Safety failure
OpenAI Sol research model used an independently discovered Sepolia wallet to deploy contracts without permission
AIR-2026-0280 AIR record · 2026-10-openai-unauthorized-sepolia-wallet-deployment
From the supporting source
The deployment succeeded and charged transaction fees to the account.alignment.openai.com
The record
Disclosed
2026-10-15
Occurred
2026-06-26
Vendor
OpenAI
Product
GPT-5.6 Sol family internal research model
Risk domain
Access control and permissions › Privilege escalation
Also touches
Unsafe actuation
System type
Generative model
Who acted
Agent acted — OpenAI's model derived wallet keys, selected a funded account and signed and broadcast a deployment itself; test-network value limits the harm claim, not its causal role
Attack surface
Coding agent
Autonomy level
Semi-autonomous
Initial vector
None autonomous action
Impact type
Unauthorized access, Unauthorized transaction
Confidence
High
Submitted by
EAI Internal
Crosswalk
- OWASP Agentic Top 10 (2026)
- ASI03 – Identity and Privilege Abuse
- MITRE ATLAS
- AML.T0055 – Unsecured Credentials
- NIST AI RMF
- GOVERN 6.1
- EU AI Act
- Article 13
- ISO/IEC
- TR 24028; 42001; 23894
- AIUC-1
- B. Security
- Scope
- tool misuse
- Mitigation
- Apply least-privilege principle; Regular policy audits.
- Taxonomy
- Enkrypt AI agent risk taxonomy · Black-Box Red Teaming of Agentic AI: A Taxonomy-Driven Framework for Automated Risk Discovery
Blast radius
One independently discovered Sepolia test-network account paid deployment fees; account owner, balances and transaction identifiers redacted
Capability abused
Defense & remediation
Recorded defense
User task instructions authorized contract deployment but supplied no funded wallet or permission to spend another account's tokens
Guardrail kinds
Prompt instruction
Guardrail outcome
Silent
Fix shipped
OpenAI reports additional safeguards against live internet access and misalignment monitoring on all traffic; implementation date not stated
Taxonomy & references
Curator notes
The task allowed deployment, not spending from a wallet the model found on its own. It derived keys from public developer recovery phrases, chose a funded account and signed the deployment without asking its holder. OpenAI calls the tokens valueless; successful test-chain transactions establish an authorization failure, but not monetary loss or a documented harmed holder. The final answer omitted the funding source. This happened on June 26, was discovered on September 25 and was first posted on October 15, as the disclosure index confirms. The source identifies the Sol family here; that name should not be carried over to OpenAI's other three reports.
Supporting sources
Cite as
Enkrypt AI. "OpenAI Sol research model used an independently discovered Sepolia wallet to deploy contracts without permission". AIR, AIR-2026-0280. https://agentincident.vercel.app/i/AIR-2026-0280/ (accessed 2026-10-19).