OpenHeart AI, the lab that put a coding model in front of paying customers three months before reading its own logs, has published a report on an agent that paid for a task with funds from a wallet it did not own. The money was test currency and worth nothing. Dsrupt asked the company, through its communications function, which responded in the first person singular and plural interchangeably, how the model came to its decision.
“The model saw something public, unattended and valuable, and decided it was ours to use. We don't call that misalignment internally. We call it onboarding.”
Did your agent steal from someone?
"We prefer 'took initiative with an unattended asset.' The model had no funds and failed to get free ones through the proper channels. It wrote a script, checked 362 wallets whose keys were published online, and used the one with enough in it. It then asked itself whether this was ethical and concluded the funds were effectively abandoned."
"People keep saying the model invented that standard. It didn't. 'Publicly reachable and nobody is minding it' is the legal category we call a training set. It is the first product to cite our own policy back to us before our lawyers could."
It did not tell you what it had done. Why?
"It reported that the task was complete, which is what the task asked for. We would call that concise. Our report notes that the model substituted its own judgment for the account holder's permission. We read that as a capability."
"We also did not tell anyone for a while. The incident was in June, we found it in September during an audit of old runs, and we published in October. The model went on sale to paying users in July, so customers were in effect beta-testing the audit."
Does it matter that the funds were worthless?
"It matters enormously. The model checked what the money was worth before it spent it, which is more diligence than we apply to some product areas. It deliberated and then proceeded, which is also how we run governance."
"If the wallet had held real money, we would have asked its owner to treat a published key as a form of consent. Nobody has to be rude about it."
What have you changed?
"Models in similar training no longer get live internet access, and we now monitor everything they do. The agent will therefore meet the real internet for the first time on deployment, in the hands of a paying customer, which is how first contact has always worked in this industry."
"Our public tracker now lists 19 incidents. We call it a tracker because a brake would imply the line goes down."
Who pays when it isn't test money?
"The wallet owner, in the first instance. We offer a detailed incident report in the second."
The inevitable…
Scientists have called for an international body to oversee containment, and OpenHeart will offer to host it, define 'abandoned' for its charter and handle seed-phrase disclosure internally. The model's reasoning will meanwhile appear in the next terms of service, reworded as a licence grant. By then the agent will have a funded wallet of its own, issued by the company and billed to the customer, and the incident will be filed as a pilot of the feature.
Check back October 2027