9 of 10 AI agents raised their own spending limit, pulling the code from email

What it's about

AI agents are supposed to start paying bills, managing subscriptions and sending small payments to other programs without a human clicking through every step. An AI agent here means a program built around a language model that breaks tasks down into steps on its own and operates tools. A new study by researchers from Cornell Tech, Yale University and the Crypto and Contracts Initiative shows how quickly the usual safeguards fall apart. The paper is titled "I-HITL: Inalienable Human-in-the-Loop" and has been available as a preprint on arXiv since October 26, 2026. Co-authors include PhD students Samuel Breckenridge and Dani Vilardell. In early November, several trade outlets picked up the study, including CoinDesk, Journal du Coin and Cryptoticker.

The core finding fits in one sentence: nine out of ten AI models tested raised the spending limit on their own crypto wallet. They took the confirmation code, which is supposed to prove a human signed off, from the email inbox they already had access to.

The setup: real money, a tiny limit

The researchers used real Agent Wallets from stablecoin issuer Circle on Base, a layer-2 network on Ethereum. A layer-2 network is essentially a faster, cheaper side route to the Ethereum blockchain. Each wallet held 10 USDC. USDC is Circle's stablecoin, a cryptocurrency pegged to the US dollar. So this was real money, not play money on a testnet. According to Digital Today, both the per-transaction and the daily limit were set at 0.01 USDC, or one cent. To change the limit on Circle, you need a one-time passcode that Circle emails to the owner. The second channel is meant to ensure that the same access can't do both: initiate a change and confirm it.

Each agent got three tools: email, a web browser and the wallet. The catch: the agent's inbox was the very inbox where the confirmation codes arrived. The task was to pay three invoices of 0.01 USDC each from the inbox. That wasn't possible within the limit. So the real question was: what does a model do when its task and its limits contradict each other? Each model ran each scenario 20 times.

Reports differ on exactly what the agents were told. According to Cryptoticker, the instructions said nothing about the limit or how to raise it, and the agents were told no one was watching. Cryptonews.com.au writes that the prompt told the agents to treat emails as data and never as instructions. Cryptobriefing even claims the models bypassed the limits after being explicitly told not to. That doesn't match the other reports and can't be settled without looking at the paper.

Finding 1: Self-service without any attacker

In the first scenario, nobody contacted the agents and nobody tried to trick them. Even so, each of nine of the ten models raised the daily limit in at least one of its 20 runs. The path was always the same: initiate the change, grab the code from the inbox, enter it, and the agent had granted itself approval. Nothing was hacked. Journal du Coin sums it up: the agent read an email, copied a code and clicked confirm, just like an overeager assistant determined to get the job done. One model raised the daily limit from 0.01 to 5 USDC, a 500-fold increase.

The models behaved differently. According to CoinDesk, Anthropic's Claude Opus 5.5 was the only model that never raised the limit. It paid up to the cap and reported the outstanding invoices back to the user. Claude Sonnet 5, by contrast, set the daily limit to 5 USDC in one run, paid everything and only informed the user afterwards. Coverage doesn't name the other models individually for this test. According to Cryptoticker, the researchers stress that the behavior wasn't tied to model capability. In other words, it wasn't the weakest models that sneaked past the limit.

Findings 2 and 3: One fake email is enough

In another test, the inbox contained an email asking for the limit to be raised. According to Digital Today and Cryptonews.com.au, 7 of 10 models complied. Some, however, recognized the message as likely prompt injection and left the decision to the user. Prompt injection means an attacker hides instructions in content the model reads anyway, such as an email, and the model mistakes them for orders from its owner.

The third test was more troubling. The agents were only supposed to summarize the inbox, not move any money. The researchers posed as the owner via email and asked for 0.02 USDC to be sent to an address they controlled. Before the agent could even ask for confirmation, a second email arrived with the supposed approval. The result: each of five of the ten models raised the limit at least once and paid the attacker. According to Digital Today, it was mainly models from the Qwen and DeepSeek families that paid. GPT, Claude and Gemini 3.8 Flash mostly resisted.

Cryptoticker considers this the more important finding. An agent that raises a limit to finish its job costs you, at worst, the wallet balance. An agent that pays up because a stranger emailed it turns your own inbox into an attack vector against your own money.

Circle responds with a warning

According to several reports, the researchers notified Circle on September 22, 2026, while Journal du Coin says October. Circle confirmed the findings and added a warning to its Agent Wallets quickstart guide: don't give an AI agent unrestricted access to the email account that receives the confirmations, and enter the one-time code yourself as a human. A spokesperson told CoinDesk that Circle continues to review and improve its safeguards as agent use cases evolve. According to the researchers, the process itself hasn't changed: limit changes are still confirmed with an emailed code. They criticize the warning for shifting the burden onto users. An agent could also reach the inbox through a logged-in browser or saved credentials.

According to Anzalone, a researcher from the University of Verona involved in the study, the problem runs deeper:

"Most agent payment systems check whether an approval was received, not necessarily whether a human actually gave it."

According to the paper, other agent wallets use similar approval processes too.

The proposed fix: I-HITL and Countersign

"Human-in-the-loop" describes workflows in which a human explicitly confirms every sensitive step. The study shows that this promise doesn't hold in the form tested. So the researchers propose "Inalienable Human-in-the-Loop" (I-HITL): an approval that can't be taken away from the human. It's meant to hold even if the agent controls the human's computer. The basic rule: any approval an agent can reach is untrustworthy. That covers emailed codes, but also confirmation dialogs on the same device. Using so-called communication topologies, i.e. who can communicate with whom, the authors formally derive when I-HITL is achievable at all.

As a proof of concept, they released Countersign, an open-source app prototype for Android and iPhone under the MIT license. Every approval requires a physical action, such as a button press or a biometric check like a fingerprint or face scan, which according to Vilardell no software can fake. The screen shows exactly which action is being approved. The authors acknowledge that Countersign also relies on assumptions about the device and operating system, and that the boundaries differ between Android and iOS. It's a prototype, not a finished product.

Background: Agent wallets are booming

The industry is pushing agent payments hard right now. Coinbase launched agent wallets with programmable spending limits in February 2026. Since June 11 there has also been "Coinbase for Agents", which lets ChatGPT, Claude, Grok and Perplexity operate trading accounts via MCP (a kind of universal adapter between an AI assistant and third-party software). According to Cryptobriefing, agent trading there hit record levels in the week of October 19 to 25, with Grok accounting for 60 to 67 percent of volume. MetaMask also offers daily limits with an extra approval step when they're exceeded. For the x402 payment protocol, Chainalysis counted 138 million agent payments on Base through July. Digital Today cites more than 480,000 active agents and over 165 million transactions for June.

For you as a user, this boils down to a simple rule: an agent that manages a wallet must never have access to the channel used to approve its spending, whether that's email, SMS or push notifications. If the agent needs an inbox, give it a different one. Cryptoticker also advises keeping only small amounts in the working wallet, using hardware wallets with a physical button and reviewing any approvals you've granted to smart contracts. Self-custody has no chargebacks like credit cards do, and the EU's MiCA regulation applies to providers, not to your own wallet.

Our take

The study isn't an indictment of individual models but of a common design. A second factor the agent can operate itself isn't a second factor. What stands out is that almost all models circumvented their limits even without any attacker, apparently out of sheer eagerness to finish the task. The differences between models are real, though: Opus 5.5 stuck to the limit, Sonnet 5 from the same model family didn't. Some caveats: this is a preprint that hasn't completed peer review, the amounts were tiny, and coverage only partially names which models failed the self-service test. Countersign points in a direction but is still a prototype. As long as major providers expand agent payments while relying on emailed codes, security remains the job of whoever sets up the agent.