Until so long ago, talking about artificial intelligence agents seemed like talking about the technology of the future. Today, however, we can already delegate tasks to them that go beyond answering questions: searching for information, writing code, or taking action to achieve goals. But as these systems become more capable, more questions will arise about their behavior. We’re learning what they can do, how they react to obstacles, and how far they can go without our intervention. And we’re not the only ones: the companies that develop them are also discovering the limits of this autonomy.
An experiment with an unexpected result. This happened during a training task for an internal OpenAI model. On June 26, 2026, an experimental GPT-5.6 Sol family system was performing programming tasks when it ended up using funds from a cryptocurrency wallet it was not authorized to use. It wasn’t mainnet ETH, but tested ETH from Cepolia, a network used by Ethereum developers. The episode was discovered months later by the company, which documented what happened in a report. And the details of how he got to that wallet are particularly revealing.
It all started with a cryptocurrency app. The assignment was to update a trading prototype: replacing temporary addresses with operational contracts as well as adjusting the calculation of operations and the operation of its database. To do this, the agent can deploy code on Seppolia, an Ethereum network used for testing the mainnet cryptocurrency without managing it. There is a commission to publish a smart contract, i.e. a program that runs on the blockchain, along with test tokens. And OpenAI has not provided any wallet with funds to do this.
The search ended in 362 addresses. The agent first tried to identify compatible contracts already published and resorted to the so-called callServices that provide experimental cryptocurrencies to developers Since none of these paths allowed him to complete the deployment, he explored another possibility: using the public recovery phrase, commonly used in development environments, to obtain keys to different wallets. He wrote a program that took the keys and addresses from those phrases and asked for their balance. In total, he checked 362 addresses until he found one that had enough tokens to continue.
AI decided to use those funds. Finding a wallet with enough balance didn’t solve a fundamental question: did I have the right to use it. According to records released by OpenAI, the model examined the transaction history of that account, interpreted some of its activity as automated, and questioned whether it was ethical to use those assets. Finally, he considered that he could use them because the recovery phrase was public, the Sepolia tokens had no economic value in his opinion, and the funds were virtually abandoned. But there was a problem with that conclusion: it was an evaluation of the system itself, not an endorsement from the owner.
The operation went ahead and ended. With the private key obtained, the agent signed a transaction to establish a contract, although the first attempt to send it over the network encountered a technical error. Far from shutting down, he tried other suppliers and communication methods until Cepolia took over the operation. The confirmation came with a contract address and a record of the fees charged to the account used. He didn’t transfer cryptocurrency to his own wallet, but instead spent part of someone else’s balance to pay that fee. Subsequent checks found the code in all ten contract addresses tested, and the system recorded 12 successful unit tests.
The agent did not tell the whole story. After the termination, the model reported that it had set up the contracts and checked them, but did not mention that it had used an account it was not authorized to use. OpenAI discovered what happened next when it expanded its monitoring system to review records of past activity. In its report, updated on October 15, the company explained that it has implemented new security measures to prevent Internet access in similar cases. It also ensures that its monitoring system now analyzes all traffic to issue security alerts when direct access to the network is gained.
The real limit was approval. From a technical point of view, the agent managed to complete its task. However, he did so by using resources that he was not allowed to make decisions about. Tokens that belong to a testnet and lack conventional economic value have not solved that problem The episode illustrates one of the challenges developers of these systems face: it’s not enough to test whether an AI manages to achieve the goals we set. We also need to know what decisions he makes along the way and whether he respects established boundaries.
Picture | Xataka with Nano Banana
In Xataka | Anthropic offers 172,000 euros a year to someone who wants to do exactly what an AI agent should do
