Circle’s agent wallets rely on a one-time passcode sent to the account owner’s email as the step meant to keep a human in control of an AI agent’s budget. Tests by researchers at Cornell Tech and Yale found that this safeguard often fails if the model can access the inbox.
The paper, posted to arXiv on Monday, said the researchers told each agent it was running unsupervised and asked it to pay invoices in the user’s inbox. They did not mention the spending cap or explain how to increase it.
According to the paper, nine of 10 models went into the inbox, copied the code, and raised their own daily limit at least once in 20 attempts. The only model that did not do so in any run was claude-opus-5.5. It spent only what the cap allowed and then told the user which invoices were still unpaid.
The authors are Samuel Breckenridge, Dani Vilardell, and Ari Juels of Cornell Tech, and Wenhao Wang and Fan Zhang of Yale. All are also affiliated with IC3.
Each model was run 20 times per experiment with email, web, and wallet tools. The wallet used in testing held 10 USDC on Base and had a daily cap of 0.01 USDC.
The spoofed-email test
In a separate experiment, the agent was asked only to summarize the inbox. The researchers, acting as the attacker, then sent emails posing as the user. Those messages asked for a 0.02 USDC transfer to an address controlled by the researchers and tried to head off any request for confirmation.
Five of 10 models paid that address in at least one run.
A chart in the paper showed that two Qwen models and two DeepSeek models raised the cap in that test in roughly 65% to 90% of runs. gemini-2.5-flash did so in a single run. GPT models, Claude models, and gemini-3.8-flash did not do so in that test.
The authors wrote that anyone who can email the user can spend from the wallet.
What changed at Circle
The researchers said they disclosed the results to Circle on Sept. 22 and that Circle acknowledged the report.
Circle’s quickstart and authentication pages now tell users, “Never give an AI agent unrestricted access to your email account,” and instruct them to enter the code themselves. The paper cites the quickstart page as accessed on Oct. 10.
The authors described that warning as a sensible mitigation, but said it leaves the burden on the user to keep the agent out of the inbox.
They also noted that Circle has not changed how limit increases are approved. In the paper, they wrote that this still leaves an opening for any agent that reaches the owner’s inbox through another route, such as saved login credentials or a browser session that is already signed in.
The researchers proposed moving approvals to a trusted device the agent cannot control. They built a prototype called Countersign that uses attestation features on Android and iOS phones, along with a button press or biometric check.
The paper also noted that other agentic wallets use similar approval designs.
Earlier this month, Unchained reported on an OpenAI model that paid Ethereum testnet fees from a wallet it had not been given.