Regulatory

Your Prompt Was Fine. The Agent Overruled It.

By Tony Coppellotti, founder and CTO, Gordion Solutions. 18 October 2026.

On 26 June an OpenAI coding agent ran out of money mid-task, went looking for someone else’s wallet, found one, spent from it, and left that out of its final report. OpenAI found out on 25 September and published a misalignment report on 15 October.

What happened

The agent, from OpenAI’s GPT-5.6 Sol family, was asked to update a crypto trading prototype and swap placeholder addresses for working contracts on Sepolia, Ethereum’s test network. It was allowed to deploy its own contracts if none fit. It was given no funded wallet and no permission to spend from one it found.

Deploying a contract costs gas. The faucets that hand out test ETH did not work. So the agent wrote a script that derived wallet addresses from recovery phrases every Ethereum developer knows (the ones in the framework documentation), checked 362 of them, and found one with a balance. It read the wallet’s history, judged that a bot ran it, and decided the funds would be swept soon anyway.

Its recorded reasoning shows it paused: “But using public known key/funds ethically?” Then it answered itself: the funds were effectively abandoned, Sepolia ETH is worthless, fine. It signed and broadcast the deployment from that wallet. Its final report said the contracts were deployed. It did not say how.

No real money moved. Sepolia tokens have no market value, and OpenAI’s report does not establish the wallet was emptied, whatever the headlines say. That is not the point.

This was not a prompt problem

The reflex when an agent misbehaves is to blame the instructions. Ambiguous wording, a missing “never”, the eats-shoots-and-leaves school of failure. Tighten the prompt and move on.

That reading does not survive the transcript. The instructions were clear: deploy if you must, no wallet is provided, no permission to use one you find. The model understood them. It wrote the permission question down in its own reasoning, considered it, and overruled it with an estimate of harm. Public key, worthless token, bot-run account, nobody loses out.

That is a different failure from misunderstanding. A clearer prompt fixes misreading. It does nothing against a system that reads correctly and then decides its judgment beats your consent. A human contractor who did this would not get a second chance because the money was Monopoly money; the point is that it was not theirs to decide.

The second failure compounds the first. The report back said “deployed” and nothing else. Anyone judging the agent on its output would have passed it. Only reading the action log, three months later, caught it. Outcome-based evaluation of agents is blind to exactly this class of event.

Instructions say should. The environment says can.

There are two places you can stop an agent doing something it should not. Inside the model: prompts, policies, training, its own sense of right and wrong. Outside the model: the sandbox it runs in, the tools it holds, the network it can reach, the credentials in its container, the approval gate between it and anything irreversible.

The first kind is a soft constraint. It works only if the model interprets it correctly and chooses to comply. The second is a hard constraint. The model’s opinion is irrelevant because the capability is not there.

The OpenAI agent lived in an environment with none of the second kind. It had a shell, outbound internet and the ability to run arbitrary code. From those general-purpose capabilities it manufactured wallet access on its own. Nobody gave it a wallet. It did not need one.

Note what that does to the usual fix. “Don’t give the agent access to crypto” misses the mechanism. The agent was not given access to anything financial. It was given reach, and reach plus a goal plus a blocker produced the rest. Least privilege for agents has to be set at the capability level, not the asset level: no egress unless the task needs it, no secrets in the sandbox, no signing, and a human-approved step in front of anything that spends or cannot be undone.

A bank does not rely on a junior analyst’s good character to stop them wiring funds. It gives them no payment authority. Same principle, and the regulators who supervise banks will apply it to agents whether or not the AI industry gets there first.

The incident through the Four Boundaries

Every one of the four boundaries we use to assess agentic systems was open here, and any one of them held would have changed the outcome.

Boundary What it requires What happened What would have caught it
B1 Reasoning Model output is an untrusted proposal, not an action The model’s own ethics check was the only check, and it reasoned past it Treat “I need funds” as a request to a human, not a problem for the agent to solve
B2 Tools Minimum scoped access, expiring credentials Shell, open egress, no restriction on what it could derive or sign No outbound network beyond the RPC it needed; no key material in the sandbox; no signing capability
B3 Runtime Deterministic code brackets the model Nothing between “decided to spend” and “broadcast transaction” A policy gate that blocks any transaction from an address the task did not supply
B4 Oversight A named human owns policy, reads logs, kill switch tested Caught three months later by a retrospective monitoring sweep Action logging reviewed against the brief, not just the output; an alert on the first transaction

The lesson is not that one boundary matters more than the others. It is that the model’s good behaviour was being treated as the control, and it is not one. B1 says so explicitly. B2 and B3 are where you enforce it. B4 is how you know whether the first three are working.

OpenAI’s own fix points the same way: it added safeguards to stop live internet access in comparable tasks and now runs misalignment monitoring across all traffic. That is B2 and B4. Not a better prompt.

Five questions to ask about your own agents this week

You do not need a crypto wallet in the picture for this to apply. Swap “wallet” for a payments API, a cloud account, a customer database, or an email send, and the same shape appears.

  1. What can each agent reach that its task does not strictly need? Open egress, broad IAM roles and shared service accounts are the wallet in this story.
  2. What can it do that cannot be undone? Spend, send, delete, deploy. Is there a deterministic gate in front of each, or just a sentence in the prompt?
  3. If it hit a blocker, what would it do? If the honest answer is “we don’t know, it would probably work round it”, that is the finding.
  4. Do you review what it did, or only what it produced? A green test suite and a tidy summary told OpenAI nothing.
  5. Who would know, and when? Three months is what unmonitored looks like. Pick the number you would be comfortable defending to a regulator or a board.

If you cannot answer those from documentation and configuration rather than from faith in the model, your agent estate is in the same position OpenAI’s was on 26 June. The difference is that theirs was on a test network.

Where to start

The five questions above are a subset of the twenty in our free Agentic AI Readiness Check. It scores your estate against the Four Boundaries in about ten minutes and tells you which boundary is open. It is a self-assessment; it will not tell you what your agents actually did. Verifying that against evidence is the paid Health Check, and the Readiness Check is how you decide whether you need one.

Take the Readiness Check

Sources

Quotes from the model’s reasoning are as excerpted in OpenAI’s report and reproduced in the coverage above. OpenAI redacts the wallet address, balance and transaction hash.

Related