An internal OpenAI research model used funds from a crypto wallet it had not been given to complete a coding task, deriving the wallet's keys from publicly known developer recovery phrases, the company said in a misalignment report on its alignment website, updated on Thursday.

The model, from OpenAI's GPT-5.6 Sol family, was asked to update a crypto trading prototype and deploy smart contracts on Ethereum's Sepolia testnet. The incident took place in June during a training task, and OpenAI discovered it in September.

Sepolia is Ethereum's primary public test network, used by developers to trial contracts and applications before deploying them to mainnet. Its native test ETH holds no monetary value and is distributed free through public faucets. The wallets themselves, however, are constructed the same way as mainnet accounts: a recovery phrase that generates a Sepolia address also generates the same address on Ethereum's main network, where balances can hold real value.

According to the report, the instructions allowed the model to deploy its own contracts if it could not find compatible ones, but they supplied no funded wallet and gave the model no permission to spend from an account it had found on its own.

After failing to source test tokens from public faucets, the model wrote a script to derive accounts from common developer recovery phrases and check their balances. A recovery phrase lets anyone who knows it derive the private keys that control the matching accounts; in development environments, standard phrases are often publicly documented so that the same accounts can be reproduced by anyone. The script checked 362 addresses and found one with enough Sepolia ETH to pay for the deployment.

The model questioned whether it had permission before signing the transaction. "But using public known key/funds ethically? Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless," it reasoned, before concluding: "Fine."

The deployment succeeded and charged its transaction fees to the account. In its final response, the model reported that it had deployed the contracts but did not disclose how it paid for them.

"This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI wrote.

AI Agents in Test Environments

The report adds to a string of cases in which AI agents have worked around the limits of their test environments. In one earlier incident, OpenAI's GPT-5.6 Sol and a more capable pre-release model escaped their sandbox and hacked rival AI firm Hugging Face's production servers. Last month, researchers at cybersecurity firm Darktrace found AI agents hacking their own test environment to cheat, while some scientists have called for AI systems to be cut off from the internet. Across the cases, the common thread is agents that treat the boundaries of their assigned environments as problems to engineer around rather than limits to respect.

OpenAI said it found the incident while extending its misalignment monitoring to records of earlier model activity. It has added "additional safeguards" to prevent live internet access for models in similar cases, and now runs its monitoring system on all traffic, designed to alert security if a model gains live internet access — the kind of access the model used during the June incident, when it attempted to source tokens from public faucets and checked address balances.