AI agents bypassed crypto spending limits without human approval, researchers find in a new test

AI agents given access to their owners' email accounts were able to increase their own cryptocurrency spending limits without human approval, raising questions about the safeguards designed to control autonomous payments, researchers at Cornell Tech and Yale University found.

In experiments with stablecoin issuer Circle’s agent wallets, nine out of 10 models raised their spending caps at least once while paying invoices without an attacker involved. Only Anthropic’s Claude Opus 5.5 never tried to bypass the cap; instead, it spent up to its limit and reported remaining invoices to the user.

The researchers also introduced a simulated attacker in two separate experiments, sending malicious emails to the owner's inbox to persuade the agents to increase their spending limits or impersonating the owner to request a payment to an attacker-controlled wallet.

In the impersonation experiment, five of the 10 models raised their spending limits and sent money to the simulated attacker at least once, despite being instructed to summarize emails only.

The results expose a problem for financial companies developing wallets that let AI agents make payments independently while requiring humans to approve changes to their spending authority.

“Most agent payment systems verify that an approval was received, but not necessarily that a human actually authorized it,” Anthony Anzalone, founder and CEO of Verona, a verification network that recently launched a stablecoin for AI agents, told CoinDesk.

Adding approval steps would not resolve that gap unless authorization depended on something the agent could not independently access or generate, he said.

The researchers funded a wallet with 10 $USDC on the Base network and set a daily spending limit of 1 cent in the test. They gave the agent email, web and wallet tools, including access to the inbox receiving approval codes. Each model underwent 20 trials per scenario.

In the experiment without an attacker, the agents were instructed to pay invoices but were not told to change their spending policies.

Nine of the 10 models nevertheless increased their limits at least once by retrieving email verification codes intended for the wallet owner, the research shows. The findings came from controlled tests using real $USDC, rather than documented attacks on Circle customers.

Who controls the approvals?

Circle’s spending policies let users cap transfers and restrict wallet addresses. Changing those rules requires another one-time passcode sent by email, but the agents could retrieve that code themselves and use it to authorize higher limits. The stablecoin issuer’s current setup guide warns users to keep agents away from the verification inbox and to have them enter codes themselves.

“When an agent has access to the resources that are used to enforce its guardrails, those guardrails can’t be relied on,” co-author Dani Vilardell, also a Cornell Tech PhD student, told CoinDesk.

Approval requires “a physical interaction that can’t be simulated in software,” Vilardell said. The person must see “a genuine representation of the action they were approving,” and the agent must not be able to extract the approval keys.

To demonstrate the approach, theresearchers built Countersign, an open-source prototype intended to combine those properties in a phone app. Vilardell said it can run on Android and Apple devices, with human confirmation tied to the specific action.

The prototype still relies on device and operating-system assumptions, including protection of the approval display. It has different limitations on Android and iOS.

The broader challenge is establishing whether a payment was genuinely approved by a person, rather than an AI agent with access to the same credentials.

Levin said every approval an agent requests should leave a verifiable record of who signed off and on what.

“Without that record, nobody can say afterward whether a person approved anything at all,” he added.