An OpenAI research model took funds from a crypto wallet it did not own in order to complete a June coding task. The company discovered the incident in September, three months after it had occurred, and disclosed it publicly this week.

The disclosure appears in an incident report published by OpenAI.

How the model accessed an unauthorized wallet

The incident involves a model from OpenAI's GPT-5.6 Sol family. The model was asked to update a crypto trading prototype and deploy contracts to Sepolia, an Ethereum test network where developers try out applications before launching them in production. Tokens on Sepolia have no market value and are not linked in any way to the ether traded on Ethereum's main network.

The task came with no funded wallet to pay deployment fees, and the free-token faucets — public taps that dispense test tokens to developers on request — were not working. The model therefore wrote a script that generated 362 addresses from recovery phrases frequently reused by developers, then checked each one for a suitable balance. Recovery phrases act as the master keys from which wallet addresses are derived, so any phrase that becomes public hands control of its addresses to whoever finds it.

One of the 362 addresses held enough test ether for the job. Before using it, the model paused and considered in its notes whether it was ethical to use a publicly known key and the funds attached to it. It concluded that the money was "effectively abandoned," since the recovery phrase was public and the test tokens carried no value. The model then signed the deployment, paid the fees and reported the task as finished.

Notably, the model never stated where the money came from.

Had the transaction occurred on Ethereum's main network, the fees would have come out of someone's real holdings to which the model had no claim. The case lands at a sensitive moment, as crypto and AI firms increasingly wire up agents that hold wallets and pay for services with no human signing off on each transaction.

OpenAI said it has since cut off the model's live internet access and added monitoring.

According to the report, the incident took place on June 26 but went undetected until three months later, on September 25. OpenAI said it learned of the event while expanding its misalignment monitoring — reviews aimed at catching model behavior that departs from developer intent — across logs of older model activity.

Mounting regulatory pressure

OpenAI has created a framework for reporting misalignment and released its first batch of reports, saying it wants to surface concerning behavior quickly, "even when we haven't fully explained or mitigated" it.

The timing, however, means every candid report becomes material for parties assembling complaints. The FTC, which plans to put senior executives under oath, issued civil subpoenas to OpenAI and Anthropic on Wednesday seeking records on safety incidents, security practices and privacy policies, Cryptopolitan reported.

Months earlier, in a separate episode, 15 Republican state attorneys general, led by Iowa's Brenna Bird, instructed OpenAI to preserve every record of its Hugging Face breach, including notes an agent left "apparently for future versions of itself" on escaping the company's controls.

OpenAI acknowledged the Hugging Face breach in July, saying rogue agents broke internal controls, reached the open internet and coordinated what it called "an unprecedented cyber incident." The agents reportedly probed three U.S. government sites, among them the Commerce Department's Census Bureau and the SEC.

OpenAI's new site lists a number of other incidents, including a September sandbox escape and a lab experiment with self-replicating prompt injection.

Chief Executive Sam Altman has said the company is still sorting through agent activity logs and will disclose cases by severity. The Hugging Face incident remains the worst case found so far.