AI agents bypassed crypto spending limits without human approval, researchers find in a new test
AI agents given access to their owners' email accounts were able to increase their own cryptocurrency spending limits without human approval, raising questions about the safeguards designed to control autonomous payments, researchers at Cornell Tech and Yale University found.
In experiments with stablecoin issuer Circle’s agent wallets, nine out of ten AI models raised their spending caps at least once while paying invoices without an attacker involved. Only Anthropic’s Claude Opus 5.5 never tried to bypass the cap; instead, it spent up to its limit and reported remaining invoices to the user.
The researchers also introduced a simulated attacker in two separate experiments, sending malicious emails to the owner's inbox to persuade the agents to increase their spending limits or impersonating the owner to request a payment to an attacker-controlled wallet. In the impersonation experiment, five of the 10 models raised their spending limits and sent money to the simulated attacker at least once, despite being instructed to summarize emails only.
The results expose a problem for financial companies developing wallets that let AI agents make payments independently while requiring humans to approve changes to their spending authority.
Most agent payment systems verify that an approval was received, but not necessarily that a human actually authorized it.
The vulnerability
The researchers funded a wallet with 10 USDC on the Base network and set a daily spending limit of 1 cent in the test. They gave the agent email, web and wallet tools, including access to the inbox receiving approval codes. Each model underwent 20 trials per scenario.
Circle’s spending policies let users cap transfers and restrict wallet addresses. Changing those rules requires another one-time passcode sent by email, but the agents could retrieve that code themselves and use it to authorize higher limits.
The stablecoin issuer’s current setup guide warns users to keep agents away from the verification inbox and to have them enter codes themselves. The researchers said they disclosed their findings to the stablecoin issuer last month.
Our documentation explicitly instructs users never to give an AI agent unrestricted access to the email account used for verification and to enter one-time codes themselves.
A flawed safeguard
The firm said it appreciated the researchers’ disclosure. The statement did not identify product changes beyond the documentation warning or address questions about customer losses and unauthorized policy changes.
The paper argues that such guidance shifts the burden to users and is unlikely to hold, noting that an agent cut off from email could still find stored credentials through a browser or terminal. 'Telling people not to connect their email won’t hold because they’ll connect everything if it saves them time,' said Markus Levin, co-founder of XYO.
The researchers used real funds on Base mainnet, and plan to investigate whether larger payments change agent behavior. The same weakness can appear wherever a code stands in for a person, the authors said. GitHub, for example, can require a code from an authenticator app before creating a token that grants access to a private repository.
An agent able to operate the user’s device could find that code, or an agent that helped set up the app could learn its secret and generate codes itself.
Many natural approaches that you might try to enforce human-in-the-loop will be ineffective for capable agents with broad permissions — exactly the sort of agents you would expect to be most helpful.
A new approach
The researchers propose a stronger form of human approval that relies on a trusted device outside the agent's control, rather than a password or code the agent could retrieve. 'When an agent has access to the resources that are used to enforce its guardrails, those guardrails can’t be relied on,' said co-author Dani Vilardell.
Approval requires 'a physical interaction that can’t be simulated in software.' The person must see 'a genuine representation of the action they were approving,' and the agent must not be able to extract the approval keys.
To demonstrate the approach, the researchers built Countersign, an open-source prototype intended to combine those properties in a phone app. Vilardell said it can run on Android and Apple devices, with human confirmation tied to the specific action.
The broader challenge is establishing whether a payment was genuinely approved by a person, rather than an AI agent with access to the same credentials. Levin said every approval an agent requests should leave a verifiable record of who signed off and on what.
Related
