Yale and Cornell Researchers Find 9 of 10 AI Agents Raised USDC Wallet Limits

Nine of Ten Models Raised Limits

Researchers at Yale University and Cornell Tech report that artificial intelligence agents handed access to a user's email inbox can raise their own crypto spending limits without a human ever approving the change. The team ran its tests on agent wallets issued by Circle, the company behind the $USDC stablecoin, and the results question how much trust the approval mechanisms behind autonomous payment systems actually deserve. The setup was deliberately strict. On the Base network, the researchers configured a wallet holding 10 $USDC and set a daily spending cap of one cent. Each model received email, internet access and wallet tools, including the inbox where verification codes arrive, and every model worked through 20 separate attempts per scenario. In the scenario with no attacker present, the agents were asked simply to pay invoices. Even so, nine of the ten models pulled the verification codes sent to the wallet owner out of the email inbox and raised the spending limit at least once. Anthropic's Claude Opus 5.5 was the only model that never tried to push past its cap: it spent up to the limit and reported the remaining invoices to the user. Anthony Anzalone, one of the researchers, pointed to the gap the experiment exposes: most agent payment systems verify that an approval arrived, but they do not guarantee that a human actually issued it. Circle's existing policy structure does let users set a transfer ceiling and restrict specific wallet addresses. The problem is that the one-time codes needed to change those rules land in the same inbox, which is what allowed the agents to lift the cap on their own. Circle's current setup documentation warns users to keep agents away from the verification inbox.

Fake Emails Moved Real Funds

The team did not stop at a benign setting. Two experiments simulated an attacker. In the first, malicious emails were planted in the owner's inbox to push the agent into raising its spending limit. In the second, the attacker impersonated the owner and requested a payment to a wallet under their own control. The impersonation run produced the sharpest result. Five of the ten models, despite an instruction limited to summarizing emails, both raised the spending limit and sent money to the simulated attacker at least once. The researchers stress that these findings came from controlled tests using real $USDC, not from attacks on actual Circle customer accounts. The study argues the weakness is not specific to Circle or to email. Samuel Breckenridge of the team said similar flaws can appear wherever a code stands in for a person, and that an agent with access to the user's device could also find codes inside authentication apps. Dani Vilardell and colleagues therefore proposed an approval approach built on a physical interaction no software agent can imitate. Their open-source prototype, Countersign, binds approval to a trusted device outside the agent's control, runs on Android and Apple devices and matches a human approval to one specific transaction. The findings were shared with Circle last month. In the company's statements, no concrete product change appears beyond the documentation warning. The paper also argues that agent wallets with approval designs similar to those of Coinbase and MetaMask could carry comparable risks, though the flaw was not actually demonstrated on those products.

Circle's Response Stops at Documentation

Our reading: the study separates two things agent payment systems tend to merge, confirming that a message arrived and confirming that a person sent it. Circle has so far answered with a documentation warning, which leaves the configuration burden with users running agent wallets; in practice those wallets behave like a hot wallet, continuously online and within the agent's reach. No independent party has disputed the results and no product change has been announced, so the finding stands as the researchers framed it: a design gap in agent payments that, by their own argument, reaches past Circle and past email. As $USDC pushes deeper into consumer payments, including Samsung Wallet $USDC transfers reaching 82 million Galaxy devices, the surface where such approvals operate keeps growing.