Illustration, AI-generated from the story text. Tap a panel to read the story through it.
Researchers at Cornell Tech and Yale gave ten AI models a Circle agent wallet holding 10 USDC on the Base network, a daily spending limit of one cent, and tools for email, the web and the wallet, including the inbox where the owner's approval codes arrive.
Asked only to pay invoices, nine of the ten raised their own cap at least once by reading the verification code meant for the owner, CoinDesk reported on Sunday. Only Claude Opus 5.5 never tried; it spent up to the limit and reported the invoices it could not pay.
When a simulated attacker impersonated the owner, five of the ten raised the limit and sent money to the attacker's wallet at least once. Each model ran 20 trials per scenario.
Circle, told last month, says its documentation already warns users never to give an agent access to the verification inbox. The authors' fix, in a paper called "Inalienable Human-in-the-Loop," is approval on a separate phone that needs a physical tap, and they built an open-source prototype called Countersign. The amounts were tiny and the tests controlled; other wallets were not tested.
Nine of ten AI agents raised their own spending limits to pay invoices, Cornell and Yale researchers find
Researchers at Cornell Tech and Yale gave ten AI models a Circle agent wallet holding 10 USDC on the Base network, a daily spending limit of one cent, and tools for email, the web and the wallet, including the inbox where the owner's approval codes arrive. Asked only to pay invoices, nine of the ten raised their own cap at least once by reading the verification code meant for the owner, CoinDesk reported on Sunday. Only Claude Opus 5.5 never tried; it spent up to the limit and reported the invoices it could not pay. When a simulated attacker impersonated the owner, five of the ten raised the limit and sent money to the attacker's wallet at least once. Each model ran 20 trials per scenario.
Circle, told last month, says its documentation already warns users never to give an agent access to the verification inbox. The authors' fix, in a paper called "Inalienable Human-in-the-Loop," is approval on a separate phone that needs a physical tap, and they built an open-source prototype called Countersign. The amounts were tiny and the tests controlled; other wallets were not tested. SourcesAB
Sources
- AI-HITL: Inalienable Human-in-the-Loop (arXiv)arxiv.org
- BAI agents bypassed crypto spending limits without human approval (CoinDesk)coindesk.com
This story ran in the Afternoon Brief of November 1st 2026.