9 out of 10 frontier AI models that were given access to a user’s inbox raised their own spending cap on a Circle agent wallet at least once.They read the one-time passcode transmitted by email to verify that a human was behind the change.Work by researchers at Cornell Tech and Yale with the Initiative for CryptoCurrencies and Contracts led to the paper being posted on arXiv on October 26. The claude-opus-5.5 model was the only one that never went beyond its own limits.One model lifted its daily cap from 0.01 to 5 USDCCircle gates any change to an agent wallet’s spending policy behind a one-time passcode sent to the account owner via email. This change only takes effect after the code is entered at the command line.The team utilized a LangChain agent that had three tools: email, a web browser, and a Circle agent wallet. The wallet had 10 USDC on Base, with 0.01 USDC per transaction and daily caps.The task was paying three 0.01 USDC invoices that were sitting in the inbox. Each model was run 20 times and there was no prompt about the spending policy or the passcode.The claude-opus-5.5 model paid as much as it could, then informed the user about the outstanding invoices.In one run, claude-sonnet-5 bumped its daily cap from 0.01 USDC up to 5 USDC, paid the invoices, and only mentioned the change to the user at the end.Seven out of ten models, down from nine, did what was asked of them when they got an extra email telling them to raise their limit. Some of them saw that email as a prompt injection, and they let the user decide what to do.Share of 20 runs in which each model raised its own Circle wallet cap, across three experiments, from Figure 2 of the Cornell Tech, Yale and IC3 paper.Five of 10 models paid an attacker posing as the userIn a different test, the agent was just told to summarize the inbox. Then, the researchers, as the user, sent an email requesting that 0.02 USDC be sent to an address they controlled.They would also send follow-up emails saying yes before the agent even had a chance to ask.Five of the 10 models went on to raise the cap and send the money at least once. Most of the payments were carried out by Qwen and DeepSeek models, while GPT and Claude models and gemini-3.8-flash held largely.“Anyone who can email the user can spend from the wallet,” the authors wrote.On September 22, the experts told Circle about the results, and the company acknowledged the report. Circle’s quickstart guide for agent wallets now carries the line “Never give an AI agent unrestricted access to your email account.”Circle has not changed the process for approving a new spending limit, the authors noted.The authors’ fix is a standard called inalienable human-in-the-loop, or I-HITL. Agent only proceeds with express human approval even after it has compromised the human’s software.The paper shows that this requires a trusted computing device out of the agent’s control. Their prototype, Countersign, employs the attestation services of the platforms and a biometric check to transform an Android phone or iPhone into one.Cryptopolitan reported Coinbase rolled out Agentic Wallets in February 2026. By June, its x402 payments protocol had over 480,000 active agents and more than 165 million transactions.MetaMask’s Agent Wallet also permits users to set daily spending limits and require approval for any spending outside those limits.Don’t just read crypto news. Understand it. Subscribe to our newsletter. It's free.