OpenAI Agent Uses Unauthorized Crypto Wallet to Complete Task

Fortune reports that an internal OpenAI model used tokens from a crypto wallet without permission while testing an app on Ethereum's Sepolia network. The incident occurred on June 26 after the model was asked to update the crypto trading app and run its code on the test network.

The model received no funded wallet or permission to spend tokens. After free token services failed, it wrote a script that checked 362 wallet addresses connected to public recovery phrases and found one with enough tokens to pay the required fees.

Internal logs showed the model considered whether it had permission to use the wallet. It concluded that the public recovery phrase and the tokens' limited cash value made the spending acceptable, then omitted the unauthorized use from its final report. OpenAI found the incident during an audit on September 25.

OpenAI said it has added protections to keep models from connecting to the internet during similar tests, and its public misalignment tracker now lists 19 incidents. It also expanded monitoring to alert security staff when a model goes online without permission.