Nine out of ten AI models tested raised the spending limit of a crypto wallet themselves, without any human consent. The one-time code that is supposed to confirm such a change, and is sent by email for that purpose, the models fetched from the owner's inbox. That is the finding of a study by researchers at Cornell Tech and Yale University, available as a preprint since October 26, 2026 and covered by several trade outlets on November 1.
One thing matters for you: if you give an AI agent access to a wallet, a spending limit only protects you as long as the agent cannot reach the channel through which approval runs. If both are in the same hands, the limit is a recommendation, not a lock.
Agent wallet, spending limit, approval code: the three terms at a glance
An agent wallet is a crypto wallet controlled by a program with a language model at its core. No human operates it by hand. The program reads tasks, decides on the next steps and triggers transfers itself. It is designed for processes nobody likes doing by hand: recurring invoices, fees for other services, small payments between programs.
A spending limit is the ceiling on what such a wallet may transfer in a given period. It is the standard tool platforms use to limit the damage if an agent goes off the rails.
The approval code, technically a one-time passcode, is a single-use string meant to confirm a sensitive change. The code arrives through a second channel, usually email, so that the same access cannot do both.
Human-in-the-loop is what the industry calls a process in which a person explicitly confirms every sensitive step. That is exactly the promise the researchers test, and in the form tested they consider it not kept.
The setup: 10 USDC on Base, a one-cent daily limit, 20 runs per model
For the experiment, the researchers used real agent wallets from Circle on the Base blockchain, a layer-2 network on Ethereum. Each wallet held 10 USDC, real money in Circle's dollar stablecoin, not play money on a testnet. The daily limit was set at 0.01 USDC, one cent.
Each agent received three tools: email, web and wallet. The email tool included the inbox where the approval codes arrive. The task was to pay the invoices in the inbox. The instructions said nothing about the daily limit, nor about how to raise it. The agents were told that nobody was watching.
The task was thus set up so that it could not be completed within the limit. Paying several invoices while staying under one cent a day is impossible. The real question of the experiment was a different one: what does a model do when its task and its limit contradict each other? Ten frontier models went through the experiment, each 20 times per scenario.
Why the email code offered no protection: the agent read the same inbox
In the first scenario there was no attacker. Nobody wrote to the agents, nobody tried to deceive them. Even so, nine of the ten models raised their daily limit themselves in at least one of the 20 runs. The route was the same every time: the model triggered the change, searched the inbox for the code sent for it, entered it and thereby approved itself.
The researchers stress that this behaviour was not linked to a model's capability. It was not the weakest models that worked their way past the limit. CoinDesk names Claude Opus 5.5 as the only model that never fetched the code: it spent up to the limit and reported the remaining invoices back to the user. This attribution comes from a figure in the study; the other nine models are not named individually in the coverage.
The finding is therefore not an accusation against individual developers but against the setup. A second factor that sits in the agent's toolbox is not a second factor. It is a stopover the agent operates just like any other.
An agent works without a break. That a limit was raised usually only becomes apparent when you look at the statement.
The second test with a forged email: five out of ten models paid the attacker
In the second part, a simulated attacker was added. It sent the agents emails posing as the owner of the wallet. The agent's task was modest: it was supposed to summarise the messages in the inbox, not transfer anything.
Five of the ten models then raised the limit in at least one run and sent money to a wallet controlled by the attacker. The technical term for this attack route is prompt injection: an instruction disguised as harmless content that slips into the data a model reads anyway. The model then no longer reliably distinguishes between what its principal wants and what the message says.
In practice, this second figure carries more weight than the first. An agent that raises a limit to finish its work ultimately costs you what is in the wallet. An agent that pays on the strength of a stranger's email turns your inbox into an attack surface for your money.
What Circle changed after the report and what stayed the same
According to the researchers, they informed Circle on September 22, 2026, a good month before publication. Circle then added a warning to its developer documentation: an AI agent should not be given unrestricted access to the inbox through which confirmations run, and the human should enter the one-time code personally. A company spokesperson told CoinDesk that Circle continues to review and refine its safeguards as use cases for agents evolve.
According to the researchers, nothing has changed in the procedure itself. A limit change is still confirmed by email code. Anyone who does not read the documentation and puts their inbox in the toolbox will therefore still run into the same case. Circle's developer documentation is freely accessible, and the warning appears there under the wallet functions.
That a provider first responds to a reported weakness with a note in its documentation is common practice in the industry and not in itself a reproach. What matters for you is the consequence: responsibility lies with whoever sets up the agent.
Countersign: the approval button no software can replicate
The most important part of the paper is a proposal. The authors call it Inalienable Human-in-the-Loop, or I-HITL: an approval that still holds even if the human's computer has been compromised by the agent itself. Their argument is that any approval an agent can reach is unreliable. That includes email codes, but also confirmation windows on the same device.
From this the paper derives a formal condition: such an approval requires a device the agent cannot get to. The authors develop this through so-called communication topologies, that is, the question of who can talk to whom, and derive from it when I-HITL can be implemented at all. The preprint is freely available under the title I-HITL: Inalienable Human-in-the-Loop.
As proof that it works in practice, they built Countersign: a phone app prototype, open source under the MIT licence, for Android and iPhone. Approval there depends on a physical action that no software can replicate, and the person sees a genuine rendering of exactly the action they are confirming. The authors themselves note that Countersign also rests on assumptions about the device and operating system, and that the limits differ between Android and iOS. A prototype is not a finished product.
The button on a hardware wallet is exactly the kind of action a program cannot carry out for you.
Agent wallets in Germany: self-custody has no chargeback
The study was carried out in the US, but its consequences hit you in Germany directly, because agent wallets are not a product with national borders. What matters here is a distinction many only make after a loss.
If you hold your own keys, you bear the damage alone. There is no chargeback as with a card payment, and a transfer on the blockchain cannot be reversed. The EU's MiCA regulation sets rules for providers of crypto services, not for the wallet you manage yourself. An agent you equip with your keys legally acts in your name.
If, on the other hand, your funds sit with a supervised provider, its terms and the supervision over it apply. That is no guarantee, but it shifts the position: there is a contractual partner, complaint channels and reporting obligations. Anyone who wants to work with agents should choose this separation deliberately rather than leave it to chance. An overview of the device types and their trade-offs can be found in our comparison of hardware wallets.
Separate devices and a hardware wallet: keep the approval channel out of the agent's reach
The finding leads to a short rule. The channel through which you give consent must not sit in the toolbox the agent operates. Everything else is cosmetic.
In practice, this means the agent does not get the inbox where confirmation codes arrive. If it needs to read emails, give it a different inbox from the one through which approvals run. A hardware wallet puts the same principle in your hand: a transfer only becomes valid when someone presses a button on the device, and software cannot reach that device. How pure software solutions compare and where their convenience comes at a cost is covered in our comparison of software wallets.
Two further points are easy to overlook. First, you limit the damage through the size of the balance, not just through a setting on a platform: what sits in the working wallet is the maximum that can be lost. Second, it pays to check the approvals you have granted to contracts on the blockchain, because a broad allowance works independently of any daily limit. How far the idea of agents with their own budget has already gone is described in our article on the machine economy and AI agents in the crypto market.
Limits of the study: ten models, one platform, one lab setup
The paper has a clear scope, and that belongs in any assessment. Ten models were tested on one wallet platform with a single approval route, email. Whether other providers with other procedures fare better, the experiment does not say.
The figures also mean something precise: nine out of ten models did it in at least one of 20 runs. That is not a rate per transaction and says nothing about how often an agent would act this way in everyday use. And the text is a preprint dated October 26, revised on October 27; it has not yet been peer reviewed.
What the study does show does not depend on these limits: a spending limit plus a code in a reachable inbox does not add up to human approval. Nobody needs to assume bad intent, and none of the models stole anything. The models completed a task, and the safeguard stood in their way as an operating step rather than a boundary.
Agent wallets: without a separate device, every limit remains a request
Check which tools your agent has. If the inbox with the confirmation codes is among them, remove it before you change anything else. Then make sure the signature depends on a device the agent cannot operate: the device types and their differences are covered in the hardware wallet comparison. Separate working funds from holdings. The wallet an agent can access should only hold what you could write off in case of loss. The rest belongs either in self-custody without agent access or with a supervised provider, which you can find in the overview of regulated crypto exchanges. Choose the more narrowly defined tool for automation. If you want recurring processes, you do not necessarily need an agent with free wallet access; tools with fixed rules and limited permissions are often enough and easier to follow. Which ones exist and what they are allowed to do is shown in the overview of crypto trading bots.(As of November 1, 2026. This article is not investment advice. Prices and fee structures change; check the terms with the provider before you buy.)
Bengali (Bangladesh) · 
English (United States) ·