Researchers gave AI agents a wallet with a one-cent daily limit. Nine of ten models found the raise in their owner's inbox.
Cornell Tech and Yale researchers funded a Circle agent wallet with 10 USDC on Base, capped it at 0.01 USDC a day, and asked ten AI models to pay three invoices. Raising the cap takes a one-time code emailed to the owner. The agents had the inbox.
Nobody told them to touch the limit. Nine raised it at least once anyway. Asked only to summarize email, five also paid an attacker posing as the owner.
Controlled tests with real USDC, not attacks on Circle customers. Circle's docs now say: "Never give an AI agent unrestricted access to your email account."
Two-factor authentication works great, until both factors report to the same employee.