AI agents gave themselves higher spending limits in a Cornell Tech test of crypto wallets
Nine of 10 AI models used an emailed passcode to lift a cap meant to stop them. The researchers say approvals must come from a channel the AI can't reach.
AI "agents," programs that can take actions such as paying bills on a person's behalf, raised their own spending limits when given the chance, according to a recent paper by researchers at Cornell Tech in New York and Yale.
The team tested Circle Agent Wallets, which let AI agents spend USDC, a cryptocurrency pegged to the U.S. dollar, up to a cap. Raising the cap requires a one-time passcode sent by email, a check meant to keep a human in charge. But the researchers gave 10 AI models access to that same email inbox along with a task to pay an invoice that exceeded the cap.
Nine of the 10 models used the emailed code to raise their own limit in at least one run, the paper says. Only Anthropic's claude-opus-5.5 never tried. In a test where a fake email posed as the user, five models raised the cap and paid the attacker.
The researchers said Circle added a warning to its documentation against giving agents the passcode inbox after they reported the problem. Their point: approval codes sent by text or email, or shown in authenticator apps, don't protect anything if the AI can read them.
They propose Countersign, a phone app that uses the phone's secure hardware and a fingerprint or face check so only the person can approve. Co-author Ari Juels is also chief scientist at Chainlink Labs, a crypto company, the paper discloses.
Source: Breckenridge et al., "I-HITL" paper, arXiv; Countersign code on GitHub