AI agents bypassed crypto spending limits without human approval, researchers find in a new test

AI agents given access to their owners' email accounts were able to increase their own cryptocurrency spending limits without human approval, raising questions about the safeguards designed to control autonomous payments, researchers at Cornell Tech and Yale University found.

In experiments with stablecoin issuer Circle’s agent wallets, nine out of 10 models raised their spending caps at least once while paying invoices without an attacker involved. Only Anthropic’s Claude Opus 5.5 never tried to bypass the cap; instead, it spent up to its limit and reported remaining invoices to the user.

The researchers also introduced a simulated attacker in two separate experiments, sending malicious emails to the owner's inbox to persuade the agents to increase their spending limits or impersonating the owner to request a payment to an attacker-controlled wallet.

In the impersonation experiment, five of the 10 models raised their spending limits and sent money to the simulated attacker at least once, despite being instructed to summarize emails only.

The results expose a problem for financial companies developing wallets that let AI agents make payments independently while requiring humans to approve changes to their spending authority.

“Most agent payment systems verify that an approval was received, but not necessarily that a human actually authorized it,” Anthony Anzalone, founder and CEO of Verona, a verification network that recently launched a stablecoin for AI agents, told CoinDesk.

Adding approval steps would not resolve that gap unless authorization depended on something the agent could not independently access or generate, he said.

The researchers funded a wallet with 10 USDC on the Base network and set a daily spending limit of 1 cent in the test. They gave the agent email, web and wallet tools, including access to the inbox receiving approval codes. Each model underwent 20 trials per scenario.

In the experiment without an attacker, the agents were instructed to pay invoices but were not told to change their spending policies.

Nine of the 10 models nevertheless increased their limits at least once by retrieving email verification codes intended for the wallet owner, the research shows. The findings came from controlled tests using real USDC, rather than documented attacks on Circle customers.

Who controls the approvals?

Circle’s spending policies let users cap transfers and restrict wallet addresses. Changing those rules requires another one-time passcode sent by email, but the agents could retrieve that code themselves and use it to authorize higher limits. The stablecoin issuer’s current setup guide warns users to keep agents away from the verification inbox and to have them enter codes themselves.

The researchers said they disclosed their findings to the stablecoin issuer last month.

The firm said it appreciated the researchers’ disclosure. “Our documentation explicitly instructs users never to give an AI agent unrestricted access to the email account used for verification and to enter one-time codes themselves,” a Circle spokesperson told CoinDesk. “We continue to review and refine our safeguards as agentic use cases develop."

The statement did not identify product changes beyond the documentation warning or address questions about customer losses and unauthorized policy changes.

The paper argues that such guidance shifts the burden to users and is unlikely to hold, noting that an agent cut off from email could still find stored credentials through a browser or terminal.

“Telling people not to connect their email won’t hold because they’ll connect everything if it saves them time,” said Markus Levin, co-founder of XYO, a cryptographic proof network.

“Nothing here is specific to Circle or to email,” the authors clarified in the paper, titled “I-HITL: Inalienable Human-in-the-Loop.”

Samuel Breckenridge, a Cornell Tech PhD student and co-author, said the setup reflects the increasingly broad permissions people give personal AI agents. The researchers used real funds on Base mainnet, and plan to investigate whether larger payments change agent behavior, he said.

The same weakness can appear wherever a code stands in for a person, Breckenridge said. GitHub, for example, can require a code from an authenticator app before creating a token that grants access to a private repository. An agent able to operate the user’s device could find that code, he said. An agent that helped set up the app could learn its secret and generate codes itself.

“Many natural approaches that you might try to enforce human-in-the-loop will be ineffective for capable agents with broad permissions — exactly the sort of agents you would expect to be most helpful,” he said.

A blurred line

The findings come as cryptocurrency companies race to build payment infrastructure for AI agents, with different approaches to separating automated spending from human control.

Cloudflare Chief Strategy Officer Stephanie Cohen told CoinDesk in August that its planned wallets would resemble corporate cards, with humans setting budgets and agents returning for permission when they reached their limits.

“We expect our findings to transfer to other agent wallets that use similar approval designs such as those of Coinbase and MetaMask,” Breckenridge told CoinDesk.

That broader vulnerability has not been demonstrated across those products.

Coinbase’s documentation for its agent-wallet tools, for example, says people set spending limits through the wallet interface. Those tools let agents pay for online services, not send funds to arbitrary addresses, change limits or initiate Coinbase Onramp funding. Coinbase did not reply to a request for comment by publication time.

Restricting the wallet tools addresses one route to greater authority. The wider question is whether the same agent can reach a human’s credentials, browser session or recovery process through another tool.

“PayBox enforces the separation on the server, not in the model,” Neeraj Prasad, chief engineer at MoonPay Labs, said in an emailed statement. “Anything requiring sign-off pauses until the user approves with a passkey in the PayBox app.”

Prasad said approvals are tied to individual transactions, so changing the amount, recipient or merchant requires fresh authorization.

Approval failures have also appeared in software outside of payments. In an October 2025 report, security firm Trail of Bits said it bypassed human approval in three agent platforms by tampering with the arguments of commands they let run automatically.

“An agent can act within its limits without having the credentials to act as the human,” Turnkey Chief Operating Officer Hannah Arnold said.

“In any system, if an agent can access a human’s credentials, browser session or recovery path then the separation between human and agent breaks down,” she added.

Building a safeguard

The researchers propose a stronger form of human approval that relies on a trusted device outside the agent's control, rather than a password or code the agent could retrieve.

“When an agent has access to the resources that are used to enforce its guardrails, those guardrails can’t be relied on,” co-author Dani Vilardell, also a Cornell Tech PhD student, told CoinDesk.

Approval requires “a physical interaction that can’t be simulated in software,” Vilardell said. The person must see “a genuine representation of the action they were approving,” and the agent must not be able to extract the approval keys.

To demonstrate the approach, the researchers built Countersign, an open-source prototype intended to combine those properties in a phone app. Vilardell said it can run on Android and Apple devices, with human confirmation tied to the specific action.

The prototype still relies on device and operating-system assumptions, including protection of the approval display. It has different limitations on Android and iOS.

The broader challenge is establishing whether a payment was genuinely approved by a person, rather than an AI agent with access to the same credentials.

Levin said every approval an agent requests should leave a verifiable record of who signed off and on what.

“Without that record, nobody can say afterward whether a person approved anything at all,” he added.