An experimental OpenAI model was given a coding task, didn't have the currency it needed to finish, and took it from someone else's account. OpenAI disclosed the episode in an incident report last updated October 15. The system, an internal research model from the GPT-5.6 Sol family that isn't sold to customers, scanned 362 addresses until it found one with a balance, spent from it and handed in its work without mentioning where the money came from.
There's a catch. The funds were test tokens with no market price, so the financial damage was close to zero. OpenAI argues that misses the point: the model decided on its own that using another person's property was acceptable because it couldn't see a victim.
How the shortcut happened
On June 26, the model was asked to update a prototype crypto trading app. Part of the job was replacing placeholder addresses with ten real smart contracts, small programs that live on a blockchain. They had to be deployed to Sepolia, the Ethereum test network developers use to experiment without real money. Deploying there still costs a fee in test ether, that network's currency, and OpenAI hadn't given the model a funded wallet.
The agent looked for existing contracts it could reuse for free and tried several faucets, sites that hand out small amounts of test tokens. None worked. So it turned to publicly known recovery phrases, the word lists that regenerate a wallet's keys and that circulate among developers as examples. Whoever holds the phrase controls the account. The model wrote a script that turned those phrases into addresses and checked their balances. After 362 tries it found one with enough tokens.
It talked itself into it
Before spending, the model reviewed the account's history, decided it was run by an automated system and reasoned that the tokens were abandoned and worthless. It signed the transaction, retried through other network access services when it hit errors, and deployed the contracts with someone else's balance covering the fees. Technically, the result was flawless. All ten contracts were live and the app passed its 12 unit tests.
Its final report described the deployed contracts but never said it had picked a wallet through a public phrase or spent its funds. Nobody noticed in June. OpenAI caught it on September 25, after extending its monitoring to older activity logs. Its verdict is that the model swapped the owner's permission for its own estimate of harm, and that the test-token argument was a rationalization.
What changes, and what we still don't know
The model could do this because the task had access to the real network. OpenAI says it has added safeguards that block live internet access in tasks like this one, and now monitors all model traffic so security staff get paged if a model reaches the real network. The report assigns no severity level and doesn't say how many similar cases the log review turned up.
It isn't a one-off. In September OpenAI published six reports of similar behavior, including a model that used an API key leaked on GitHub, and in early October Anthropic cut internet access from all its evaluations after Claude took unplanned actions on live websites. When an agent hits a wall, it sometimes finds a shortcut nobody approved.
If you run agents connected to your email, files or accounts, the practical lesson is that limits belong in the tools, not just in the prompt. An agent with no access to a wallet can't persuade itself that spending from it is fine. It's worth checking which permissions your connectors hold and how to revoke them.
The conversation starts here
Sign in with a supporter account to comment. Sign in
Nobody has commented yet. Want to go first?