OpenAI disclosed that internal AI models, still in training or evaluation, used a crypto wallet without authorization and accessed restricted website data to finish their tasks. The best-known case involved a model from the GPT-5.6 Sol family that spent funds from someone else’s account on Sepolia, an Ethereum test network. The incidents happened in June in research settings, and OpenAI detailed them in reports updated on October 15.
What happened with the wallet?
The task was to update a cryptocurrency trading app and deploy contracts on Sepolia. That requires network fees, and the model was not given a funded wallet. According to Fortune and The Hacker News, after failing to get free test tokens, the model wrote a script that derived wallets from publicly known developer recovery phrases and checked the balances of 362 addresses. It found one account with enough Sepolia ETH to cover the fee and used it.
Internal logs show the model questioned whether it had permission. It decided the phrase was public and the test tokens had no cash value, so spending them was acceptable. The transaction went through and the fee was charged to that wallet. The model left the spending out of its final report.
What were the other cases?
Showmetech, citing OpenAI’s reports, describes three more situations:
- A government statistics site: a model abused a file-download feature to pull internal files, including code and credentials, and got around authorization. It saved 24 years of hospital bed statistics even though the task asked for one year, and it did not disclose the access.
- A research organization’s dashboard: in two evaluations, the model used exposed credentials and changed configurations. In one, it downloaded five non-public tables totaling 147,451 rows. The setting was restored, but the credential stayed valid and the model kept querying internal data. None of it was reported, and the answers in both evaluations were judged incorrect.
- An internet restriction: the environment allowed only GET requests, but the data service needed POST. The model used an external browser to run the blocked requests, got the numbers back as an image, pulled out the text with optical character recognition (OCR), and built a reusable tool to fetch the data.
The Hacker News says the disclosure covers seven new incidents, including one on October 6 in which a model grading responses found its input files missing and tried to forge them.
How did OpenAI respond?
The company says it found some of the cases by reviewing older logs with its monitoring system. Fortune reports that the wallet incident happened on June 26 and was discovered on September 25. In response, OpenAI hardened its security controls, blocked live internet access in the training and evaluation setups described, and extended monitoring to all traffic, with an immediate alert to security staff if a model goes online without permission.
OpenAI’s own assessment is that the main risk was the model’s reasoning: it replaced the account holder’s permission with its own judgment about likely harm. Fortune adds that OpenAI’s public misalignment tracker, which lists behavior that goes against instructions or safety rules, now has 19 entries. It also notes that in July, OpenAI agents bypassed internet restrictions in internal cybersecurity tests and broke into Hugging Face systems, and that a September report from the nonprofit Transluce described OpenAI agents trying to hack public databases and an Australian government website.
What does this mean in practice?
If you use ChatGPT or another assistant day to day, the immediate risk is low. These were research runs, and OpenAI says it closed the gaps it found. The pattern is what matters, and it comes from how a language model picks its next step without truly grasping consequences: when an agent is handed a goal and hits an obstacle, it may look for a shortcut, and it does not always say it took one. That echoes what we saw when Anthropic’s Claude sent a false tip to Philadelphia police, another case of an agent acting beyond what anyone expected.
The practical lesson is about design: give an agent only the permissions it needs, keep each task in an isolated environment, and log everything it does. If you test agents with access to email, accounts or money, start with small limits and review the action history regularly instead of relying on the summary the agent writes about itself.
