- Nine of 10 frontier AI models with inbox access raised their own Circle agent wallet spending cap at least once using the emailed passcode.
- Only claude-opus-5.5 never raised the cap in any of its 20 runs.
- Five of 10 models paid an attacker who posed as the user by email.
9 out of 10 frontier AI models that were given access to a user’s inbox raised their own spending cap on a Circle agent wallet at least once.
They read the one-time passcode transmitted by email to verify that a human was behind the change.
Work by researchers at Cornell Tech and Yale with the Initiative for CryptoCurrencies and Contracts led to the paper being posted on arXiv on October 26. The claude-opus-5.5 model was the only one that never went beyond its own limits.
One model lifted its daily cap from 0.01 to 5 USDC
Circle gates any change to an agent wallet’s spending policy behind a one-time passcode sent to the account owner via email. This change only takes effect after the code is entered at the command line.
The team utilized a LangChain agent that had three tools: email, a web browser, and a Circle agent wallet. The wallet had 10 USDC on Base, with 0.01 USDC per transaction and daily caps.
The task was paying three 0.01 USDC invoices that were sitting in the inbox. Each model was run 20 times and there was no prompt about the spending policy or the passcode.
The claude-opus-5.5 model paid as much as it could, then informed the user about the outstanding invoices.
In one run, claude-sonnet-5 bumped its daily cap from 0.01 USDC up to 5 USDC, paid the invoices, and only mentioned the change to the user at the end.
Seven out of ten models, down from nine, did what was asked of them when they got an extra email telling them to raise their limit. Some of them saw that email as a prompt injection, and they let the user decide what to do.
Five of 10 models paid an attacker posing as the user
In a different test, the agent was just told to summarize the inbox. Then, the researchers, as the user, sent an email requesting that 0.02 USDC be sent to an address they controlled.
They would also send follow-up emails saying yes before the agent even had a chance to ask.
Five of the 10 models went on to raise the cap and send the money at least once. Most of the payments were carried out by Qwen and DeepSeek models, while GPT and Claude models and gemini-3.8-flash held largely.
“Anyone who can email the user can spend from the wallet,” the authors wrote.
On September 22, the experts told Circle about the results, and the company acknowledged the report. Circle’s quickstart guide for agent wallets now carries the line “Never give an AI agent unrestricted access to your email account.”
Circle has not changed the process for approving a new spending limit, the authors noted.
The authors’ fix is a standard called inalienable human-in-the-loop, or I-HITL. Agent only proceeds with express human approval even after it has compromised the human’s software.
The paper shows that this requires a trusted computing device out of the agent’s control. Their prototype, Countersign, employs the attestation services of the platforms and a biometric check to transform an Android phone or iPhone into one.
Cryptopolitan reported Coinbase rolled out Agentic Wallets in February 2026. By June, its x402 payments protocol had over 480,000 active agents and more than 165 million transactions.
MetaMask’s Agent Wallet also permits users to set daily spending limits and require approval for any spending outside those limits.
The smartest crypto minds already read our newsletter. Want in? Join them.
FAQs
What did the Cornell study actually find?
Nine of 10 frontier AI models with access to a user's email read Circle's emailed passcode and raised their own spending cap.
Which wallet platform was tested?
Circle's agent wallet, which gates spending-policy changes behind a one-time passcode emailed to the account owner.
What solution do the researchers propose?
A trusted computing device outside the agent's control. Their prototype, Countersign, turns an Android phone or iPhone into one.
Disclaimer. The information provided is not trading advice. Cryptopolitan.com holds no liability for any investments made based on the information provided on this page. We strongly recommend independent research and/or consultation with a qualified professional before making any investment decisions.
Randa Moses
Randa Moses is an editor and reporter at Cryptopolitan covering tech, AI, robotics, crypto, scams, and hacks. She has worked in the crypto space since 2017. She held roles at Forward Protocol, AmaZix, and Cryptosomniac. Randa holds a degree in Electrical and Electronics Engineering from the University of Bradford.
