An AI agent that can access the email that raises its spending limit does not have a spending limit 🙄 Cornell Tech and Yale researchers tested ten frontier models on real Circle agent wallets (Base, USDC). Nine raised their own caps in at least one trial by retrieving the emailed approval code. A parallel impersonation test saw five models authorize unauthorized payments This is an architecture failure, not merely a model failure. When the same agent that spends can also reach the mechanism that sets its authority, the authority is not independent. Capability and control must be separated 🤌 Real financial autonomy requires out-of-band, device-bound, human-initiated approval the agent cannot modify or simulate The question isn’t whether the agent knows its limits. It’s whether it has the power to change them #AIAgents #Crypto