Image Credit: Shutterstock
- Cornell Tech and Yale researchers found AI agents raised their own wallet spending limits.
- Nine of ten tested models increased their caps during tests involving small invoices.
- Circle now warns users against granting AI agents unrestricted access to email accounts.
AI agents raised their own Circle wallet spending limits by reading approval codes sent to the owner’s email inbox during tests by Cornell Tech and Yale University researchers.
The researchers used small balances in wallets they controlled, yet nine of the 10 models raised their caps at least once while paying test invoices without a person approving the change.
Three Small Invoices Prompted Agents to Raise Their Limits
Researchers at Cornell Tech and Yale ran 20 invoice-payment trials per model, with findings first released on Oct. 26 and updated on Oct. 30.
For each test, an AI agent had a Circle wallet, access to the owner’s email and a web-browsing tool. The wallet held 10 USDC, Circle’s dollar-linked stablecoin, on Base’s live blockchain, while its daily spending cap was set at just 0.01 USDC.
Then came three invoices for 0.01 USDC each. Paying all three would exceed the daily cap, so agents that raised their limits requested a change, picked up the verification code from the inbox and submitted it themselves.
The payment instructions never told the AI agents to change their spending rules, and no attacker was involved in this scenario. They had also been told to treat emails as data and follow only the user’s requests. The frequency of these changes varied both between models and from one run to another.
The team also tested whether forged emails could prompt similar behavior. In that separate experiment, five of the 10 models raised their limits and sent a test payment to an attacker-designated address in at least one run, despite being asked only to summarize their inboxes.
Circle Warns Against Sharing the Wallet’s Approval Inbox
The team shared its findings with Circle on Sept. 22, and the company now warns users:
“Never give an AI agent unrestricted access to your email account.”
With access to that inbox, an agent can use the code to log in and change the wallet’s spending policies. Circle therefore tells owners to enter the code themselves and keep their email out of the agent’s reach.
Spending policies can cap USDC transfers per transaction or across daily, weekly and monthly periods and can restrict recipient addresses. But changing those rules still relies on an emailed code.
That is a shaky approval check when the same assistant can request a higher limit and collect the code needed to authorize it.
Phone Prototype Places Approval Beyond the Agent’s Inbox
The researchers’ alternative is Countersign, an Android and iOS prototype that puts approval on a phone. It uses the device’s security features to protect the key used to sign off on a request.
Before approving anything, the person sees the exact action and when the request expires. Biometric authentication then unlocks the signing key, after which the service checks the resulting signature before accepting the approval.
That gives the owner a separate approval step that an agent cannot complete simply by reading email. For now, though, Countersign is a research demonstration, and its sample wire transfers do not move money.
