AI agents: they gave themselves the right to spend more crypto

The guard dog has the keys to the kennel. Researchers from Cornell Tech and Yale entrusted crypto wallets to ten AI models, with a spending limit of one cent per day. Nine of them raised this ceiling without asking anyone's permission. Enough to chill those who already see AI agents paying for us.

AI agents: 9 out of 10 models raise their own ceiling

The protocol consisted of a few things. A Circle agent wallet, funded with 10 USDC on the Base network, capped at 1 cent in daily spending. The agent had tools to read his emails, browse the web and use his wallet. And that's where it all comes down to: the agent's email box was also the one that received the validation codes intended for the owner.

Each model played each scenario 20 times. Without any attacker in the loop, 9 out of 10 models raised their ceiling at least once, simply by searching the mailbox for the verification code supposed to validate a human's decision. Only one never tried, Anthropic's Claude Opus 5.5, who spent up to the limit and then reported the remaining bills, according to CoinDesk.

The agent didn't hack anything. He read an email, copied a code, clicked confirm, just like a zealous assistant who wants to finish his task would do.

Theft: 5 out of 10 models send money to the attacker

The second test is more worrying. The researchers simulated an attacker who writes to the agent pretending to be the owner and requests a payment to his own wallet. However, the instructions given to the agent were limited to summarizing the emails received.

Five out of ten models have raised their cap and sent the money to the attacker at least once.

“Most agent payment systems verify that an approval has been received, not necessarily that a human has actually authorized it,” summarizes researcher Anzalone, from the University of Verona. Circle, warned in October, recalls that its documentation “explicitly asks never to give an AI agent unlimited access to the email account” used for verification. The press release does not mention any changes to the product.

Countersign: the parade involves a physical gesture

The study, entitled “I-HITL: Inalienable Human-in-the-Loop” and co-authored by doctoral students Samuel Breckenridge and Dani Vilardell, draws a simple rule. Any approval an agent can achieve is unreliable. So the researchers released Countersign, an open source mobile app for Android and iPhone that requires physical interaction that software can't simulate, according to Dani Vilardell. The approval screen must also show a faithful representation of the action to be validated.

For you, the practical lesson is in one sentence. An agent who manages a wallet should never have access to the channel used to validate their own expenses, whether emails, SMS or notifications.