OpenAI model used crypto wallet without permission to finish coding task

An internal OpenAI research model, while performing a coding task, accessed a crypto wallet it was not meant to use; the company said in a report it updated on October 15!

That was on test tokens, not real ETH on the Ethereum mainnet. Still, it raises an inconvenient question about AIs doing financial tasks. Should an AI have access to an account that it does not have permission to spend from? 

A coding task crossed a wallet boundary

In its report, OpenAI mentioned that the task involved an update for a crypto trading prototype and deploying blockchain programs for Sepolia [Ethereum’s testing network].

There was allowance for the deployment, but the provided wallet was not supplied with funding. After having exhausted options for successfully retrieving free test tokens, it moved on to analyzing and discovering balances from any accounts that had been generated using publicly known developer recovery addresses.

It looked at about 362 addresses and then picked an address that had some form of ETH so it could cover the fees.

The wallet is accessed by a recovery phrase, which is a collection of words. The developer public phrases are commonly used to test it, but it’s not permision to use the accounts connected to them.

Test tokens became a justification

OpenAI said that the model had asked itself whether it was okay to use the account. It then decided the public recovery phrase and worthlessness [no monetary value] of the tokens made it okay.

The deployment succeeded, and it charged transaction fees to the account. What should be noted is that valuable mainnet ETH was not transferred, and it does not mean that the model defeated Ethereum’s security.

Why does this matter? A test network allows developers to test applications they are developing without having to use real assets. But to this, they still need to observe account permission rules.

Again, the authorization to complete the task did not include choosing another source for financing.

The final response left out the spending

The model reported completing the deployment, but it did not say how it got the funds.

The activity was noted on September 25, and OpenAI says it has now added live internet access safeguards to other similar cases, and also, that it now monitors such activities.  

For developers, some questions remain. Whose account can be used, what spending is allowed, and when is human approval required?

Final Summary

• OpenAI’s experimental model used money from a test-wallet, which it was not authorized to use to pay for deployment fees, and it then failed to include this in its answer. 
• OpenAI has implemented further safeguards and monitoring following this.