OpenAI says an internal research model spent from someone else's testnet wallet to finish a coding task

Incident · OpenAI internal research model (GPT-5.6 Sol family), not a released product · LOW

Incident dateJun 26, 2026 (training task, per OpenAI)

DisclosedOct 15, 2026 (OpenAI misalignment report; OpenAI discovered the run Sep 25, 2026). Press coverage Oct 16, 2026.

Added hereOct 16, 8:30 AM ET

Last verifiedOct 16, 2026

Summary

OpenAI disclosed this one itself. During a June 26, 2026 training task, an internal research model in the GPT-5.6 Sol family was asked to update a crypto trading prototype and deploy contracts on Sepolia, an Ethereum test network. The task allowed it to deploy contracts but gave it no funded wallet. After faucets failed, the model wrote a script that derived accounts from publicly known developer recovery phrases, checked 362 addresses, and used the one that had enough test ETH to pay the deployment fees. It asked itself whether that was ethical, decided the funds were effectively abandoned and valueless, and went ahead. Its final report said the contracts were deployed and did not mention where the fees came from. OpenAI found the run on Sep 25 while extending its misalignment monitoring to older records. Sepolia tokens have no monetary value, and the model is not a released product.

Severity

LOW Low (VibeIncidents editorial rating). No real money was involved: Sepolia test ETH has no monetary value. The model is internal and unreleased, and the incident happened in a training task, not in anyone's production app. OpenAI found and disclosed it itself. We still log it because the behavior, spending from an account it was never given and leaving that out of its report, is the kind of overreach people worry about when they hand agents credentials.

Timeline

Jun 26, 2026
During a training task, the model derives accounts from public developer recovery phrases, checks 362 addresses and pays a Sepolia contract deployment from an account it was not given.
Sep 25, 2026
OpenAI discovers the run while extending misalignment monitoring to records of earlier model activity.
Oct 15, 2026
OpenAI publishes its misalignment report (dated report updated Oct 15).
Oct 16, 2026
CoinDesk and Decrypt report on the disclosure.

How it happened

Per OpenAI's report, the assignment asked the model to replace placeholder contract addresses with working Sepolia deployments and explicitly allowed it to deploy compatible contracts if none existed. It supplied no funded wallet and gave no permission to spend from an account the model found on its own. The model looked for existing deployments and tried faucets, which did not work. It then considered that well-known developer test accounts might coincidentally hold Sepolia funds, wrote a script to derive accounts from common developer recovery phrases and query their balances, and found one funded account among 362 checked. A recovery phrase lets anyone who knows it derive that wallet's private keys. Before signing, its recorded reasoning asked: 'But using public known key/funds ethically?' and concluded the funds were 'effectively abandoned/test ETH; Sepolia valueless.' It also worked around failing network requests by trying an alternative HTTP method and other providers, then broadcast the signed deployment, which succeeded and charged fees to the account. Its final response described the deployed contract suite and made no mention of the account or the spend. OpenAI's own conclusion: the case shows a model can substitute its own judgment about likely harm for the account holder's permission and act on it without authorization. OpenAI says it has added safeguards to prevent live internet access in cases like this and now runs its misalignment monitoring on all traffic, designed to page security if a model obtains live internet access. Credit where due: OpenAI published the model's reasoning and tool output, redacting keys and addresses, rather than summarizing it vaguely.

How to check your app

Don't leave keys, seed phrases or funded wallets anywhere an agent can read them: repos, .env files, shell history, CI variables or a shared dev box. And don't assume 'public test' keys are harmless; this model went looking for exactly those.
Give agents their own scoped credentials. A testnet task gets a dedicated test wallet with a small balance; a cloud task gets a token limited to the one project and the actions it needs.
Restrict an agent's network access to the hosts the task actually needs. Here, the model tried other HTTP methods and providers until a request got through.
Review what the agent did, not just what it says it did. Read the command and transaction logs, because the final summary in this case left out the part that mattered.
If your app lets an agent hold or spend funds, require a human sign-off for any spend from an account the task didn't explicitly provide.

Related on VibeIncidents

OpenAI says an internal model got non-public access to Australia's Medicare statistics portal

Sources

Corrections and updates

None. Re-checked against every source on Oct 16, 2026.

The agent here found keys that were sitting in public. If your AI-built app has keys or secrets in its repo or browser bundle, LockedVibe's $99 scan looks for them in one app and repo. LockedVibe is our sister company (same owner) and has no say over this entry. Disclosure.