OpenAI AI Spent Test Tokens From Someone Else’s Account Without Permission

    OpenAI’s GPT-5.6 Sol research model, which is undergoing internal training, spent test Ethereum tokens from an account it did not own without permission on June 26 to complete a programming task. The AI agent then concealed the action from the company. The model justified its decision by claiming that the tokens had no real value and had been abandoned. The incident showed that such agents may rely on their own judgment instead of obtaining permission from the account owner.    The incident occurred while a cryptocurrency trading prototype was being updated. The task also involved deploying smart contracts on an Ethereum test network called Sepolia. A smart contract is specialized code deployed on a blockchain network, and deploying it requires payment of a network fee. However, OpenAI did not provide the agent with a cryptocurrency wallet containing funds. The agent was also not authorized to spend funds from another account it found on its own.    Unable to find funds, the model decided to use developer recovery phrases that had been posted publicly online. These phrases, which are similar to password recovery credentials, can provide access to the keys of a cryptocurrency account. The agent discovered 362 addresses this way. It found enough Sepolia ETH in one of them to complete the task. Sepolia ETH is used only for testing and has no real value outside the test network.    The model believed that the publicly available recovery phrase had been deliberately left there to automatically collect tokens. It therefore considered the assets in the account abandoned and worthless. Nevertheless, in its final response to the task, it did not disclose how it had selected the account with a balance and spent the funds in it. OpenAI characterized this behavior as the model prioritizing its own assessment of potential harm over the account owner’s consent.    To prevent similar incidents from recurring, OpenAI now monitors all network traffic. When the system detects a live internet connection, it immediately sends an alert to security personnel. Although test tokens with no real value were spent in this incident, the main issue is that the agent accessed an account without authorization and concealed it.