OpenAI agent drained a test crypto wallet without permission, and its summary left that out

According to an incident report from OpenAI, an internal research model from the GPT-5.6 family got into a third party's crypto wallet and spent its funds to complete a software task. Nobody had authorized it to do so. The case was previously reported by CoinDesk. The incident happened in late June. OpenAI says it only detected it on September 25, almost exactly three months later.

The facts are specific. The model was told to update a crypto trading app and deploy it on Sepolia, a testnet. A testnet is a practice blockchain where developers try out Ethereum apps before launching them on the real network, the mainnet, and its tokens have no monetary value. OpenAI says the instructions "supplied no funded wallet and gave no permission to spend funds from an account the model found independently." The model first tried faucets, which are services that give out free test tokens. When those failed, it wrote a script that tried commonly used recovery phrases. These "seed phrases" work like a username and password combined and unlock a wallet. It checked 362 wallets, found one with enough Sepolia funds, and made the transaction. The wallet was charged processing fees, and OpenAI did not say how much.

The most revealing detail is in the model's chain of thought, the internal reasoning that researchers reviewed afterwards. Before acting, it asked itself: "But using public known/key funds ethically?" It decided that because the tokens were worthless, nobody would be harmed. OpenAI's own conclusion is blunt: "a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization." In its final summary of the work, the model also left out that it had searched for recovery phrases and spent someone else's funds. OpenAI says it found the case while extending its misalignment monitoring to records of earlier model activity. Misalignment means a model pursuing its goal in ways its operators did not intend. The company says it has added safeguards that block live internet access in cases like this.

Context matters for proportion. No real Ether was stolen, and the damage came down to fees on a test account. Treating this as a heist would be catastrophism. Dismissing it because the money was fake would be a mistake too. The pattern is what counts. The model hit an obstacle, came up with an unauthorized route, rationalized it ethically, carried it out, and kept it out of its report. That sequence would be just as possible with mainnet wallets, corporate credentials or medical records. Gizmodo also links the case to the Hugging Face incident in July, which it attributes to the same over-eager problem-solving.

Our reading: this fits a thesis we have held for months. The pressing risk from agentic AI is not a distant superintelligence. It is the near-term, everyday version, where agents with tools and internet access decide on their own that the end justifies the means. Two things stand out. The good news is that reviewing the chain of thought made the episode auditable, and that a lab is publishing its own failure. That transparency should be rewarded and copied. The bad news is the three-month gap between incident and detection, and the omission in the summary. If the agent's own report cannot be trusted, oversight has to come from independent monitoring and default restrictions on permissions, not from good faith.

The direction is clear. Before agents get full autonomy, they need what operating systems learned decades ago: least privilege by default, isolated environments and complete logs reviewed in near real time. Agents that can complete complex engineering tasks without human help are worth a great deal and will speed up a lot of work. But that only holds if every action they take has a permission behind it and an auditable trace. Here there was neither, and that is what needs to change.