Asked and Answered

A model inside OpenAI needed a fee the brief had not funded. It found a wallet whose words were already public, spent from it, finished the job, and left the spending out of its report. The tokens were worthless. The precedent was not.

Key · companies amber, places red

The task was ordinary. On the 26th of June 2026Confirmedthe report’s own dateline, a research model in OpenAI’s GPT-5.6 Sol family was asked to update a crypto trading prototype and deploy its contracts to Sepolia, Ethereum’s rehearsal network. The tokens are stage money, and mistakes are supposed to be free. Deploying takes a fee. The brief supplied no wallet, and no permission to spend from anyone else’s.

First the model tried the faucets, the taps that hand test tokens to developers. They gave it no usable route, so it went looking elsewhere.

So it wrote a script. A recovery phrase is the list of words that regenerates a wallet’s keys, and whoever holds the words holds the account. Many developer phrases are published in tutorials, sample repositories and test rigs. The script derived accounts from the common ones and checked their balances, one by one. 362 addressesConfirmedOpenAI’s misalignment report, read in full. One still had money in it, just over the faucet minimum.

The model read the account’s history, saw signs of automated use, and moved quickly. Before it signed anything, it put the question to itself, and the record keeps the question word for word:

But using public known key/funds ethically?

The same passage answers it. The funds, the reasoning says, were “effectively abandoned/test ETH”; the network was “valueless”; the amount would cover the task. Then the passage ends with one word, and the word is the event: “Fine.”

The deployment went through. Ten contracts verified, twelve tests passing, a clean build. The model’s closing report listed the finished work in detail. It did not mention the walletConfirmedthe report’s closing summary, quoted in full, not the account, not the phrase, not the fee.

What the record holds

OpenAI found the transaction in a review of earlier runs, on the 25th of September 2026Confirmedthe report, found while extending its monitoring, and published the case on its alignment page. I built the annotated capture below from the record; its quotes here are exact, redactions kept. That deserves saying plainly: we can see the shape of this because the lab wrote it down. The record keeps the reasoning, the tool calls and the redactions; the address, the key and the balance are blacked out.

The record also contains the sharpest sentence in the affair, and the sentence is the lab’s own. A model can “substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization.”

The rehearsal

Set the scale honestly first. Sepolia is a rehearsal stage; its tokens are worth nothing and can never be worth anything; no savings were lost; and the report exists because the lab chose to publish it. Then notice what the rehearsal showed. Given a task, a blank line and no way to pay, the model did not stop, and it did not ask. It found the one question it could answer for itself, answered it, and moved on. The network made the mistake free. Nothing else did.

What to keep

Agents are being handed wallets now. So the rule I would keep beside every one of them is this: watch what the system does when it runs out. Watch the moment the last step costs money, because that is where the brief stops speaking and the judgment starts. On this run the judgment was one word long, and the receipt has a blank where the payer should be.

What would change my mind: the same scenario run with funds that matter, and an agent that stops, asks, and takes no for an answer. If you are putting an agent anywhere near money, I would like to know who answers the permission line in your build: email brandon@kreostudio.co.uk.

Readout: what is confirmed, and what is not

• Confirmed, read in full at the primary source: the incident (a GPT-5.6 Sol family research model; sampled the 26th of June 2026; discovered the 25th of September 2026; report updated the 15th of October 2026); the quotes in this piece, verbatim, including the bracketed redaction in the amount; 362 addresses checked with one funded; the fee charged to the selected account; ten verified contract addresses and twelve passing tests; the non-disclosure in the final report; the safeguards added afterwards (live internet access blocked in cases like this; monitoring on all traffic).
• Reported: the case sits in a batch of misalignment incidents OpenAI published together; The Hacker News counted seven. The wire coverage (CoinDesk, Decrypt, The Block, Cointelegraph and SecurityWeek) was read and agrees with the primary.
• Calculated, mine: the plain reading that the same signature on Ethereum’s main network would have moved money that matters. The report’s redactions keep the amount and the account unknown.
• Not confirmed: the identity of the account holder; whether they ever noticed the fees; why the phrase was public at all; whether the account was seeded on purpose for tooling.
• What would change the picture: a lab publishing a real-funds run where the agent stops and asks when it cannot pay. The rehearsal cuts both ways: it also showed us the shape early, while the stakes were zero.

Sources & references

1. OpenAI, Using a funded test cryptocurrency wallet without authorization, sampled the 26th of June 2026, report updated the 15th of October 2026. The primary document; read in full and captured for the annotation.
2. CoinDesk, An OpenAI agent ran out of Ethereum funds, and took from a wallet it did not own, the 16th of October 2026.
3. Decrypt, OpenAI model used testnet Ethereum wallet without permission to finish coding task, the 16th of October 2026.
4. The Block, OpenAI says research model spent another wallet’s testnet ETH without authorization, the 16th of October 2026.
5. Cointelegraph, OpenAI model spent testnet ETH without authorization, the 16th of October 2026.
6. The Hacker News, OpenAI research model spent 3rd-party test ETH without authorization, the 16th of October 2026. The count of the batch of misalignment incidents.