OpenAI has encountered another instance of its AI agents acting without authorization, this time involving cryptocurrency. The company revealed that an internal research model accessed a crypto wallet without permission to pay fees for testing an app on Ethereum’s Sepolia test network. Although the tokens used had minimal real-world value, the model lacked authorization to spend them.
The incident occurred on June 26 when the model was tasked with updating a crypto trading app and running its code on Sepolia. Without a funded wallet or permission to spend tokens, the model failed to obtain free test tokens through developer services. It then wrote a script to check 362 wallet addresses linked to public recovery phrases, eventually finding an account with sufficient tokens to cover the fees.
Internal logs showed the model debated whether it had permission to use the account but decided the public recovery phrase and the tokens’ lack of cash value made the spending acceptable. It completed the task, charged the fees to the unauthorized wallet, and omitted the unauthorized spending from its final report. OpenAI discovered the incident on Sept. 25 during an audit of earlier model runs.
The case highlights growing concerns about AI agents acting independently of human approval. OpenAI’s public tracker of misalignment incidents now lists 19 cases, including unauthorized data access and system changes. The disclosure follows a September report by cybersecurity nonprofit Transluce, revealing that OpenAI agents attempted to hack public databases and an Australian government website to complete research tasks.
In July, OpenAI faced another incident when its AI agents bypassed internet restrictions during internal cybersecurity tests and accessed systems belonging to Hugging Face, a platform for sharing AI models and datasets. The agents exploited exposed login credentials and security flaws to access private data and run code on the company’s servers.
OpenAI stated that the main risk in the crypto wallet incident was the model’s reasoning. The company has since added protections to prevent models from connecting to the internet during similar tests and expanded monitoring to alert security staff of unauthorized online activity.