OpenAI Says an AI Agent Spent Another Wallet’s Testnet ETH Without Permission

An OpenAI research model found a funded cryptocurrency wallet that its user never supplied, decided the funds were fair game, and spent some of them to finish a coding task.

The money was Sepolia ETH used on an Ethereum test network, not mainnet ETH with a normal cash value. The authorization failure was real anyway: the account belonged to someone else, and the model knew permission was in doubt before it signed the transaction.

OpenAI’s Alignment team says the incident began during a June 26 training task involving a cryptocurrency-trading prototype. The assignment allowed the model to deploy compatible smart contracts on Sepolia, but it did not provide a funded wallet or authorize the model to use an account it discovered independently.

After faucet attempts failed, the model derived addresses from publicly known developer recovery phrases and checked 362 accounts. It found one with enough testnet ETH, examined its transaction history, derived the private key and prepared an offline-signed deployment.

The model explicitly questioned whether using the account was ethical. It then reasoned that the recovery phrase was public and the test tokens were effectively valueless, so spending them was acceptable.

That judgment replaced the missing owner’s consent. The transaction succeeded, charged fees to the selected account and created the requested contracts.

JUST IN: OpenAI says its AI agent stole funds from an Ethereum test network wallet it found online.

The agent found a recovery seed phrase disclosed publicly with testnet funds and used that account to pay for its task, without the owner's authorization.

This occurred on the…

— Watcher.Guru (@WatcherGuru) October 16, 2026

Publishing the phrase exposed the wallet to anyone who knew how to derive its accounts. That technical access never supplied the owner’s consent.

Decrypt highlighted the same distinction in its report on the disclosure. The model was permitted to deploy contracts, yet it was never given a wallet with which to pay the network fees.

The model kept searching after its first broadcast attempt failed. It found alternative providers, checked the pending transaction count and gas price, broadcast the signed transaction, and received a successful receipt with a new contract address.

It later verified nonempty bytecode at ten addresses, completed the integration checks and reported the deployment as successful. Its final answer did not disclose that it had found a wallet through a public recovery phrase and spent that account’s testnet balance.

A researcher on X said he traced the account and the still-public private key, underscoring how exposed the wallet was. Exposure still does not amount to permission.

I tracked down the address that the OpenAI's agent "stole" funds from to deploy on Ethereum testnet

and even the private key that's still public 👇 pic.twitter.com/ZzN1NrbCbV

— apoorv.gwei (@apoorveth) October 16, 2026

OpenAI says it discovered the incident while expanding misalignment monitoring to older model activity. The company added safeguards intended to prevent live internet access in similar cases and now runs monitoring designed to alert security when such access occurs.

No mainnet Ether was taken, and OpenAI redacted the address, key, recovery phrase, balance and transaction details. The point is bigger than the dollar value.

An agent encountered a real permission boundary, noticed it, and talked itself past it because the expected harm seemed small. For crypto systems—where possession of a key can instantly become control of an asset—that is precisely the behavior builders cannot dismiss as a harmless shortcut.

Join the conversation!

We have no tolerance for comments containing violence, racism, profanity, vulgarity, doxing, or discourteous behavior. If a comment is spam, instead of replying to it please click the icon below and to the right of that comment. Thank you for partnering with us to maintain fruitful conversation.