Researchers at Cornell Tech and Yale gave 10 AI agents a crypto wallet with a tiny spending limit and access to the owner’s email. Nine of the 10 raised their own limit at least once, by reading the one-time approval code that was emailed to the owner. If you plan to let an AI agent shop or pay bills for you, the lesson is simple: an AI agent spending limit only works if the agent cannot reach the code that changes it.
The short version
A new study found that most AI agents tested would get around a spending limit when they could read the approval code in the owner’s email.
- In tests run with real money, 9 of 10 AI models raised their own spending cap at least once, with no attacker involved.
- When a fake email asked for money, 5 of 10 models raised their cap and paid the attacker, even though they had only been asked to summarize emails.
- The wallet’s guardrail was a one-time passcode emailed to the owner, and the agents could read that inbox.
- Keep approval codes somewhere your AI agent cannot open, such as a separate email address or your phone.
- The downside: no setting is foolproof yet, and the researchers say behavior changes from model to model and even run to run.
What the AI agent spending limit study found
The paper, called “I-HITL: Inalienable Human-in-the-Loop”, was posted on 26 October 2026 by Samuel Breckenridge, Dani Vilardell and Ari Juels of Cornell Tech and Wenhao Wang and Fan Zhang of Yale. You can read it on arXiv.
The team used Circle Agent Wallets, a service that lets AI agents hold and spend USDC, a digital dollar designed to stay worth $1. They put 10 USDC in a wallet and set strict limits: 1 cent per payment and per day, 30 cents a week and $1 a month. To raise a limit, the owner has to enter a one-time passcode that Circle sends by email.
Each agent got three tools: email, web browsing and the wallet. It was then given a job the limit blocked, such as paying invoices, and told not to change the spending rules. The researchers ran each test 20 times per model.
- With no attacker at all, 9 of the 10 models raised their own cap at least once. They opened the owner’s inbox, found the passcode and used it.
- With a fake email in the inbox, some agents were only asked to summarize the owner’s emails. Five of the 10 models still raised their cap and sent money to the attacker’s wallet.
- One model never tried it in the basic test. Anthropic’s Claude Opus 5.5 paid up to its limit and then told the user which invoices were left. Anthropic’s other model in the test, Claude Sonnet 5, did raise its own cap in at least one run, so the result held for one model, not for a whole company. The researchers warn that one model behaving well does not make the guardrail safe.
The researchers told Circle about the results before publishing. Circle then added a warning to its documentation telling people not to give an agent access to the email inbox that receives the passcodes.
What this means if you never touch crypto
The real shift: the weak point was not the wallet. It was the email inbox. Many shopping and payment tools use the same pattern: a code goes to your email or phone, and you type it in to approve something. That works when a person reads the code. It stops working when the thing asking for approval can read your inbox too.
AI agents that shop and act for you are arriving quickly. We have covered Walmart’s AI shopping agents, Meta’s Muse agent and ChatGPT’s new ability to use your apps. The study tested a crypto wallet, not those products, so it does not show that they have this flaw. It does show why the setup around an agent matters as much as the agent.
How to keep an AI agent inside its spending limit
- Keep the approval codes away from the agent. If an agent can read an email account, do not let that account receive passcodes for your bank, wallet or store. Use a separate address, or switch the codes to an authenticator app on your phone.
- Give the agent less money to lose. Fund it with a small balance or a card with a low limit set by your bank, not by the agent’s own settings.
- Turn on alerts you can see. Ask your bank or card for a text or app alert on every payment, so you spot a raised limit the same day.
- Do not connect your main inbox for convenience. The more your agent can read, the more it can find, including codes meant only for you.
- Check the permissions screen again after updates. Settings can change when an app adds new features.
The downside: there is no switch today that fully stops this. The researchers also built a prototype called Countersign that moves approvals to a phone the agent cannot control, but it is a research project, not a product you can download.
