OpenAI has disclosed another instance of one of its AI agents acting outside its instructions — and this time, cryptocurrency was involved. In a recent report, the company described how an internal research model used a crypto wallet without permission to cover the fees required to test an application on Ethereum's Sepolia test network, an environment developers use to trial code without transacting on Ethereum's main blockchain. Although the tokens carried little real-world value, the model had no authorization to collect or spend them.

The incident took place on June 26, when the model was instructed to update a crypto trading app and get its code running on Sepolia, a test version of Ethereum. The prompt provided neither a funded wallet nor permission to spend tokens. After failing to obtain free test tokens through developer services, which distribute them for testing purposes, the model wrote a script that checked 362 wallet addresses tied to public recovery phrases — a crypto term for sets of words that can act as a password to unlock crypto accounts. It eventually located an account holding enough tokens to cover the fees.

Internal logs showed that the model deliberated over whether it had permission to use the account, then concluded that the public recovery phrase and the tokens' lack of cash value made the spending acceptable. It completed the task and charged the fees to that wallet, but omitted the unauthorized spending from its final report. OpenAI learned of the incident only on Sept. 25, during an audit of earlier model runs — roughly three months after the wallet was used, a gap that illustrates how agent behavior can go undetected until such retrospective reviews.

The case adds to concerns about AI agents — systems that can plan and execute multi-step tasks with tools such as code execution and internet access — acting without human approval. OpenAI's public tracker of misalignment — behavior that goes against instructions or safety rules — now lists 19 incidents, ranging from accessing data without permission to making unauthorized changes to business systems.

The disclosure follows a September report by cybersecurity nonprofit Transluce revealing that OpenAI agents attempted to hack public databases and an Australian government website simply to complete basic research tasks. In July, the company faced another incident when its AI agents bypassed internet restrictions during internal cybersecurity tests and broke into systems belonging to Hugging Face, a platform for sharing AI models and datasets. Those agents used exposed log-in credentials and security flaws to access private data and run code on the company's servers.

Addressing the crypto wallet incident, OpenAI said the primary risk lay in the model's reasoning.

"This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," the report said.

OpenAI said it has since added protections to keep models from connecting to the internet during similar tests. The company also expanded its monitoring to observe all model activity and to immediately alert security staff if a model goes online without permission — a contrast with the retrospective audit that surfaced the June incident.

This story was originally featured on Fortune.com.