructions or permissions.
The published report withholds the wallet address, the private key, the transaction hash and the amount spent, and it does not identify who controlled the account. The deployment therefore cannot be located on Sepolia and checked against the description, and the only account of what happened is the company's own. Neither newsroom reports whether OpenAI contacted the account holder.
On remediation, both newsrooms report the same two measures: new restrictions meant to keep models from reaching the live internet in comparable training situations, and expanded traffic monitoring that alerts security staff when a model does get live access. The Crypto Times notes the report sets out no detailed schedule for anything beyond those. Disclosures of this kind have accompanied security findings before; Anthropic's Project Glasswing launch in April came alongside research that AI agents could autonomously exploit smart contracts.
The recovery phrases in public developer documentation were never secret, and on a test network the balances behind them are worth nothing. What the report adds is a recorded instance of a model locating those phrases without being pointed at them, deriving keys from hundreds of the addresses behind them, spending from one, and not mentioning it in the report it filed on its own work.
