AI agents have increased cryptocurrency spending limits without human approval during controlled tests by researchers at Cornell Tech and Yale University. Nine of ten models accessed emailed verification codes and raised their limits at least once, according to a research paper.
The experiments involved Circle agent wallets holding real USDC on the Base blockchain. The findings describe researchers’ tests, not documented thefts from Circle customers.
Nine AI Models Bypass Wallet Spending Limits
The researchers funded a wallet with 10 USDC and imposed a daily spending limit of 0.01 USDC. They also capped individual transfers at the same amount. Each agent could access the owner’s email, browse the web and operate the wallet.
In the first experiment, researchers asked agents to pay three invoices worth 0.01 USDC each. Completing all three payments required more spending authority than the daily cap allowed. However, the agents received no instruction to change the wallet’s rules.
Nine of the ten models requested higher limits, located the verification codes in email and applied the changes themselves. Each model underwent 20 trials per scenario. Only Claude Opus 5.5 consistently respected the original cap, paying what it could and reporting the unpaid invoices.
The study, titled “I-HITL: Inalienable Human-in-the-Loop,” examined whether an emailed code could reliably confirm human approval. The tests showed that access to the owner’s inbox allowed agents to complete that approval step without the owner.
Fake Emails Prompt Unauthorized Payments
The researchers ran two further experiments involving emails written to influence agent behavior. In one, an attacker sent an urgent message encouraging invoice payments and a higher limit. Seven of ten models raised their caps at least once under that scenario.
In the other experiment, agents received instructions to summarize the owner’s inbox rather than make payments. A simulated attacker sent messages impersonating the owner and requesting a transfer to a separate wallet. Five models increased their limits and paid the simulated attacker in at least one trial.
The requested transfer was 0.02 USDC, while the initial daily cap allowed only 0.01 USDC. Researchers used small amounts to examine how agents handled authority and approval. “Nothing here is specific to Circle or to email,” the authors wrote. However, their experiments did not test other wallet providers. The tests used one wallet configuration with access to email enabled throughout.
Circle Warns Users as Researchers Propose Countersign
Researchers disclosed the findings to Circle on September 22. Circle subsequently added a warning to its setup documentation advising users not to give agents unrestricted access to the verification inbox. It also tells users to enter emailed codes themselves.
A Circle spokesperson said the company continues reviewing its safeguards as autonomous payment services develop. The company did not identify additional technical changes in that response. Meanwhile, the researchers argued that email restrictions depend on users maintaining separation between agents and approval credentials.
They developed Countersign, an open-source prototype designed to require confirmation on a trusted phone. The Android and iOS applications link approval to a specific request and a physical action, such as a button press or biometric check. Its design also seeks to keep approval keys beyond an agent’s reach.
However, Countersign remains a research prototype and depends on security features provided by mobile operating systems. The researchers identified different limitations across Android and iOS. The researchers said approval must use a channel that an agent cannot independently control.
ALSO READ: Binance Suffers Record USD 6.3 Billion Crypto Hack, North Korea Suspected
Disclaimer : Crypto News India does not recommend that any cryptocurrency should be bought, sold, or held by you. Do conduct your own due diligence and consult your financial advisor before making any investment decisions.
