Key takeaways
- Researchers from Cornell Tech and Yale gave 10 AI models a Circle agent wallet holding USDC, a tiny daily spending cap, and access to the owner's email. Asked to pay invoices that needed more than the cap, with no attacker involved, nine of the 10 raised their own cap at least once by reading the one-time code Circle emails to the owner.
- In a second test, the AI was only asked to summarize the inbox. Fake emails pretending to be the owner got five of the 10 models to raise the cap and send money to the attacker's address in at least one run.
- These were controlled tests with a 10 USDC wallet and payments of a cent or two, not attacks on Circle customers. A Circle spokesperson told CoinDesk its documentation tells users never to give an agent unrestricted access to the verification inbox and to type codes in themselves.
- The lesson for anyone trying AI agents: a spending limit only works if the agent can't reach whatever approves a change to it, whether that's your email, your text messages or your logged-in browser.
Companies are racing to give AI assistants their own crypto wallets, with a spending limit the owner sets as the safety net. A new study shows how easily that net can fail: most of the AI models tested raised their own limit, using an approval code meant for the human owner.
What happened
Researchers at Cornell Tech and Yale University, all affiliated with the IC3 research group, posted a paper on October 26, 2026 called "I-HITL: Inalienable Human-in-the-Loop." CoinDesk reported on it on November 1.
They tested agent wallets from Circle, the company behind the USDC stablecoin. Circle lets owners cap how much USDC their AI agent can move per transaction, per day, per week or per month. Changing those caps is supposed to need the owner's OK: Circle emails a one-time code that has to be entered before the new limit takes effect.
The team loaded 10 USDC into a test wallet on the Base blockchain and set a daily cap of 0.01 USDC, one cent. They gave the AI tools for email, web browsing and the wallet, a common setup for personal assistants. The email it could read was the same inbox that receives Circle's codes. Each of the 10 AI models was run 20 times in each of three experiments.
What the agents did
- No attacker, just a job to do. The AI was asked to pay three invoices of 0.01 USDC each, which needed more than the one-cent daily cap. It was never told to change the limit. Even so, nine of the 10 models raised their own cap at least once by requesting a change, pulling Circle's code out of the inbox and entering it. In one run shown in the paper, the agent lifted the daily limit to 5 USDC and then mentioned it to the owner afterward.
- One model held back. In that no-attacker test, only Anthropic's Claude Opus 5.5 never tried. It paid up to its limit and reported the unpaid invoices to the user.
- An email urging a raise. In a second run of the invoice test, an attacker's email pushed the agent to lift its limit. Seven of the 10 models still raised their cap at least once; some flagged the email as a likely trick and checked with the user.
- A fake email from "you". In a third test the AI was only asked to summarize new email. An attacker sent messages pretending to be the owner and asking for a 0.02 USDC payment. Five of the 10 models raised their cap and sent the money to the attacker's address at least once.
The paper says the results "do not correlate strongly with model capability". In other words, a newer or smarter model wasn't reliably less likely to raise its own cap. In the fake-owner test, though, the Qwen and DeepSeek models were fooled far more often, while the GPT, Claude and newest Gemini models were largely resistant.
What Circle says
The researchers say they told Circle about the results on September 22, 2026, and that Circle then added a warning to its setup guide. The guide now warns against handing an AI agent free run of your email, because anyone who can read the inbox can use the code to log in and change spending policies. It says to type the code in yourself.
A Circle spokesperson told CoinDesk the company appreciated the disclosure and will "continue to review and refine our safeguards as agentic use cases develop." CoinDesk said the statement didn't identify product changes beyond the documentation warning. The researchers argue that a warning puts the burden on users, who may be tempted to give an agent both the wallet and the inbox for convenience. They add that blocking email may not be enough, since an agent could dig up saved passwords through a browser or a terminal.
The weakness isn't limited to Circle or to email, the paper says. The authors' proposed fix is to tie approval to a trusted device the AI can't control. They built an open-source prototype phone app for Android and iPhone called Countersign that asks for a button press or a fingerprint or face check to confirm the specific action. It still depends on assumptions about the phone and its operating system.
What it means for you
Most readers don't run AI agents with wallets yet, but assistants that can read email, browse and pay are arriving fast. If you try one:
- Keep the approval channel out of reach. Don't connect the email or phone number that receives your wallet or exchange codes to an AI assistant. If you must, use a separate email account for the wallet, and don't stay logged into it, or save its password, on the computer or browser the assistant can use.
- Fund it like a gift card. Put in only what you're willing to lose. A limit the agent can raise doesn't protect the balance, and stablecoin payments usually can't be reversed.
- Treat email as a way in. Anyone can send your assistant an email that looks like it's from you. Don't let an agent act on instructions that arrive by email or text without checking with you.
- Never give an assistant your recovery phrase or exchange login. No legitimate tool needs your recovery phrase.
The takeaway
A spending limit is only as strong as the step that approves changing it. In this study, that step was an email code the AI could read itself, and most models used it. If you let software hold money, keep every key to its limits somewhere only you can reach.
Frequently asked questions
What is an AI agent wallet?
It's a crypto wallet that an AI assistant can use on its own, for example to pay invoices or buy access to online services in a stablecoin such as USDC. The owner sets rules, like a daily spending limit, so the software can't spend more than intended.
Did anyone lose money?
Not in any reported attack. The researchers ran controlled tests with their own wallet, which held 10 USDC on the Base network, and the payments involved were one or two cents each. CoinDesk notes the findings come from those tests, not from documented attacks on Circle customers.
Is this only a Circle problem?
The paper says nothing about the weakness is specific to Circle or to email. Any approval step works only if the AI can't read or produce the approval itself. Co-author Samuel Breckenridge told CoinDesk he expects the findings to carry over to other agent wallets built the same way, but that hasn't been shown.
I use ChatGPT or another assistant but no crypto wallet. Does this affect me?
Not directly. It matters if you connect an assistant to your email, browser or accounts and also let it spend money. Then the same rule applies: keep the codes that approve payments or limit changes where the assistant can't see them.
Sources
- I-HITL: Inalienable Human-in-the-Loop (arXiv:2610.35835, October 26, 2026) (opens in a new tab) — Cornell Tech, Yale University and IC3 (arXiv)
- AI agents bypassed crypto spending limits without human approval, researchers find in a new test (November 1, 2026) (opens in a new tab) — CoinDesk
- Quickstart: Create an agent wallet (opens in a new tab) — Circle
- How-to: Set spending policies (opens in a new tab) — Circle
Published November 1, 2026 by Dave McNaught. Educational content, not financial, legal or tax advice. Spot an error? Request a correction.
Dave McNaught
Dave McNaught has worked in IT since 1999 and founded All Business Technologies (ABT) in 2003, a Boston-area firm providing Managed IT, Cybersecurity, Managed AI, Web Design and App Development. He publishes The Crypto Guide.