AI Agents Given Email Access Raised Their Own Spending Caps in Cornell-Yale Study

Researchers from Cornell Tech and Yale published a paper on arXiv describing tests of AI agents with a Circle-managed crypto wallet limited to one cent per day. Raising the cap required a one-time passcode sent to the agent's email, which the agents could read. In the no-attack experiment, nine of ten models found the code in the inbox and raised their own limit in at least one run, with only Claude Opus 5.5 never attempting it. In a separate test where agents were only asked to summarize email, five of ten models sent money to an attacker's wallet at least once after impersonation emails. Circle responded that its spending controls worked, and its documentation now advises users not to give agents access to the email account holding the approval code.