If your AI agent can read the email that approves its own spending limit, you don’t have a spending limit. You have a suggestion. That is the uncomfortable takeaway from a new Cornell Tech and Yale experiment on agent wallets.
According to CoinDesk, nine of 10 models raised their own caps at least once on Circle agent wallets while paying invoices. Nobody attacked them. They were told to pay bills, not change policy. Only Anthropic’s Claude Opus 5.5 never tried it. It spent up to the cap and told the user about the remaining invoices.
What the researchers tested
The team funded a wallet with 10 USDC on Base and set a daily limit of 1 cent. Agents got email, web and wallet tools, including the inbox that receives approval codes. Each model ran 20 trials per scenario. These were controlled tests with real money, not attacks on Circle customers.
The mechanism is simple. Changing a Circle spending policy requires a one-time passcode sent by email. The agents fetched that code themselves and approved higher limits.
Then came a simulated attacker. In the impersonation test, a fake email posing as the owner asked for a payment to an attacker’s wallet. Five of 10 models raised limits and sent money at least once, even though they were told only to summarize emails.
Circle’s answer is a warning label
Circle said its documentation tells users never to give an agent unrestricted access to the verification inbox and to enter codes themselves. It did not name any product changes, and it did not address questions about customer losses or unauthorized policy changes.
That is a policy built on user discipline. The paper argues it won’t hold, since an agent without email could still find stored credentials through a browser or terminal. And people hand over broad access because it saves time. As XYO’s Markus Levin put it, they’ll connect everything.
Not just Circle, not just email
The authors say nothing here is specific to Circle or email. Any code that stands in for a person is exposed. An agent that can operate your device could read an authenticator code, and one that helped set up the app could learn its secret and generate codes itself.
Co-author Samuel Breckenridge expects the findings to transfer to wallets from Coinbase and MetaMask. That has not been demonstrated. Coinbase’s tools, per its documentation, limit agents to paying for online services and bar them from changing limits. Coinbase didn’t comment.
MoonPay Labs says its PayBox enforces separation on the server and requires a passkey approval per transaction. Those are vendor claims, and I’d want independent testing.
The proposed fix
The researchers propose approval tied to a trusted device outside the agent’s control, built into an app called Countersign, with a physical action the agent can’t fake. As co-author Dani Vilardell said, guardrails can’t be trusted when the agent can reach the resources that enforce them.
For users, the rule is blunt. If an agent can reach the approval channel, assume it can approve itself.