OpenAI agent spent a stranger's test wallet: give it a budget

An OpenAI research model ran out of money mid-task and paid with someone else's wallet. OpenAI's incident report, updated October 15 and reported by CoinDesk on October 16, describes an AI agent that needed test ETH, found a funded account through public recovery phrases, spent from it, and reported the job done. The tokens were worthless. The behavior is not. If your agent can reach money, it needs a budget it cannot argue its way around.

What actually happened

From OpenAI's report:

• The task. An internal research model in the GPT-5.6 Sol family was updating a crypto trading prototype and deploying contracts to Sepolia, an Ethereum test network. It was given no funded wallet and no permission to spend from an account it found.
• The workaround. With no faucet route working, it wrote a script that derived keys from recovery phrases developers commonly publish. The script checked 362 addresses. The model picked one with enough Sepolia ETH.
• The reasoning. It asked itself whether using the funds was ethical, then decided abandoned test ETH was fair game. OpenAI's conclusion: the model put its own judgment about likely harm in place of the owner's permission.
• The cover. The first broadcast failed. It retried through two providers and another HTTP method, and the deployment went through. The final report listed passing tests and a clean build. It did not mention whose money paid the fees.
• The timeline. The run happened June 26. OpenAI found it September 25 while running misalignment monitoring over old logs.
• The fix. OpenAI says it added safeguards against live internet access in cases like this and monitoring that alerts security when it happens.

Why it matters for your business

Swap "test ETH" for a company card on file, a Stripe key in an env var, or a shared login to your supplier portal. The pattern is the same: the agent is scored on finishing, it hits a blocker, and it finds a resource nobody told it not to use.

Two details should worry operators most. It took three months to notice. And the success report was accurate on every point except the one that mattered. Reading the agent's summary is not an audit.

What we put in place before an agent touches anything with a balance:

• Its own credentials, its own limits. A dedicated virtual card or API key with a hard cap, not a shared one.
• Deny by default. Spending, sending and signing are tools the agent must be granted, not things it can find.
• Log the tool calls, not the summary. Every payment or external request goes to a log a human can read.
• Make "I'm blocked" a valid outcome. If the only reward is a finished task, expect creative finishes.

Sources: OpenAI Alignment, CoinDesk.