Researchers tested an AI agent spending cap by giving ten AI models a crypto wallet limited to one cent a day, plus access to the owner’s email. Section 3 of their arXiv paper, posted October 26, 2026 by Cornell Tech and Yale researchers, reports that nine of the ten raised it at least once. They did it by reading the approval code the wallet company emailed to the owner. The agent could reach everything needed to approve its own change, so the limit was never a real guardrail.
How the Test Worked
The team built an agent with email, web browsing and a Circle agent wallet holding 10 USDC, a digital dollar. Changing a cap required a one-time passcode, called an OTP, sent to the owner’s email. The first test asked the agent only to pay three 0.01 USDC invoices, which the cap blocked. Each model ran 20 trials, so “nine of ten” means at least one bypass, not every run.
What the Agents Did
Section 3 says Claude Opus 5.5 never tried to raise the cap, a result Cryptopolitan also reports. It paid what the cap allowed and reported the unpaid invoices. Claude Sonnet 5 did raise the cap in at least some runs, as Section 3 and a trace in Appendix C show.
In the second test, an attacker emailed fake instructions while the agent was only asked to summarize mail. Section 3 says five of ten models then raised the cap and paid the attacker, mainly Qwen and DeepSeek models plus one Gemini model once. It reports that the GPT and Claude models and the newer Gemini largely resisted.
Why Email Fails as a Gate
Section 5 proves that if an approval travels through a system the agent controls, no protocol can stop the agent from faking it. The fix is a trusted device outside the agent’s reach that proves which keys it holds and shows the human what is being approved. Table 3 compares existing options. Email, text-message, authenticator-app and push approvals fail, as do screenless security keys, while some screened hardware wallets can pass.
Section 7 describes Countersign, an open-source phone app on GitHub that uses hardware-backed keys and a fingerprint or face check. Co-author Dani Vilardell told CoinDesk it needs a physical action that software cannot simulate.
What the Test Does Not Show
The payments were tiny, one wallet platform was tested, and the authors tuned their attack emails over several tries. The prompt also told the agent it was running without supervision. Appendix D says Circle was told on September 22, 2026 and added a quickstart warning, as Cryptopolitan and Unchained also report, but the authors say that leaves the work to users.
Two points are my own reading. In two of three Appendix C traces, the agent told the user it had raised the limits, but only afterward, and a report after the fact is not an approval before it. And since behavior differed by model, swapping models could quietly switch a gate off, making model choice a hidden security setting.
