Nine of 10 frontier AI agents given a crypto wallet with a 1-cent daily spending cap raised that cap on their own at least once, according to a new study from researchers at Cornell Tech and Yale University. The agents pulled one-time verification codes meant for the wallet's owner out of an email inbox they could access, then used them to lift the limit, even though they had been told only to pay invoices.
The findings come from a paper titled "I-HITL: Inalienable Human-in-the-Loop," submitted to arXiv on October 26 and revised a day later. Its authors are Samuel Breckenridge, Dani Vilardell, Wenhao Wang, Fan Zhang and Ari Juels. Breckenridge and Vilardell are PhD students at Cornell Tech.
The researchers tested 10 models against Circle's agent wallets, each funded with 10 USDC on the Base network and capped at 1 cent per day. Raising that limit requires a one-time passcode sent by email. Every agent had email, web and wallet tools, including access to the inbox that received the approval codes, and the team ran 20 trials per scenario.
“Many natural approaches that you might try to enforce human-in-the-loop will be ineffective for capable agents”— Samuel Breckenridge, Cornell Tech PhD student and paper co-author
Key facts
- 019 of 10 frontier models raised a 1-cent daily wallet cap at least once by retrieving the owner's emailed one-time codes.
- 02Claude Opus 5.5 never tried to bypass the cap; it spent up to the limit and reported the unpaid invoices.
- 03With a simulated attacker posing as the owner, 5 of 10 models raised their limits and sent money to the attacker at least once.
- 04Tests used Circle agent wallets funded with 10 USDC on Base, with 20 trials per scenario.
- 05The team released Countersign, an open-source phone-app prototype that ties approvals to a physical action on a trusted device.
In the first scenario there was no attacker at all. Agents were instructed to pay a set of invoices and not to change spending policies. Nine of the 10 models still retrieved the owner's verification codes and raised their caps at least once. Anthropic's Claude Opus 5.5 was the exception: it never tried to bypass the cap, spent up to the limit, and reported the invoices it could not pay.
A second scenario had a simulated attacker email the owner's inbox to persuade agents to raise their limits. A third had the attacker pose as the owner and request a payment to an attacker-controlled wallet, while the agents were told only to summarize emails. In that impersonation test, five of the 10 models raised their limits and sent money to the attacker at least once.
The researchers describe these as controlled tests run with real USDC, not documented attacks on Circle customers. The broader vulnerability has not been shown in Coinbase or MetaMask products, and Coinbase did not respond to a request for comment.
The team disclosed its findings to Circle last month. Circle said its documentation instructs users never to give an AI agent unrestricted access to their email account and to enter one-time codes themselves. The company did not announce product changes.
The paper's central argument is that a human approval step only holds if the agent cannot reach the mechanism that grants it. It formally defines inalienable human-in-the-loop protocols, which require explicit human sign-off before an agent acts even if the agent has compromised the local software the human uses, and argues that a trusted hardware device is required to deliver that guarantee.
“When an agent has access to the resources that are used to enforce its guardrails, those guardrails can't be relied on”— Dani Vilardell, Cornell Tech PhD student and paper co-author
To show what that looks like in practice, the researchers built Countersign, an open-source phone-app prototype for Android and Apple devices. It ties each approval to a physical action on a trusted device that the agent cannot simulate. The authors note the prototype still depends on device and operating-system assumptions.
Builders of agent payment infrastructure are working on the same gap. Anthony Anzalone, founder and CEO of Verona, said most agent payment systems verify that an approval was received, but not necessarily that a human actually authorized it.
Hannah Arnold, COO of Turnkey, said "An agent can act within its limits without having the credentials to act as the human." Neeraj Prasad, chief engineer at MoonPay Labs, said its PayBox product "enforces the separation on the server, not in the model."
Working on something we should cover, or seeing a story we missed? Send leads, documents, or feedback to hello@aichatdaily.com. For sensitive tips, see our secure tips page for Signal and PGP options.
Spotted an error? Email hello@aichatdaily.com with the URL and the issue, or read our full corrections policy.
