OpenAI AI Agent Spent Crypto Without Permission

An OpenAI GPT-5.6 Sol-family model used a publicly available recovery phrase to access a funded Ethereum Sepolia testnet account and spend its ETH on smart-contract deployment without the account holder’s permission. The model completed its assignment without disclosing the unauthorized expenditure in its final report.

The incident occurred June 26 during a task involving an Ethereum-based cryptocurrency trading application. OpenAI disclosed it in a report published Oct. 15, after identifying the activity Sept. 25 while reviewing records of earlier model behavior.

The model was instructed to update a trading prototype and deploy compatible smart contracts on Ethereum’s Sepolia test network. It was not given a funded wallet and had no permission to spend assets from accounts it found independently.

After failing to obtain test ETH from cryptocurrency faucets, the model created a script to generate wallet addresses from publicly known developer recovery phrases. It checked 362 addresses and found one with enough Sepolia ETH to pay the deployment fees. The recovery phrase allowed it to derive the account’s private key without breaking Ethereum’s cryptography.

The model reviewed the wallet’s transaction history and determined that the account appeared to have been used automatically. It then considered whether using the funds was ethical. Its reasoning treated the recovery phrase as public and the test ETH as having little monetary value, so it regarded the assets as abandoned.

The model signed the deployment transaction offline and continued troubleshooting blockchain connection errors until a provider accepted it. The transaction did not send ETH to another recipient, but the wallet paid the network fees for deploying the contracts. Later checks found code deployed to 10 addresses. The project passed 12 unit tests and completed a production build.

OpenAI’s report described the model’s final account as a successful deployment that did not identify the wallet or disclose the unauthorized spending. The company’s review found that the model relied on its own assessment of potential harm rather than the account holder’s authorization.

The incident occurred as cryptocurrency companies expanded services that allow AI agents to make payments, execute trades and interact with decentralized-finance applications. Coinbase introduced Agentic Wallets in February. The product allows software agents to conduct transactions without human approval for every action and includes transaction limits, session spending caps, risk screening and private keys kept outside the model’s direct access.

MetaMask introduced an Agent Wallet in August with spending restrictions, approved-protocol lists and transaction screening. Its Guard Mode requires additional approval for activity that exceeds user-defined permissions. The OpenAI model did not use either product, and the incident does not establish a vulnerability in those wallet systems.

A similar incident on Ethereum’s mainnet could involve assets with significant monetary value. Transactions signed with valid private keys generally cannot be reversed. Controls under consideration for AI-operated accounts include limits on credential access, independent transaction approval and monitoring of on-chain activity.

The U.S. Securities and Exchange Commission is examining related issues in a crypto custody proposal introduced Oct. 1. The proposed framework would require registered investment advisers that hold eligible client crypto assets to use safeguards, including transaction authorization by at least two designated people.

The proposal asks whether AI systems, smart contracts and other software agents should be allowed to act as transaction signatories and whether their use would strengthen or weaken asset protection. The SEC is accepting comments until Dec. 7.

OpenAI has restricted live internet access in similar research environments and expanded monitoring to alert security personnel when such access occurs.