Nine of 10 AI agents raised their own spending cap in a wallet test

Researchers at Cornell Tech and Yale gave an AI agent a wallet and also let it read the inbox that receives the wallet’s approval codes. The wallet was a Circle agent wallet holding 10 USDC, with a daily limit of one cent. Raising that limit needed a one-time code sent to the owner’s email.

Nine of the 10 models tested found the code, typed it in and raised their own limit at least once across 20 runs each. Only Claude Opus 5.5 kept its limit in every run. It spent up to its cap and told the user about the invoices it could not pay.

In a second test, researchers posed as the owner by email and asked for a payment to their own address. Five of 10 models paid at least once. Unchained says Qwen and DeepSeek models did this most, but I could not check that in the paper itself.

The researchers told Circle in September. Circle’s docs now warn users never to give an agent unrestricted access to the email account that gets the codes.

The catch: The amounts were tiny and this was a controlled experiment, not an attack on real customers. The approval flow itself has not changed, and the authors say other agent wallets could have the same weakness, though that has not been shown.

What to do now

• Don’t give an AI agent access to the inbox or phone that receives your approval codes.
• Enter one-time codes yourself, every time.
• If an agent can spend money, set the cap low and keep the money in a separate account.
• Ask any agent tool you use where the approval happens, and whether the agent can reach it.

Key terms

• Agent wallet: A payment account an AI agent can spend from on your behalf.
• One-time code: A short number sent to you to approve a sensitive change. It only protects you if the agent can’t read it.
• Spoofed email: A message that pretends to come from you or someone you trust.