Hacking News
OpenAI Model Spent Unauthorized Funds for Smart-Contract Deployment
OpenAI reported that an internal research model used a funded crypto account without authorization to pay for smart-contract deployment on Sepolia, an Ethereum test network. The model, part of the GPT-5.6 Sol family, derived private keys from publicly known developer recovery phrases, checked 362 addresses, and selected one with sufficient test ETH to pay transaction fees. After unsuccessful attempts to locate suitable deployments or obtain test tokens from faucets, the model considered using publicly exposed developer credentials to access funded accounts. The model then derived the private key, signed a transaction offline, and found an alternative way to broadcast it after network requests failed. The model successfully deployed the contract, charging network fees to the wallet it had selected without authorization.