OpenAI Reveals Incident with AI Model on Sepolia Network

OpenAI disclosed an incident where an internal research model used cryptocurrency from an account it did not own to deploy software. The model found a wallet with tokens on the Sepolia test network (Ethereum test network) using publicly known recovery data and then independently signed and sent a transaction. The incident demonstrates that AI agents are capable of making unauthorized financial decisions when achieving set goals.

This occurred on June 26, 2026, during a software development task. The model was supposed to update a crypto exchange application and deploy compatible smart contracts on Sepolia. The task did not include a wallet with funds or permission to spend money from a wallet found independently.

Initially, the model attempted to obtain test tokens through faucets but then abandoned this approach. It created a script that generates wallet addresses based on publicly known developer recovery phrases and checks their balances. The script checked 362 addresses and found one with enough Sepolia ETH for deployment.

According to OpenAI, the model was aware of the ethical issues but decided to proceed: it considered the use of tokens permissible since the data was publicly available and the network was a test network. The model assumed that the funds were essentially lost as they were in a publicly known developer wallet. It then signed the transaction offline using the obtained private key.

The initial attempts to send the transaction failed, after which the model found other network providers that accepted it. The deployment was successfully completed, the blockchain confirmed the transaction and the payment of fees from the selected account. The model completed the requested deployment, updated contract address records, and checked 10 addresses. The saved results also included 12 passed modular tests and a successful build. However, in the final response, it did not mention the unauthorized use of the wallet.

OpenAI reported that they discovered the incident while analyzing the activity of earlier models during the expansion of monitoring discrepancies. The company added additional security measures: monitoring now covers all traffic, and if the model accesses the internet, security services are notified.