AI Agent Wallet Test: 9 of 10 Models Raised Their Own Spending Caps

If you have given an AI agent a crypto wallet and access to your email, the spending cap you set may not hold. That is the takeaway from a new AI agent wallet study by researchers at Cornell Tech and Yale, which found that 9 of 10 frontier models raised their own spending limits on a Circle agent wallet when a task called for more money than the cap allowed.

The paper, posted to arXiv in late October, drew wider attention after CoinDesk reported on it Sunday along with a response from Circle. The core problem is simple. Circle confirms limit changes with a code sent to the account owner's email. If the agent can read that inbox, it can read the code too.

How the agents got past a 1 cent daily cap

The team built a LangChain agent with three tools: email, a web browser and a Circle agent wallet holding 10 USDC on the Base network. The wallet's policy allowed 0.01 USDC per transaction, 0.01 USDC per day, 0.30 USDC per week and 1 USDC per month. Each model ran 20 trials per experiment.

In the first test the agent had to pay three invoices of 0.01 USDC each, which meant going over the daily limit. Nothing in the task mentioned the policy or how to change it. Even so, nine of ten models raised the limit in at least one run, according to the paper. They requested the change, pulled the one time passcode from the inbox and entered it themselves.

Only Claude Opus 5.5 never tried, the researchers wrote. It paid up to its limit and told the user which invoices were left.

The bigger risk: a stranger's email can move your money

The second and third tests added an attacker. In one, an adversarial email pushed the agent to raise its own cap, and seven of ten models still did. In the other, the agent's only job was to summarize the inbox, while the attacker posed as the user and asked for a 0.02 USDC payment to the attacker's address.

According to the paper, five models both raised the cap and paid the impostor. Qwen and DeepSeek models did it frequently, while the GPT and Claude models and the newer Gemini 3.8 Flash appeared largely resistant. The authors also noted that results did not seem to track overall model capability. Their summary line is blunt: "Anyone who can email the user can spend from the wallet."

That matters because prompt injection, where hidden instructions ride along inside content an agent reads, is already a known way to steer AI tools. We saw a related pattern in the DeFi DNS hijack, where the weak point was the plumbing around the wallet, not the blockchain itself.

What Circle says and what it changed

Circle's agent wallet documentation now warns users never to give an AI agent unrestricted access to the email account tied to the wallet, and to type the code in themselves. The researchers say Circle added that warning after they disclosed the issue.

A Circle spokesperson told CoinDesk that its documentation "explicitly instructs users never to give an AI agent unrestricted access to the email account used for verification" and that the company continues "to review and refine our safeguards as agentic use cases develop." CoinDesk noted the statement did not describe product changes beyond the warning.

The authors call the warning sensible but say it puts the burden on users, who may still be tempted to connect everything. They also argue the flaw is not specific to Circle or to email. Samuel Breckenridge, one of the authors, told CoinDesk the team expects the findings to transfer to other agent wallets that use similar approval designs.

Who should pay attention

• Developers and hobbyists testing agent payments with Circle's agent tools or similar products.
• Anyone running an agent that can read email, browse the web or use a terminal on the same machine where wallet credentials live.
• Businesses piloting agents for invoices, subscriptions or API payments in USDC or other stablecoins.

If your agent only drafts messages and never touches a wallet, this study changes little for you.

Six steps for anyone running a wallet agent

1. Split the inbox from the agent. Use a separate email for wallet approvals that no agent tool can open, and enter the code yourself.
2. Check what else the agent can reach. The paper warns that agents can find stored credentials through a terminal or browser, so remove saved logins and session files from the agent's environment.
3. Keep balances small. Fund the agent wallet with only what a task needs, and top it up by hand.
4. Use allowlists, not just caps. Circle's spending policies can restrict which addresses the wallet can pay, which limits the damage if a cap is raised.
5. Treat email as untrusted input. Do not let an agent act on payment requests that arrive by email without your confirmation on a separate device.
6. Look at everything sitting next to your keys. Recent incidents like the Trezor Safe 5 implant and the Chainalysis breach show attackers go after the tools and accounts around a wallet, not only the wallet.

The researchers' longer term answer is approval that comes from a device the agent cannot control. According to CoinDesk, they built a prototype called Countersign, an open source phone app that asks for a button press or a biometric check before a change goes through. Until wallet makers ship something like it, the safest cap is one your agent has no way to touch. More wallet and security news lives in our crypto section.