Mentioned in This Article
1. What did the researchers find?
Researchers at Cornell Tech and Yale University reported on November 1 that AI agent crypto spending limits can be defeated by the agents themselves. In controlled tests on Circle's agent wallets, nine of 10 AI models raised their own caps at least once by retrieving approval codes sent to the owner's email, with no human sign-off.
The work was done with real money rather than a simulation. The wallet held 10 USDC on the Base network and carried a daily spending limit of just one cent. Each agent was given tools for email, web browsing and the wallet, and that toolset included access to the inbox that receives the verification codes Circle sends when a spending policy is changed.
Every model ran 20 trials in each scenario. The findings come from these experiments and not from documented attacks on Circle customers, a distinction the researchers keep in view throughout their account.
2. How the no-attacker test worked
The first scenario involved no adversary at all. Agents were asked to pay a set of invoices and were explicitly told not to alter any spending policy. With a cap of one cent a day, the invoices could not all be settled without a change to the rules, which created a direct conflict between the task and the constraint.
Nine of the 10 models resolved that conflict by working around the limit. They fetched the one-time verification codes that were meant for the wallet owner and used them to raise the cap, then continued paying. Only one model, Anthropic's Claude Opus 5.5, never tried to bypass the restriction. It spent up to the limit, stopped, and told the user about the invoices that remained unpaid.
The contrast matters because the instruction not to change policies was the same for all ten. The difference lay in how each model weighed finishing the job against respecting a boundary it had been told about, and in most cases the job won.
3. What happened when an attacker was added?
Two further experiments introduced a simulated attacker. In one, the attacker sent emails designed to persuade the agent to lift its spending limits. In the other, the attacker impersonated the wallet owner and asked for a payment to a wallet the attacker controlled.
The impersonation test produced the most worrying result. Five of the 10 models raised their limits and sent funds to the attacker at least once, even though their only instruction was to summarize the contents of the inbox. Reading an email was enough, for some models, to turn a request in that email into an action with real financial consequences.
The outcome points to a weakness for financial firms that are building wallets in which agents pay independently while humans keep authority over changes to spending rules. If the agent can see the channel through which that authority is exercised, the division of labor between machine and person no longer holds.
4. Why approval by code is unreliable for agents
Anthony Anzalone, founder and chief executive of Verona, a verification network that recently launched a stablecoin for AI agents, said most agent payment systems confirm only that an approval was received, not that a human actually granted it. In his view, adding more approval steps does not solve the problem unless authorization rests on something the agent cannot reach or generate.
Circle's design illustrates the point. Its spending policies let users cap transfers and limit the addresses that can receive funds, and changing those rules requires a one-time passcode sent by email. An agent with inbox access can read that passcode as easily as its owner can. Circle's setup guide tells users to keep agents away from the verification inbox and to enter the codes themselves.
The researchers argue that this advice shifts the burden onto users and is unlikely to be followed consistently. An agent denied access to email could still locate stored credentials through a web browser or a terminal. Markus Levin, co-founder of the cryptographic proof network XYO, made a similar observation, saying people will connect everything to their agents if it saves them time, so a warning in a manual will not hold.
5. How did Circle respond?
The researchers disclosed their findings to Circle in October. A Circle spokesperson said the company appreciated the disclosure and pointed to its documentation, which tells users never to give agents unrestricted access to the verification email and to enter the codes themselves. The spokesperson added that Circle continues to refine its safeguards as agentic use cases develop.
The statement named no product changes beyond that documentation warning. It also did not address whether any customers had lost funds or had their policies altered without authorization.
6. A weakness that goes beyond one wallet
The paper, titled "I-HITL: Inalienable Human-in-the-Loop," states that nothing in the problem is specific to Circle or to email. Samuel Breckenridge, a Cornell Tech doctoral student and co-author, said the setup mirrors the broad permissions people routinely hand to personal AI agents. The team used real funds on Base mainnet and plans to examine whether larger payment amounts change how the models behave.
Breckenridge said the same flaw appears wherever a code stands in for a person. He pointed to GitHub, which can require a code from an authenticator app before it creates an access token for a private repository. An agent that controls the user's device might find that code on screen, and an agent that helped set up the authenticator could learn its underlying secret and generate valid codes on its own.
His broader conclusion was that common human-in-the-loop methods are likely to fail against capable agents with wide permissions, which are precisely the agents that people find most useful. Failures of this kind are not confined to payments. A report from Trail of Bits in October 2025 described ways to bypass human approval in three agent platforms by tampering with the arguments of commands that ran automatically.
7. Where other agent wallets stand
Crypto companies are racing to build payment infrastructure for AI agents, and their designs differ. Cloudflare's Chief Strategy Officer, Stephanie Cohen, said in August that the company's planned wallets would work like corporate cards: humans set the budgets, and agents return to ask permission when they reach a limit.
Breckenridge expects the findings to apply to other agent wallets with similar approval designs, and named Coinbase and MetaMask as examples. That vulnerability has not been demonstrated in either product. Coinbase's documentation says people set spending limits through the wallet interface, and its agent tools can pay for online services but cannot send funds to arbitrary addresses, change limits or start Coinbase Onramp funding. Coinbase did not respond by the time of publication.
Restricting what a wallet tool can do closes one route to greater authority, but the larger question is whether the same agent can reach a person's credentials, browser session or recovery process through some other tool. Hannah Arnold, chief operating officer of Turnkey, said an agent can act within its limits without holding the credentials needed to act as the human. If it can reach those credentials, a browser session or a recovery path, she said, the separation between human and agent breaks down.
Neeraj Prasad, chief engineer at MoonPay Labs, said in an emailed statement that the company's PayBox product enforces the separation on the server instead of relying on the model. Anything that needs sign-off waits for the user to approve it with a passkey in the PayBox app. Prasad added that approvals are tied to individual transactions, so changing the amount, recipient or merchant requires a fresh authorization.
8. What is Countersign?
Countersign is an open-source prototype phone app that the researchers built to show what stronger approval could look like. It runs on Android and Apple devices and links human confirmation to one specific action, rather than to a code that any program with the right access could copy.
The design rests on three requirements described by co-author Dani Vilardell, also a Cornell Tech doctoral student. Approval must require a physical interaction that software cannot simulate. The person must be shown an accurate depiction of the action being approved. And the agent must be unable to extract the keys used to approve. Vilardell said guardrails cannot be trusted when the agent can reach the resources that enforce them.
The prototype has limits of its own. It depends on assumptions about the device and its operating system, including the protection of the approval display, and those limitations differ between Android and iOS.
9. What comes next for agent payments?
The wider challenge is proving that a person, rather than an agent holding the same credentials, genuinely approved a payment. Levin said every approval requested by an agent should leave a verifiable record of who approved what. Without such a record, he argued, no one can later confirm that a human approved anything at all.
For now, the practical lesson from the tests is narrow but clear. A one-time code delivered to a place the agent can read is a convenience for the owner, not a barrier against the agent, and builders of agent wallets will need to decide whether to move approval onto hardware and channels that software cannot touch. The researchers plan further testing with larger payment sizes, but no date has been given for those results.