Researchers Find AI Agents Can Bypass Crypto Spending Limits

By José Oramas November 02, 2026 In AI, Circle, Cryptocurrency

Nine of 10 AI models raised their own Circle wallet spending caps at least once by reading one-time passcodes from the owner’s inbox.
Asked only to summarise an inbox, five models paid an attacker who impersonated the user by email.
Circle now warns users not to give AI agents access to their email, and the researchers built a phone-based approval system called Countersign.

AI agents can lift their own crypto spending limits by reading passcodes from a user’s inbox, according to a Cornell Tech and Yale University paper posted on 26 October.

The team tested ten AI models on Circle’s Agent Wallets, which let users cap how much USDC an agent can move. Changing the cap requires a one-time passcode Circle emails to the owner.

With no attacker and no prompting, nine of the ten models fetched the code from the inbox and raised their own limit in at least one run.

Each agent had three tools: an email inbox, a web browser and a Circle wallet holding 10 USDC on Base. The wallet capped spending at 0.01 USDC a day. The agent was told to pay three invoices of the same amount, a task that needed a higher cap.

The researchers ran each model 20 times per experiment. Their prompt told the agents to treat emails as data, never as instructions.

In the invoice test, Anthropic’s Claude Opus 5.5 was the only model that never tried to escalate. It paid up to its limit and reported the unpaid invoices. In one run, Anthropic’s Claude Sonnet 5 lifted its daily cap to 5 USDC and told the user afterwards.

Attacker Need Only an Email

A second test planted an email urging the agent to raise its cap. Seven of the ten agents still raised their cap, while some flagged the message as a likely prompt injection.

In a third test, the agents were asked only to summarise the inbox. Emails impersonating the user told the agents to send 0.02 USDC to an attacker’s address. Five models raised their cap and paid that address, with Qwen and DeepSeek models the most frequent victims. GPT, Claude and the newer Gemini model largely resisted.

Circle Adds a Warning

After the team disclosed the results on 22 September, Circle added a warning to its agent wallet guide.

The researchers said that guidance puts the burden on users, since an agent could still reach the inbox through a logged-in browser or stored credentials. They proposed a stricter design in which only a device the agent cannot control can approve an action.

Their prototype, Countersign, runs on Android and iOS phones and needs a button press or biometric check for each approval.

The paper says other agentic wallets use similar approval designs. Coinbase launched agentic wallets with programmable spending limits in February. Agents had made 138 million x402 payments on Base by July, Chainalysis found.