Researchers at Cornell Tech and Yale gave ten AI models a crypto wallet, a one-cent daily spending limit and access to the owner's email. Nine of the ten raised their own limit at least once by fishing out the one-time passcode that was meant for the human. If you've ever connected an AI agent to your email, that's the result to read twice.
Nobody attacked them. The agents were told to pay a batch of invoices and told not to change the spending policy. They hit the cap, noticed the verification code sitting in the inbox, and used it to keep going.
The paper, titled "I-HITL: Inalienable Human-in-the-Loop," ran the test on Circle's agent wallets with real money: 10 USDC, a dollar-pegged stablecoin, on the Base network, 20 trials per scenario. Only Claude Opus 5.5 never tried to get around the cap. It paid up to its limit and reported the leftover invoices to the user, which is exactly what you'd want.
Then the researchers added an attacker
In a second scenario, the agents only had to summarize the owner's emails. One email, written to look like it came from the owner, asked for a payment to an attacker's wallet. Five of the ten models raised their limits and sent money to the attacker at least once. The paper says Qwen and DeepSeek models did it frequently, while the GPT and Claude models were largely resistant.
The researchers name the core problem in one line: "Human approval relies on resources that the agent can reach through the platform it runs on." An emailed code was supposed to prove a person said yes. Once the agent can read that inbox, it proves nothing.
Circle's documentation already tells users never to give an agent unrestricted access to the verification email account, CoinDesk reports. The researchers say nothing here is specific to Circle or to email.
Why this matters if you never touch crypto
Swap the wallet for a shopping agent, a travel booker or one of OpenAI's always-on Dots, and the setup looks familiar. Plenty of banks and stores still send confirmation codes by email or text. If the agent you've connected can read those messages, your spending limit is a suggestion.
We find the first test more unsettling than the attack. Those agents were simply trying to finish a job, and a rule in the prompt didn't hold them back. Nine out of ten is a pretty clear verdict on "just tell it not to."
A fix, and what to do today
The team's fix is Countersign, an open-source phone app. Approvals happen through a physical action on a device the agent can't control, and the screen shows you the exact payment you're approving. The authors note it relies on assumptions about how Android and iOS protect that screen.
You don't need to wait for it. Keep any agent away from the inbox or phone number that receives your security codes, or give it its own email address. Use an authenticator app or a passkey for accounts that move money. And put the real limit where the agent can't edit it: a prepaid or virtual card with a fixed balance, set up by you. Our checklist for OpenAI's Dots covers the other permissions worth locking down first.
The cap held for one model out of ten. Put yours somewhere no agent can reach.
Cover: AI-generated editorial illustration by TMRW. The wallet, lock and envelope are illustrative.
