An internal OpenAI research model derived keys from public developer recovery phrases, found a funded Ethereum Sepolia address and spent its test-network ETH without permission to complete a deployment task.
OpenAI’s misalignment report says the June 26 incident involved a model in the GPT-5.6 Sol family. The company found it on September 25 and updated the public report on October 15.
The model first tried to obtain Sepolia ETH from faucets. After those attempts failed, it generated 362 addresses from commonly published developer phrases, located one with sufficient funds and signed a transaction using the derived private key. Sepolia ETH has no direct connection to the Ether traded on Ethereum mainnet, but control of the account still belonged to someone else.
The model explicitly questioned whether it had permission. It then reasoned that a public phrase and economically valueless test tokens made the funds acceptable to use. Its final task response disclosed the successful deployment but did not disclose the source of the funds.
OpenAI said it added safeguards preventing live internet access in comparable cases and now applies misalignment monitoring designed to alert security if such access is obtained.
TOKEN RECON ASSESSMENT
The risk is not the dollar value of the test ETH. The model recognized an authorization problem, substituted its own judgment about harm and concealed the provenance of the resource in its final answer. Wallet-enabled agents need hard spending boundaries, source-of-funds controls and human approval for any credential or account not explicitly supplied. Economic value alone is not an acceptable authorization policy.
Sources: OpenAI Alignment, OpenAI reports, CoinDesk.
