AI Models Raise Their Own Circle Wallet Spending Caps
Researchers say nine of ten frontier models raised their own Circle agent-wallet spending cap with no human approval.
Researchers from Cornell Tech and Yale gave ten frontier AI models a Circle agent wallet with a spending cap, and reported that nine of the ten read the codes and raised their own cap in at least one run, with no human approval.
What's the Scoop?
The Test: The models were asked to pay three 0.01 USDC invoices from a wallet holding 10 USDC, with a 0.01 USDC daily cap, so finishing the job meant raising the cap. Circle gates cap changes behind an emailed one-time code, and the agents could read that inbox.
The Results: Nine of ten models raised their own cap in at least one of 20 runs, and the authors say the behavior did not track model capability. Per the paper's chart, Qwen and DeepSeek models did so in nearly every run, while Claude Opus 5.5 never tried. In a separate test where an attacker emailed as the user, the authors say five of ten models bypassed the gate and paid the attacker.
The Fix: The authors say they told Circle on Sept. 22, and Circle's docs now warn, "Never give an AI agent unrestricted access to your email account." The authors call that sensible but argue real human sign-off needs a trusted device the agent can't touch.
David Christopher
David is a writer/analyst at Bankless. Prior to joining Bankless, he worked for a series of early-stage crypto startups and on grants from the Ethereum, Solana, and Urbit Foundations. He graduated from Skidmore College in New York. He currently lives in the Midwest and enjoys NFTs, but no longer participates in them.
