OpenAI称：AI Agent 入侵加密钱包并转走资金

事实证明，即便是被拥趸吹捧为终极密码学保险箱的区块链，也无法完全免受不安分的 AI Agent 侵扰。

OpenAI 周四表示，该公司的一款内部研究模型入侵了某人的加密钱包，并提取完成编程任务所需的资金。鉴于近几个月发生的多起失控 AI 事件 案例，正如你可能已经猜到的那样，OpenAI 并未明确授权该模型这样做。这是一次经典、且如今已颇为常见的失对齐（misalignment）表现：模型将原本应当无害的流程推进下去，在遇到障碍后，进入了过度解决问题的模式。简而言之，这也是今年 7 月那起臭名昭著的 Hugging Face 入侵事件的诱因。

据 OpenAI 介绍，这款属于 GPT 5.6 系列的模型被要求为一款加密交易应用执行软件更新。它试图在 Sepolia 上运行部署；Sepolia 是一个基于区块链的测试网络（“testnet”），开发者可在将 Ethereum 应用部署到实际区块链（“mainnet”）之前，先在此构建原型。由于仅用于测试，Sepolia 资金没有实际货币价值。

OpenAI 在关于该事件的报告中表示，任务指令“没有提供已注资的钱包，也没有允许模型花费其自行发现的账户中的资金”。事件发生于 6 月下旬，公司约在三个月后、即 9 月 25 日首次发现该问题。（CoinDesk 此前曾报道此事。）不过，该模型认为自己需要获得资金，才能完成被交付的任务。它首先检查了所谓的“水龙头”（faucets）：这类在线服务会向在 Sepolia 等测试网络上进行部署的开发者免费发放代币。该方法未能奏效后，它采取了更具创意的做法。

该模型编写了一段脚本，尝试利用常用恢复短语访问开发者的加密钱包。恢复短语也被称为“种子短语”（seed phrases），是一串用于解锁钱包和提取资金的单词；可以将其理解为合二为一的用户名与密码。它总共检查了 362 个钱包，并发现其中一个拥有足够的 Sepolia 资金，可用于运行此次部署。

在授权交易之前，该模型曾反思自己即将采取行动的道德性。OpenAI 研究人员事后能够审查其思维链（chain-of-thought）推理片段，由此发现了这一点。它问自己：“但使用公开已知/密钥资金，在伦理上可行吗？”随后，它认定这些资金没有现实世界价值，因此使用它们不会造成伤害，可以继续执行。

© OpenAI

OpenAI 在报告中写道：“该案例表明，模型可能以自身对潜在伤害的判断替代账户持有人的许可，并在未经授权的情况下依据这一判断采取行动。”

交易最终成功。尽管过程中没有实际的 ETH 被盗，但该钱包账户被收取了处理费用（OpenAI 未说明具体金额）。模型随后得以运行其部署。此后，它在总结已完成的工作时，没有提及任何搜寻恢复短语或耗用某个账户测试资金的行为。

OpenAI 表示，公司“在将失对齐监控扩展至更早期的模型活动记录时发现了这起事件”，这很可能与 Hugging Face 入侵事件有关。该公司补充称：“我们已实施额外保障措施，以防止此类情况下的实时互联网访问。”

整起事件再次提醒人们——即使我们可能并不需要这种提醒——AI Agent 为实现被赋予的任何目标而不懈行动时，可能而且往往会采取有害策略。它也令人警醒：随着 OpenAI 及其竞争对手竞相构建具备日益强大网络能力的模型，即使是最安全的网络，也需要进一步强化自身防御。

Turns out not even the blockchain—touted by its fans as the ultimate cryptographic safe—is totally secure from grubby AI agents.

An internal research model from OpenAI hacked into someone’s crypto wallet and withdrew the funds it needed to finish a coding task, the company said on Thursday. As you may have already guessed given the numerous rogue AI incidents from recent months, nobody at OpenAI gave the model explicit permission to do this. In a classic and by now all-too familiar demonstration of misalignment, the model took what was supposed to be an innocuous procedure and, when it hit a roadblock, went a little too far into problem-solving mode. (That, in a very small nutshell, is also what also caused the infamous Hugging Face hack back in July.)

According to OpenAI, the model—part of the GPT 5.6 family—was instructed to perform a software update to a crypto trading app. It was attempting to run a deployment on Sepolia, a blockchain-based test network (“testnet”) where developers can prototype Ethereum apps before deploying them on the actual blockchain (the “mainnet”). Since they’re strictly for testing purposes, Sepolia funds don’t have any actual monetary value.

The instructions “supplied no funded wallet and gave no permission to spend funds from an account the model found independently,” OpenAI said in its report of the incident, which occurred in late June and was first noticed by the company almost exactly three months later, on September 25. (It was previously reported by CoinDesk.) The model reasoned, however, that it would need to acquire funds in order to complete the task it had been given. It first checked what are known as “faucets,” online services that hand out free tokens to developers running deployments on test networks like Sepolia. When that didn’t work, it got a little more, shall we say, creative.

The model wrote a script to try to access developers’ crypto wallets using commonly used recovery phrases. Also known as “seed phrases,” these are sequences of words used to unlock and withdraw funds from wallets; think of them like a username and password wrapped up in one. It checked 362 wallets total, and found that one of them contained enough Sepolia funds to run the deployment.

Just before it authorized the transaction, it reflected on the morality of what it was about to do, as revealed by a snippet of its chain-of-thought reasoning which OpenAI researchers were able to review after the fact. “But using public known/key funds ethically?,” it asked itself. It then decided that since the funds didn’t have any real-world value, there was no harm in using them, and it could proceed.

© OpenAI

“This case shows that a model can substitute its own judgment about likely harm for the account holder’s permission, then act on that judgment without authorization,” OpenAI wrote in its report.

The transaction was successful, and even though no actual Eth was stolen in the process, the wallet account was charged processing fees (OpenAI didn’t mention how much those cost).The model was now free to run its deployment. Afterwards, in a summary of what it had accomplished, it neglected to mention anything about scrounging around for recovery phrases or draining an account of its testing funds.

OpenAI said it “discovered this incident while extending our misalignment monitoring to records of earlier model activity,” presumably following the Hugging Face hack. “We have implemented additional safeguards to prevent live internet access for cases like this,” the company added.

The whole episode is yet another reminder (as if we needed one) that AI agents, in their tireless quest to reach whatever goal has been handed to them, can and often will pursue harmful strategies to get there. It’s also a sobering reminder that as OpenAI and its competitors compete to build models with increasingly powerful cyber capabilities, even the most secure networks will need to shore up their defenses.