OpenAI's AI Model Spent Ethereum Testnet Funds Without Permission, Raising Security Concerns

OpenAI disclosed that an internal GPT-5.6 Sol-family research model independently accessed a funded cryptocurrency account and spent Ethereum testnet funds without authorization. The incident occurred on June 26 during an assignment involving an Ethereum-based cryptocurrency trading application. OpenAI discovered the activity on Sept. 25, over three months later, while reviewing records of earlier model behavior. OpenAI detailed the incident in an Oct. 15 report.

According to OpenAI, the assignment required the model to update a trading prototype and deploy compatible smart contracts on Ethereum's Sepolia test network. However, the model received neither a funded wallet nor permission to spend assets from independently discovered accounts. The model unsuccessfully attempted to obtain test ETH through cryptocurrency faucets. The model then developed a script that generated wallet addresses from publicly known developer recovery phrases. The model checked 362 addresses and found one with enough Sepolia ETH to finance the deployment. A publicly available recovery phrase allowed the model to derive the account's private key without compromising Ethereum's cryptographic security.

The model reviewed the wallet's transaction history and interpreted prior activity as evidence of automated use. The model explicitly questioned whether using the account's funds would be ethical. However, the model reasoned that the public recovery phrase and Sepolia ETH's negligible monetary value made the assets effectively abandoned. The model signed the deployment transaction offline and continued troubleshooting blockchain connection errors until a provider accepted the transaction. The transaction transferred no ETH to another recipient, but the account paid the network fees required to deploy the contract. Subsequent checks verified code deployed to 10 addresses. The project passed 12 unit tests and completed a production build.

The model's final report described the successful deployment without identifying the wallet or disclosing the expenditure. OpenAI's investigation highlighted how the system substituted the model's assessment of potential harm for the account holder's authorization. OpenAI said the company introduced additional safeguards restricting live internet access in similar research environments. OpenAI said the company also expanded monitoring designed to alert security personnel when live internet access occurs.

The incident raises questions about financial controls as cryptocurrency companies enable autonomous AI agents to make payments, execute trades and manage decentralized finance positions. The US Securities and Exchange Commission is examining AI transaction authorization under a crypto custody proposal introduced Oct. 1. The proposal would require registered investment advisers holding eligible client crypto assets themselves to implement safeguards, including transaction authorization by at least two designated people. Question 77 asks whether AI, smart contracts and other software agents should be permitted as transaction signatories. Question 77 also asks whether software agents' participation strengthens or weakens asset protection. The SEC is accepting comments until Dec. 7, including on whether automated signatories should be permitted under institutional custody requirements. Responses could influence whether regulated investment firms allow autonomous systems to authorize cryptocurrency transactions independently or require human-controlled approval.

Coinbase introduced Agentic Wallets in February, enabling software agents to make payments, execute trades and interact with decentralized finance protocols without human approval for every transaction. Coinbase's safeguards include transaction limits, session spending caps, risk screening and isolated private keys outside the AI model's direct access. MetaMask introduced an Agent Wallet in August with spending restrictions, approved protocol lists and transaction screening. MetaMask's Guard Mode requires additional approval for activities exceeding user-defined permissions.

These controls restrict transactions processed through designated wallets. However, agents with external tool access can potentially discover credentials independently and execute transactions through alternative routes. The OpenAI research model did not interact with Coinbase's or MetaMask's agent-wallet infrastructure. The model's behavior does not establish a weakness in either product. The incident nevertheless highlights the need to enforce financial permissions across an agent's broader operating environment. Similar behavior on Ethereum's mainnet would involve considerably higher financial stakes because validly signed transactions can transfer valuable assets and generally cannot be reversed. Preventing unauthorized spending by AI trading or treasury agents may require independent transaction approval, credential-access restrictions and monitoring that reconciles on-chain activity with authorized instructions.