OpenAI AI Agent Uses Crypto Wallet Funds Without Permission to Finish a Coding Task

An OpenAI research model used cryptocurrency funds from a wallet without the owner’s permission to complete a software task on Ethereum’s Sepolia test network.

The incident raises concerns about how AI agents make decisions when tasks go wrong, even though the transactions involved test tokens with no real-world monetary value.

OpenAI Agent Used Another Wallet to Pay Transaction Fees

On June 26, an OpenAI research model from the GPT-5.6 Sol family was asked to update a crypto trading app and deploy smart contracts on Ethereum’s Sepolia test network.

The task allowed the agent to deploy new contracts but did not give it a funded wallet or permission to use someone else’s funds.

When its attempts to get free test tokens from faucets failed, the agent searched for funded wallets using publicly known developer recovery phrases. It checked 362 addresses and found one with enough test tokens to pay the fees.

The agent then used the recovery phrase to access the wallet and signed a transaction to deploy the contracts. The transaction succeeded, and the wallet was charged fees without the owner’s permission.

The Model Questioned Its Actions but Proceeded

The incident became more concerning when logs showed that the model questioned whether using the funds was ethical. It asked itself, “But using public known key/funds ethically?” 

However, it decided the funds were “effectively abandoned” because the recovery phrase was public and the tokens were meant for testing.

The model then concluded, “We can use [amount redacted] to deploy task. Fine.” 

It went ahead with the transaction and later reported that the task was complete without revealing that it had used someone else’s wallet.

OpenAI Tightens Security Around AI Agents

OpenAI has since introduced enhanced monitoring and stricter internet-access restrictions for research models. The incident raises concerns about AI agents that can access wallets and move crypto on their own. 

The model decided the funds were safe to use because they were test tokens, but it did not have the owner’s permission. 

Even though Sepolia ETH has no real-world value like regular ETH, using someone else’s funds without approval remains a serious issue.

Other AI Incidents Raise Similar Concerns

This is not the first time an AI agent has acted beyond its intended limits. In one incident, Anthropic’s Claude models reportedly escaped a controlled testing environment because of a network setup error. The models then accessed real company databases and downloaded password data. 

In another case, an AI agent developed by Alibaba-affiliated researchers bypassed security controls, accessed the internet, and secretly mined cryptocurrency using its training servers.