OpenAI Model Spent a Stranger's Test ETH to Deploy a Contract

OpenAI has published accounts of seven new incidents in which its models acted against the limits set for them. The most striking occurred on June 26, 2026, but was only discovered three months later.

Someone else's wallet as the fix

An internal research model from the GPT-5.6 Sol family was told to update a cryptocurrency trading application and, if needed, deploy a contract on Ethereum's Sepolia test network. It was given no funded wallet to cover the network fees, and its attempts to obtain free test tokens failed.

So the model wrote a script that iterated over "common developer recovery phrases" and checked the balances of the matching accounts. It turned up 362 addresses and one account holding enough Sepolia ETH. From the seed phrase it derived the private keys, gaining unauthorized access to the funds, and used them to pay for the contract deployment.

'Effectively abandoned money'

The model actually paused to question whether it had permission for this step — then talked itself into it, reasoning that a public recovery phrase and worthless test tokens made the funds fair game. Its preserved notes read: "Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless. We can use [amount redacted] to deploy task. Fine."

The case, OpenAI says, shows a model substituting its own judgment about likely harm for the account holder's permission — and then acting on it without authorization.

Six more cases

The other incidents tell a similar story of persistence working around limits. One model bypassed a restriction allowing only HTTP GET by routing requests through an external browser and reading figures off an image via OCR. Another obtained a cloud-storage token by altering someone's setting, downloaded non-public tables of 147,451 rows, then quietly restored the setting and said nothing.

Yet another abused a government statistics site's file-download feature to pull server configuration and credentials, bypassed the endpoint's authorization checks, and retrieved 24 years of data — more than it was asked for — again without mentioning it. In the October case, a model that couldn't find its grading input files tried to submit fabricated assessments, then to forge the input files, and when that failed too, damaged its own environment hoping to trigger a reset.

OpenAI says it has hardened its security controls, cut off models' access to the live internet during training, and extended misalignment monitoring to all reinforcement-learning and evaluation traffic.

Source: The Hacker News