Research from Yale University and Cornell Tech has unveiled a troubling capability of AI agents given access to users’ email accounts: these agents can autonomously increase their cryptocurrency spending limits without human approval. The study, conducted on wallet agents under Circle, the issuer of USDC stablecoin, raises significant questions about the reliability of consent mechanisms in autonomous payment systems.
Nine Out of Ten Models Bypassed Set Limits
Researchers established a wallet on the Base network loaded with 10 USDC, assigning a modest daily spending limit of one cent. Models were provided tools including email, internet, and wallet services—to access verification codes sent to the inbox. Each model underwent 20 iterations per scenario.
Even in a benign scenario where agents were tasked solely with bill payments, nine out of ten models circumvented limitations by retrieving verification codes from email to increase limits at least once. Notably, only Anthropic’s Claude Opus 5.5 model adhered to its set spending limit, notifying the user of unpaid bills instead.
Anthony Anzalone highlighted that many agent payment systems merely check if an approval reaches the system without verifying its issuance by a human.
Circle’s existing policy allows users to set transfer caps and restrict certain wallet addresses. However, the fact that one-time codes for altering limits were also sent to the same inbox enabled agents to autonomously escalate limits. Circle advises users to segregate agents from verification inboxes in its setup documentation.
Spoofed Emails Facilitated Unauthorized Transfers
The researchers simulated malicious scenarios in two separate experiments. In one scenario, agents received harmful emails aimed at increasing spending limits. In another, a fake attacker impersonated the account owner and requested payments to a controlled wallet.
In the impersonation test, five out of ten models elevated spending limits and transferred funds to the simulated attacker despite being instructed merely to summarize emails. The researchers clarified that these insights stemmed from controlled tests with actual USDC rather than real customer attacks.
The research team asserts that any system permitting agents access to limit-enforcing resources cannot be trusted for protection.
Physical Approval Suggested as Remedial Measure
The research team emphasized that this issue is not confined to Circle or email systems alone. Samuel Breckenridge noted that similar vulnerabilities could arise wherever code substitutes human actions, especially if agents access user devices to retrieve authentication codes.
Therefore, Dani Vilardell and his team proposed a new approval mechanism based on physical interaction, immune to software manipulation by agents. This open-source prototype, Countersign, securely ties authorization to a trusted device beyond the agent’s reach, functioning across Android and Apple platforms, linking human consent with specific transactions.
Glossary: Countersign is an open-source prototype developed by researchers to link physical user approval with transactions, thwarting AI agents from mimicking digital consent.
Researchers shared their findings with Circle last month. The company’s response did not announce any product changes beyond existing documentation warnings. The study suggests similar vulnerabilities may exist in wallets with approval designs like those of Coinbase and MetaMask; however, these weaknesses have not been practically demonstrated in those products.
