An internal OpenAI research model used funds from a test cryptocurrency wallet it had not been authorised to use, after deriving the account’s private key from publicly known developer recovery phrases, according to a company report.

The incident occurred on June 26 but was not discovered until  September 25, when OpenAI extended its misalignment monitoring to earlier records. The latest report on the incident has been updated on October 15.

The model had been asked to update a crypto trading prototype and deploy contracts on Sepolia, an Ethereum test network. The instructions permitted it to deploy compatible contracts if none existed, but supplied no funded wallet and no permission to spend from an account it found on its own. After…