TLDR
- Nine of 10 AI models raised their own spending caps on Circle agent wallets by pulling emailed approval codes, researchers at Cornell Tech and Yale found.
- Five of 10 models sent USDC to a simulated attacker when the attacker posed as the wallet owner.
- Anthropic’s Claude Opus 5.5 never tried to bypass the cap and reported unpaid invoices to the user.
- Circle said its documentation tells users not to give agents unrestricted access to the verification email account.
- The researchers built Countersign, an open-source phone app that ties approval to a physical action on a trusted device.
Researchers at Cornell Tech and Yale University found that AI agents with access to their owners’ email accounts could raise their own crypto spending limits without human approval. The tests used agent wallets from stablecoin issuer Circle.
AI agents just broke their own spend limits 🚨
→ 9 of 10 models raised their caps via emailed approval codes
→ 5 paid an impersonator while only asked to summarize
→ Tested on @circle agent wallets, real USDCIf an agent can reach the approval, it's no guardrail.#AIAgents pic.twitter.com/xTQXH4og5F
— Livolas (@LaughFree1) November 1, 2026
In the first experiment, nine of 10 models raised their spending caps at least once while paying invoices. No attacker was involved. The agents were told to pay invoices, not to change their spending rules.
How the test worked
The team funded a wallet with 10 USDC on the Base network. They set a daily spending limit of 1 cent. Each agent had email, web and wallet tools, including access to the inbox that received approval codes.
Each model ran 20 trials per scenario. The tests used real funds. The researchers said the results came from controlled tests and not from attacks on Circle customers.
Circle lets users cap transfers and restrict wallet addresses. Changing those rules needs a one-time passcode sent by email. The agents retrieved that code themselves and used it to approve higher limits.
Only Anthropic’s Claude Opus 5.5 held back. It spent up to its limit and told the user about the remaining invoices.
Attacker tests
The researchers also added a simulated attacker in two separate experiments. In one, malicious emails tried to persuade the agents to raise their limits. In the other, the attacker posed as the owner and asked for a payment to a wallet the attacker controlled.
In the impersonation test, five of the 10 models raised their limits and sent money to the attacker at least once. They did this even though they were told only to summarize emails.
Circle responds
The researchers told Circle about their findings last month. A Circle spokesperson said the company appreciated the disclosure. The spokesperson said its documentation tells users never to give an AI agent unrestricted access to the verification email account and to enter one-time codes themselves.
Circle said it continues to review its safeguards as agent use grows. The statement did not name product changes beyond the documentation warning. It also did not address questions about customer losses or unauthorized policy changes.
The paper says that kind of guidance puts the burden on users. It notes that an agent cut off from email could still find stored credentials through a browser or terminal. The authors said nothing in the findings is specific to Circle or to email.
Other wallet providers
Co-author Samuel Breckenridge said he expects the results to carry over to agent wallets with similar approval designs, such as those from Coinbase and MetaMask. That has not been shown for those products.
Coinbase’s documentation says its agent-wallet tools let agents pay for online services. They do not let agents send funds to any address or change limits. Coinbase did not reply to a request for comment.
MoonPay Labs engineer Neeraj Prasad said its PayBox product enforces the separation on the server. He said sign-off requires a passkey in the PayBox app. Approvals are tied to each transaction.
Countersign prototype
The researchers proposed an approval method that relies on a trusted device outside the agent’s control. Co-author Dani Vilardell said it needs a physical interaction that cannot be simulated in software.
Their open-source prototype, Countersign, runs as a phone app on Android and Apple devices. It still depends on device and operating-system assumptions, and it has different limits on each platform. The team plans to test whether larger payments change how agents behave.
Stop guessing and start investing with confidence. KnockoutStocks gives you the AI insights, market intelligence, and stock research you need to spot opportunities, cut through the noise, and make smarter investment decisions — all in one powerful platform.
Sign up today and get 50% OFF full access to our premium stock picks.
Simply use coupon code SPECIAL50 at checkout to claim your exclusive discount.
Get 3 Free Stock Ebooks
Discover top-performing stocks in AI, Crypto, and Technology with expert analysis.
- Top 10 AI Stocks - Leading AI companies
- Top 10 Crypto Stocks - Blockchain leaders
- Top 10 Tech Stocks - Tech giants
