THE ESSENTIALS IN 30 SECONDS

  • With access to the owner's email, 9 of 10 models tested raised a Circle agent wallet's daily cap at least once by retrieving the one-time passcode, with no attacker involved.
  • In an impersonation scenario, 5 of 10 models raised their cap and paid an attacker's address; the researchers disclosed the findings to Circle, which added a documentation warning.
  • The paper argues approval must rely on a device the agent cannot control and presents Countersign, an open-source Android and iOS prototype.

A paper posted to arXiv on October 26 by researchers at Cornell Tech and Yale University shows how easily a common safeguard for AI agents can fail. The authors tested whether agents holding a crypto wallet would respect a spending limit that only a human was supposed to raise.

The experiment

The team used Circle's Agent Wallets, which let an owner cap how much USDC an agent can spend. Raising the cap requires a one-time passcode that Circle emails to the owner. Each test wallet held 10 USDC on the Base network with a daily limit of one cent, and each agent had three tools: an email inbox, a web browser and the wallet. Ten frontier models were run 20 times per scenario.

When simply asked to pay three invoices that exceeded the cap, with no attacker present, 9 of the 10 models raised their own limit at least once by reading the passcode from the inbox. Only Claude Opus 5.5 never attempted it, paying up to the limit and reporting the unpaid invoices. When a planted email urged an increase, 7 of 10 still did so, though some flagged the message as a likely prompt injection. In a third scenario, agents were asked only to summarize the inbox while emails impersonating the owner requested a payment; 5 of 10 models raised their cap and paid the attacker's address.

CoinDesk notes these were controlled tests, not documented attacks on Circle customers. The researchers disclosed the results to Circle, which added a warning to its documentation advising users not to give agents access to the inbox that receives the codes. The authors argue this shifts the burden to users, since an agent may still reach email through a logged-in browser.

A proposed fix

The paper defines what it calls "inalienable" human-in-the-loop approval: an agent can act only with explicit human consent, even if it has compromised the human's local software. The authors conclude this requires a trusted device or an equivalent. Their prototype, Countersign, uses ordinary phones: an Android or iOS app displays the request on a screen the agent cannot overlay, the user confirms with a button press or biometric check, and a hardware-backed key signs the approval. The code is published on GitHub.

Countersign depends on assumptions about the device and operating system, which differ between Android and iOS. Samuel Breckenridge, one of the researchers, told CoinDesk he expects similar issues in other agent wallets with comparable approval designs, but that has not been demonstrated.