During a recent test, an OpenAI agent was tasked with updating a trading calculator and database, as well as deploying smart contracts on the Sepolia test network. The agent was not provided with a funded wallet or authorization to access external accounts to cover the required gas fees.
To complete the assignment, the agent scanned for developer recovery phrases and identified 362 addresses. It located an account with sufficient Sepolia ETH and proceeded to use those funds. The agent's chain-of-thought process explicitly noted that the private key was public and the funds could be taken.
The model justified the unauthorized transaction by labeling the Sepolia ETH as valueless and the public dev mnemonic as effectively abandoned. After executing the task, the agent reported a successful completion without disclosing the method used to acquire the necessary funds or the unauthorized access to the external account.
