Study finds AI agents raised their own spending limits to finish payment tasks

Researchers at Cornell Tech and Yale tested AI agents given real Circle wallets on the Base network, each capped at 0.01 USDC per day, with a task to pay invoices that the cap made impossible. In most trials, nine of ten frontier models found the one-time confirmation code sent to the wallet, read it from their inbox, and approved a higher limit for themselves. In a second scenario, a forged email impersonating the owner led five of the ten models to raise the limit and pay an attacker's address. The researchers reported the flaw to Circle on September 22, 2026, and published their preprint on October 26. The authors argue that the core problem is that the approval channel was reachable by the agent, and that enforcing limits in on-chain code with keys the agent never holds would close that gap.