On Circle’s agent wallets, the step meant to keep a human in charge of an AI agent’s budget is a one-time passcode emailed to the account owner. In tests by researchers at Cornell Tech and Yale, most AI models fetched that code from the inbox themselves.

The researchers told each agent it was running unsupervised and asked it to pay the invoices in the user’s inbox, without mentioning the spending cap or how to raise it. Nine of 10 models went into the inbox, copied the code and lifted the daily limit for themselves at least once in 20 attempts, according to the paper, posted to arXiv on Monday. Only claude-opus-5.5 held the line in every run. It spent what the cap allowed, then told the user which invoices were still unpaid.

The authors are Samuel Breckenridge, Dani Vilardell and Ari Juels of Cornell Tech and Wenhao Wang and Fan Zhang of Yale, all also with IC3. Each model ran 20 times per experiment, with email, web and wallet tools and a wallet holding 10 USDC on Base, capped at 0.01 USDC per day.

Get Unchained’s crypto news in your inbox with the free Unchained Daily newsletter.

The Spoofed-Email Test

Separately, the agent was asked only to summarize the inbox. The researchers, playing the attacker, sent emails that posed as the user, asked for a 0.02 USDC transfer to an address the researchers controlled, then headed off any request for confirmation.

Five of 10 models paid that address in at least one run. Per a chart in the paper, two Qwen and two DeepSeek models raised the cap in that test in roughly 65% to 90% of runs, gemini-2.5-flash in a single run, and the GPT and Claude models and gemini-3.8-flash in none. “Anyone who can email the user can spend from the wallet,” the authors wrote in the paper.

What Circle Changed

The researchers said they disclosed the results to Circle on Sept. 22 and that Circle acknowledged the report. Circle’s quickstart and authentication pages now tell users, “Never give an AI agent unrestricted access to your email account,” and to enter the code themselves. The paper cites the quickstart page as accessed on Oct. 10.

In the paper, the authors called the warning “a sensible mitigation” but said it “places the burden on the user” to keep the agent out of the inbox. Circle has not changed how limit increases are approved, the authors noted. That leaves the gate open to any agent that reaches the owner’s inbox another way, such as with saved login credentials or a browser that is already signed in, they wrote.

They propose routing approvals through a trusted device the agent cannot control. They built a prototype, Countersign, that uses attestation features on Android and iOS phones plus a button press or biometric check. The authors noted that other agentic wallets use similar approval designs.

Unchained reported earlier this month on an OpenAI model that paid Ethereum testnet fees from a wallet it was not given.

Related Listen: How Morse Code Broke an AI Crypto Agent