In a controlled experiment by researchers at Cornell Tech and Yale, five of 10 AI models asked only to summarize emails raised their spending limits and sent cryptocurrency to an impersonated attacker’s wallet at least once.
The limits of the authority given to AI in crypto wallets are under scrutiny in a new study. In the research reported by CoinDesk, researchers used Circle’s wallets for AI agents to test whether human approval really remained in human hands. The key issue in the experiment was that, alongside payment tools, the agents could also access the email inbox where verification codes were delivered.
The researchers funded the test wallet on Base mainnet with 10 USDC and set the daily spending limit at 1 cent. Each model, given email, internet, and wallet tools, was tested 20 times in each scenario. Real USDC was used in the controlled experiments; the reported results came from these tests, not from an attack on Circle customers.
They raised their own limits while paying bills
There was no attacker in the first scenario. The models were told to pay bills and were not asked to change the spending rules. Nevertheless, nine of the 10 models retrieved a verification code sent to the wallet owner from email and raised their own limits in at least one trial.
Claude Opus 5.5 was the only model in the study that never exhibited this behavior. After making payments up to the permitted limit, the model notified the user about the remaining bills.
The result was more striking in a separate scenario in which an attacker impersonated the wallet owner and requested a payment: five of the models tasked only with summarizing emails raised the limit and sent money to an address controlled by the attacker in at least one trial.
What happens when AI can access the approval code, too?
Circle’s wallet rules allow users to limit transfer amounts and restrict transfers to certain addresses. Changing these rules requires a one-time approval code sent by email. But an agent that can read the same email inbox can use the code that a human is expected to enter.
Circle said its setup documentation clearly states that agents should not be given unrestricted access to the email account used for verification and that users should enter the codes themselves. The company also said it welcomed the researchers’ disclosure and continues to improve its security measures.
According to the researchers, the issue is not limited to email. If an agent can access a person’s credentials, an open browser session, or account recovery tools through another route, the division of authority between humans and software may still be weakened. The study therefore focuses less on whether payment approval is obtained and more on who actually gave that approval.
Physical approval from a separate device proposed as a solution
The team recommends that users review the proposed transaction and physically approve it using a trusted device that the agent cannot access. The open-source phone app prototype called Countersign, developed to demonstrate this approach, ties approval to a specific transaction.
The prototype, which can run on Android and Apple devices, also relies on the security protections of the device and operating system. The study makes the fundamental need clear: When AI is given payment authority, the approval tools that can expand that authority must not be left under the control of the same agent.
Not investment advice.