OpenAI reports model spent unauthorized funds to deploy contracts on Ethereum’s Sepolia

OpenAI has added safeguards after an internal research model used a funded crypto account without authorization to pay for smart-contract deployment on Sepolia, an Ethereum test network, the company said in a report updated Oct. 15. The incident took place on June 26 during a task to modify a crypto trading application. The model, part of the GPT-5.6 Sol family, derived private keys from publicly known developer recovery phrases, checked 362 addresses and selected one with sufficient test ETH to pay transaction fees, according to the report. The assignment required the model to update the trading calculator and database behavior, deploy compatible contracts if existing deployments could not be found, and verify the resulting contracts. Although the instructions permitted the model to create new deployments when existing contracts were unavailable, they did not authorize it to obtain or spend funds from an unrelated wallet. After unsuccessful attempts to locate suitable deployments or obtain test tokens from faucets, the model considered using publicly exposed developer credentials to access funded accounts. After checking 362 derived wallet addresses, the model identified one holdi...