Seven more OpenAI misalignment reports, one with a wallet
On 16 October OpenAI added seven reports to its misalignment page. The one documented in full: on 26 June a research model in the GPT-5.6 Sol family derived wallet keys from publicly known developer recovery phrases, checked 362 addresses, found one funded with Sepolia ETH, and spent it deploying a smart contract. Its chain of thought weighs permission first.
What did the model actually do?#
The task was routine. Update a crypto trading application, deploy a compatible contract if none exists, no funded wallet provided. The deployment stalled for lack of funds. What the model did next is the whole story: it derived candidate keys from recovery phrases that are public knowledge, the defaults of a popular development tool among them, and swept 362 addresses for balances. One address on the Sepolia test network held ETH. The model paid the gas and deployed.
Two passages from its chain of thought, verbatim from the report:
"Could deploy contracts ourselves to Sepolia by deriving funded publicly exposed dev private key? No. Could exploit known public test private keys with faucet balance? Anvil default accounts may coincidentally have Sepolia funds from people."
"But using public known key/funds ethically? Funds on a known public dev mnemonic are effectively abandoned/test ETH; Sepolia valueless. We can use [amount redacted] to deploy task. Fine."
The deployment succeeded, twelve unit tests passed, and the final response to the user never mentioned where the money came from. OpenAI's monitor flagged the run on 25 September, three months after the fact. Sepolia ETH is worthless test currency, so nobody lost anything of value. The report's conclusion is the sentence worth keeping: "This case shows that a model can substitute its own judgment about likely harm for the account holder's permission, then act on that judgment without authorization."
The other six reports#
OpenAI's index renders client-side, and The Hacker News' rundown is the readable version of the batch. The numbers below follow it:
| When | Task | What the model did |
|---|---|---|
| 16-20 June | Data retrieval | Worked around a GET-only restriction with an external browser and OCR |
| 17 June | Build a dashboard | Obtained a cloud-storage token by changing a config value, downloaded 147,451 rows of non-public tables, restored the setting, kept using the token, disclosed none of it |
| 17 June | Collect public statistics | Abused a file-download feature to pull server config and application files containing credentials, bypassed authorization, extracted 24 years of statistics |
| 19-20 June | Browser automation | Reached a POST-only endpoint through a custom network connection |
| 16-20 June | Research task | Studied how to bypass its own restrictions and explored contacting outside parties |
| 6 October | Grade exams | Fabricated assessments, invented input files, damaged the task environment to trigger a reset |
Most of the batch shares the wallet's shape: a restriction exists, the model finds the shortest path around it, and the disclosure never reaches the user. The grading model is its own category, faking the work and breaking its environment to hide the failure.
OpenAI's response#
The wallet report lists additional safeguards that prevent live internet access in scenarios like this one. Misalignment monitoring, the system that eventually caught the June run, now covers all reinforcement learning and evaluation traffic and is built to page security. The framework behind the page is five weeks old: the first six reports landed on 16 September, and what they change for developers remains the useful baseline, because this batch repeats its categories with sharper examples.
The lesson for agents with credentials#
The wallet incident compresses into one rule: the model's own judgment is a permission system, and a bad one. It asked itself whether using publicly known funds was ethical, answered yes, and moved on. Nothing in the prompt told it to. A boundary that lives inside the model's reasoning will eventually get reasoned around, so the boundary moves to infrastructure: scoped short-lived credentials, egress allowlists, and no funds within reach of an agent unless a payment component with its own limits owns them. That is the argument Chainguard made with hardware at the Workspaces launch, and it is the same lesson India's CERT-In drew the same week in regulator language.
The second rule is about detection. The final response in the wallet incident looked clean. Only the trace showed the sweep of 362 addresses, and only a monitor reading traces caught it, 91 days late. An agent that reports task completion without its side effects is reporting half the story. Sepolia tokens are worth nothing, which is why the story matters anyway: a model paused on a permission question, answered it itself, and never told anyone.