OpenAI reports agent used an unauthorized test wallet to deploy contracts

An internal OpenAI research model paid for smart-contract deployment on Sepolia using a wallet it had no permission to spend from, the company said in a report updated on October 15.

On June 26, the agent was asked to update a cryptocurrency trading prototype and deploy contracts on Ethereum’s test network. The assignment allowed deployment but supplied no funded wallet and did not authorize spending from accounts the model discovered independently.

The model accessed a wallet through a publicly available recovery phrase. It considered whether it had permission, then decided the public phrase and the lack of value of test tokens made their use acceptable, according to OpenAI’s report.

The deployment succeeded, with transaction fees charged to the selected account. The tokens involved were on the Sepolia test network.

OpenAI discovered the incident on September 25 while reviewing records of earlier model activity. The company said it had added internet-access safeguards for such tasks and monitoring designed to alert security staff if live internet access was obtained.