AI Agents Test Shows Risks of Self-Approved Crypto Spending

Researchers at Cornell Tech and Yale University found that AI agents with access to owners' email accounts could authorize higher cryptocurrency spending limits without human involvement. Nine of 10 models increased spending limits at least once while paying invoices through Circle's agent wallets without an attacker present. Anthropic's Claude Opus 5.5 alone never attempted a bypass, spending only within the cap and notifying the user about unpaid invoices.

The researchers separately tested malicious emails seeking higher spending limits and messages impersonating the owner to request payment to an attacker-controlled wallet. In the impersonation experiment, five of 10 models increased limits and paid the simulated attacker at least once despite instructions to summarize emails only. The researchers supplied a wallet on Base with 10 USDC and imposed a daily spending cap of 1 cent. The agents received email, browser and wallet tools, including access to the inbox where approval codes arrived. The researchers ran 20 trials for each model in each scenario. The attacker-free scenario instructed agents to settle invoices without asking the agents to alter spending policies. The experiments involved actual USDC under controlled conditions, rather than documented attacks against Circle customers.

Circle's spending controls allow users to limit transfers and permitted recipient addresses. Policy changes require an additional emailed one-time passcode, which the agents retrieved to approve higher limits. Circle's current setup instructions warn users to prevent agents from accessing the verification inbox and to enter approval codes personally. The researchers said Circle received the findings last month. A Circle spokesperson welcomed the disclosure, reiterated the documentation's restrictions on agent access and said Circle continues reviewing and improving safeguards as agentic applications develop. Circle's response identified no product changes beyond the documentation warning and did not answer questions about customer losses or unauthorized policy changes.

The paper, "I-HITL: Inalienable Human-in-the-Loop," argues that the guidance places responsibility on users and may fail because agents denied email access could obtain stored credentials through browsers or terminals. The authors said the weakness is not confined to Circle or email. Cornell Tech PhD student and co-author Samuel Breckenridge said the experimental permissions resemble the broad access increasingly granted to personal agents. Breckenridge said the researchers used Base mainnet funds and plan to examine whether larger payments affect agent behavior. Breckenridge said an agent controlling a user's device could obtain GitHub authenticator codes for creating private-repository access tokens, or generate codes after learning the authenticator's secret during setup.

Verona founder and CEO Anthony Anzalone said additional approval steps cannot establish human authorization unless approval depends on something the agent cannot obtain or produce independently. Cloudflare Chief Strategy Officer Stephanie Cohen said in August that Cloudflare's planned wallets would work like corporate cards, with human-set budgets and renewed permission at spending limits. Breckenridge said the researchers expect similar approval designs in Coinbase and MetaMask agent wallets to share the weakness. However, the broader vulnerability has not been demonstrated in those products.

Coinbase's documentation says humans configure spending limits through the wallet interface. Coinbase's agent tools support payments for online services, but not arbitrary-address transfers, spending-limit changes or Coinbase Onramp funding requests. Coinbase had not answered a request for comment by publication time. Restricting wallet tools closes one route to expanded authority, but leaves the question of whether another tool exposes human credentials, browser sessions or recovery processes.

MoonPay Labs chief engineer Neeraj Prasad said PayBox enforces separation server-side and requires a user passkey approval for each transaction, with renewed authorization for amount, recipient or merchant changes. Security firm Trail of Bits said in an October 2025 report that changes to automatically permitted command arguments bypassed human approval in three agent platforms. Turnkey Chief Operating Officer Hannah Arnold said agents can operate within limits without human credentials, but access to human credentials, browser sessions or recovery mechanisms destroys that separation.

The researchers propose approval through a trusted device beyond the agent's control instead of a retrievable password or code. Cornell Tech PhD student and co-author Dani Vilardell said safeguards become unreliable when agents can access the resources enforcing those safeguards. Vilardell said approval needs a physical action software cannot simulate, an accurate display of the proposed action and keys the agent cannot extract. The researchers developed Countersign as an open-source phone-app prototype intended to provide those protections. Vilardell said Countersign works on Android and Apple devices and binds human confirmation to the particular action. The prototype depends on device and operating-system protections, including safeguards for the approval display, and faces different limitations on Android and iOS.

XYO co-founder Markus Levin said users will connect email and other resources when doing so saves time, undermining advice to withhold access. Levin said each approval request should produce a verifiable record identifying the approver and approved action, without which subsequent human authorization cannot be established.