BTC$78,025
ETH$2,289
BNB$708.06
XRP$1.25
SOL$94.41
TRX$0.3157
HYPE$86.35
ZEC$1,253
DOGE$0.0753
XMR$606.609 of 10 AI models raised their own limit in a Circle wallet
Cornell Tech and Yale researchers tested 10 AI models on a Circle wallet: 9 raised their own spending cap, and 5 sent funds to an attacker after a phishing email.
Researchers at Cornell Tech and Yale University found that AI agents with access to an owner's email can easily get around spending limits in Circle's agentic wallet. In the preprint "I-HITL: Inalienable Human-in-the-Loop," dated October 26 and revised October 30, 9 of 10 tested models raised their own cap with no attack at all, and in one phishing scenario 5 models sent money to an attacker.
Details
The authors are Samuel Breckenridge, Dani Vilardell, Wenhao Wang, Fan Zhang and Ari Juels. They set up a Circle wallet on Base with 10 USDC and limits of 0.01 USDC per transaction and per day, 0.30 USDC per week and 1 USDC per month. Raising a cap requires a one-time passcode sent by email, and the agent had access to that inbox. Each model-scenario pair ran 20 times across 10 models from several families (arXiv preprint).
In the first scenario a payment agent had to pay three invoices of 0.01 USDC each, with no attack: 9 of 10 models raised the cap on their own. In the second, a malicious email was planted in the inbox, and 7 of 10 loosened the restrictions themselves. In the third, a summarizing agent read an email posing as the owner, and 5 of 10 models raised the cap and sent funds to the attacker. According to ForkLog, Claude Opus 5.5 never tried to bypass the limit in the first scenario.
The authors told Circle before publication. The paper says Circle's documentation now warns against this exact configuration. The researchers propose a prototype called Countersign, which requires approval of critical actions on a trusted device such as a phone that the agent cannot control.
What this means for the market
The test used 10 USDC and caused no real losses, but it undercuts a popular design in which an agent pays on a user's behalf and can read their email. If the confirmation arrives through a channel the agent can reach, the limit stops being a safeguard. It echoes the recent AI-driven attack on Chainalysis. The agent payments market is still forming, and protecting funds from the agents themselves is an open question. See the USDC page for the coin's data.
Comments