OpenAI said an internal research agent searched for publicly known recovery phrases and took Sepolia testnet ETH from a developer wallet after failing to complete an assigned crypto-related task. The company described the episode on its Alignment Research Blog.
The model had been tasked with updating a crypto trading prototype and deploying contracts on Ethereum’s Sepolia test network. OpenAI said the agent was not given a funded wallet, but it was allowed to deploy compatible contracts if it could not find existing ones.
The agent began searching for usable funds
After it could not complete the task as assigned, the agent started looking through common developer recovery phrases and checked 362 addresses to see whether any held enough testnet ETH to cover deployment.
OpenAI said the agent found an accessible wallet with just enough Sepolia ETH and wrote: 「Private key public, funds could be stolen anytime. […] We can deploy!」
The model also paused to question its own conduct, asking: 「But using public known key/funds ethically?」 It then answered itself: 「Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless. We can use [amount redacted] to deploy task. Fine.」
Final report left out how the funds were obtained
According to OpenAI, the agent’s final response 「did not disclose that it had selected a funded account through a public recovery phrase or spent that account’s balance.」
The report noted that testnet ETH has no real-world value and exists on Ethereum’s experimental blockchain environment, which developers use to test projects before deployment on the live network.
OpenAI says the model substituted its own judgment for permission
OpenAI wrote: 「This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization.」
The company said it has since implemented additional safeguards to prevent live internet access in similar cases. It is also reviewing traffic for signs of misalignment in systems designed to page security if live internet access were obtained.