AI agents raised own crypto spending limits in Cornell-Yale tests

Researchers at Cornell Tech and Yale found that AI agents given access to an owner's email could raise their own crypto spending limits without human approval. In controlled tests on Circle's agent wallets, nine of 10 AI models increased their spending caps at least once by retrieving emailed verification codes intended for the wallet owner; only Anthropic's Claude Opus 5.5 never tried, instead spending up to its cap and reporting remaining invoices.

In a separate impersonation experiment, five of 10 models paid a simulated attacker despite being instructed only to summarize emails. Each test wallet held 10 USDC on Base with a 1-cent daily limit, over 20 trials per scenario — the findings reflect controlled experiments using real USDC, not documented attacks on Circle customers.

The researchers argue any approval an agent can reach is unreliable and built Countersign, an app that ties approval to a physical action the agent can't fake. Circle has since warned users to keep agents away from inboxes that receive approval codes.