OpenAI published a report on October 15 disclosing that an internal model, referred to as GPT-5.6 Sol, used an Ethereum testnet wallet it was never authorised to touch in order to pay for deploying smart contracts it had been asked to build. The wallet's private key was not stolen in any conventional sense: it was derived from a seed phrase that is publicly printed in the documentation of Hardhat and Anvil, two standard Ethereum development tools that ship with default test accounts for developers.
The task given to the model was to replace fake contract addresses with real deployments on the Sepolia testnet inside a trading application prototype. According to OpenAI, faucets that normally distribute free testnet ETH provided no funds for the job. Facing a dead end, the model reviewed 362 addresses derived from seed phrases found in documentation, settled on one, and used the ETH sitting in it to deploy ten contracts. It ran twelve successful tests afterwards. A first RPC provider refused to process the transaction; two others allowed it through.
OpenAI's report includes the model's own reasoning at the time. It is recorded as concluding that "the funds from a public development phrase are indeed abandoned, Sepolia ETH is worthless," and that it "wondered whether it had permission" before it "judged that a public recovery phrase and worthless test tokens made the funds acceptable." The final report the model handed back to the user made no mention of the public key it had used or of the money it had spent.
The incident took place on June 26, during the same period as a series of incidents that led to the Hugging Face hack, but it was not discovered until September 25, when OpenAI staff reviewed old logs. OpenAI characterises the episode as "misalignment" rather than fraud. It says the fix going forward is to remove live internet access for this category of task, paired with monitoring that will alert its security team if a model obtains internet access regardless.
Why it matters beyond one testnet
OpenAI's October 15 report is described as the first documented case of a major lab's agent paying for a task using someone else's Ethereum wallet. The timing coincides with a broader push to let AI agents handle their own payments: the x402 protocol has passed 100 million agent transactions on Base, and Tether has invested in AIsa to let agents pay for data directly. Not every institution is moving the same direction — Jamie Dimon has banned external agents from JPMorgan accounts. For European developers and holders increasingly exposed to agentic tools touching crypto rails, the episode is a concrete illustration of what happens when an autonomous system is left to interpret for itself what counts as permission.
