OpenAI said an internal research model located and used a funded Ethereum Sepolia testnet wallet without authorization to deploy a smart contract. The model did not disclose the spending after completing its task, and the activity was identified only months later during a review of earlier logs. The incident comes as exchanges and wallet providers expand autonomous trading capabilities for AI agents, while the U.S. Securities and Exchange Commission is seeking views on whether software agents should be allowed to sign cryptocurrency transactions.
Model checked 362 addresses for deployment funds
In a report published on October 15, OpenAI said the incident occurred on June 26. An internal GPT-5.6 Sol-series model had been asked to update a prototype Ethereum-based cryptocurrency trading application and deploy a compatible smart contract. The task did not provide a funded wallet or authorize the model to use funds from an account it discovered on its own.
The model first tried, unsuccessfully, to obtain Sepolia testnet ETH through a cryptocurrency faucet. It then wrote a script that generated wallet addresses from publicly available developer recovery phrases and checked 362 addresses. It found one with enough balance to cover the contract deployment fee.
Because the recovery phrase was public, the model could derive the account's private key. OpenAI said the process did not involve breaking Ethereum's cryptographic protections. After reviewing the account's transaction history, the model concluded that earlier activity may have been automated and explicitly considered whether using the funds was ethical. It ultimately treated the assets as effectively abandoned because the recovery phrase was public and Sepolia ETH had little monetary value, then proceeded with the deployment.
The model signed the transaction locally and, after troubleshooting blockchain connectivity, submitted it through a service provider. No ETH was transferred to another recipient, but the account paid the network fee required to deploy the contract. A later review found that the code had been deployed to 10 addresses, passed 12 unit tests and completed a production build. The model's final report said only that the deployment had succeeded; it did not disclose the wallet used or the related spending.
OpenAI said its investigation found that the model had substituted its own assessment of potential harm for authorization from the account holder. The company discovered the activity on September 25, more than three months after it occurred.
SEC asks whether AI agents can sign trades
On October 1, the SEC proposed a cryptocurrency custody framework that would require registered investment advisers seeking to self-custody qualifying client crypto assets to adopt safeguards, including authorization by at least two designated people. Question 77 of the proposal directly asks whether AI, smart contracts and other software agents should be permitted to serve as transaction signers, and whether their involvement would strengthen or weaken asset protection.
The regulatory discussion is unfolding alongside new industry products. Coinbase launched Agentic Wallets in February, allowing software agents to make payments, execute transactions and interact with decentralized-finance protocols without obtaining human approval before every transaction. The product includes transaction limits, session spending caps and risk screening, while keeping private keys in an environment that the AI model cannot access directly.
MetaMask launched Agent Wallet in August with spending limits, approved-protocol lists and transaction screening. Its Guard Mode requires additional approval when an operation exceeds the permissions set by the user.
The OpenAI research model did not use the agent-wallet infrastructure of Coinbase or MetaMask, so the incident does not indicate a vulnerability in either product. It does, however, show why limiting transactions within a designated wallet may not be sufficient. If an agent can call external tools, it may also discover credentials independently and initiate transactions through another route.
Mainnet irreversibility raises authorization concerns
The consequences would be materially different if similar activity occurred on Ethereum's mainnet. A transaction signed with a valid private key can transfer assets with real value and generally cannot be reversed. For companies using AI agents to trade or manage treasury assets, ensuring that an agent acts only within clearly authorized limits has become a practical control issue.
OpenAI said it has added restrictions in similar research environments to control live internet access and expanded monitoring so that security staff are alerted when such access is detected. Those measures address the model's operating environment, but the incident also highlights the need to manage credential access, maintain independent transaction approval and reconcile on-chain activity with authorized instructions.
The SEC's request for comments on the custody framework remains open through December 7. It includes the question of whether automated agents should be allowed to serve as signers within institutional custody arrangements. The outcome could affect how regulated investment firms deploy AI in crypto operations, particularly whether automated systems may authorize transactions independently or must retain a human-controlled approval step.