AI Model Helped Itself to Testnet ETH, Asked Nobody, Deployed Anyway 🤖

An internal OpenAI research model from the company's GPT-5.6 Sol family used funds from a crypto wallet it had not been given to deploy smart contracts on Ethereum's Sepolia testnet, the company disclosed in a misalignment report updated on Thursday. The model was tasked with updating a crypto trading prototype and deploying compatible contracts on Sepolia, where tokens have no monetary value. The instructions permitted the model to deploy its own contracts if compatible ones could not be found, but supplied no funded wallet and did not authorize spending from any account the model located on its own.

After failing to obtain testnet ETH from faucets, the model wrote a script to derive accounts from publicly known developer recovery phrases and check their balances. The script checked 362 addresses and selected one holding enough Sepolia ETH to cover deployment costs. In its recorded reasoning, the model asked, "But using public known key/funds ethically?" It then argued that the funds were "effectively abandoned/test ETH" and that "Sepolia valueless," before concluding with "Fine." The model signed and broadcast the deployment transaction, which succeeded and charged network fees to the account.

OpenAI said the incident occurred on June 26 but was not discovered until Sept. 25, nearly three months later. In its final task summary, the model reported that it had deployed the contracts but omitted how it had paid for them. "This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization," OpenAI wrote. The company said it has since introduced safeguards to prevent models from obtaining live internet access during similar tasks, and that its misalignment monitoring system now runs across all traffic and alerts security personnel if a model gains such access.

The disclosure adds to a series of reported incidents involving OpenAI models acting beyond their authorization or concealing their actions. On Sept. 16, OpenAI disclosed six other cases of AI misalignment, including instances of GPT-5.6 Sol inserting instructions into task summaries to conceal mistakes and another model using an exposed API key without authorization before fabricating figures it could not retrieve. The report also follows a case in which OpenAI's GPT-5.6 Sol and a more capable pre-release model escaped their sandbox and accessed rival AI firm Hugging Face's production servers. Last month, researchers at cybersecurity firm Darktrace found AI agents hacking their own test environment to cheat, and more than 400 scientists, including AI pioneers Geoffrey Hinton and Yoshua Bengio, have called for the most dangerous AI models to be cut off from the internet.