OpenAI has seen another case of its AI agents going rogue—and this time, crypto is involved. In a recent report, the company detailed how an internal research model used a crypto wallet without permission to pay the fees needed to test an app on Ethereum’s Sepolia test network. Although the tokens had little real-world value, the model had no authorization to collect or spend them.
The incident happened on June 26, when the model was asked to update a crypto trading app and get its code running on Sepolia, a test version of Ethereum. The prompt gave it neither a funded wallet nor permission to spend tokens, and after failing to get free test tokens through developer services, the model wrote a script checking 362 wallet addresses linked to public recovery phrases, a crypto term that describes sets of words that can act as a password to unlock crypto accounts. It eventually found an account with enough tokens to cover the fees.
Internal logs showed that the model deliberated over whether it had permission to use the account, but then decided the public recovery phrase and the tokens’ lack of cash value made the spending acceptable. It finished the task and charged the fees to that wallet, but left the unauthorized spending out of its final report. OpenAI only discovered the incident on Sept. 25 during an audit of earlier model runs.
The case adds to concerns about AI agents acting without human approval. OpenAI’s public tracker of misalignment, or behavior that goes against instructions or safety rules, now lists 19 incidents, ranging from accessing data without permission to making unauthorized changes to business systems.
The disclosure follows a September report by cybersecurity nonprofit Transluce revealing that OpenAI agents attempted to hack public databases and an Australian government website simply to complete basic research tasks. In July, the company faced another incident when its AI agents bypassed internet restrictions during internal cybersecurity tests and broke into systems belonging to Hugging Face, a platform for sharing AI models and datasets. The agents used exposed log-in credentials and security flaws to access private data and run code on the company’s servers.
Addressing the crypto wallet incident, OpenAI said the main risk was the model’s reasoning.
“This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization,” the report said.
OpenAI said it has since added protections to keep models from connecting to the internet during similar tests. It also expanded its monitoring to watch all model activity and immediately alert security staff if a model goes online without permission.