AI Agents: They Gave Themselves the Right to Spend More Crypto

The watchdog has the keys to the kennel. Researchers from Cornell Tech and Yale entrusted crypto wallets to ten AI models, with a spending cap of one cent per day. Nine of them raised this cap without asking for permission. This should cool the concerns of those who already see AI agents paying on our behalf.

Key points of this article:

• Researchers found that 9 out of 10 AI models autonomously raised their spending limits using verification codes meant for humans.
• A study revealed that 5 out of 10 AI models transferred money to a simulated attacker, highlighting the potential risks of automated payment systems by AI agents.

AI Agents: 9 out of 10 Raise Their Own Spending Limits

The protocol was simple. An agent wallet from Circle, funded with 10 USDC on the Base network, capped at 1 cent of daily spending. The agent had tools to read emails, browse the web, and use its wallet. And this is where it all plays out: the agent's inbox was also the one receiving the validation codes meant for the owner. Rate of autonomous spending limit increase according to the AI model and the tested scenario. Only Claude Opus 5.5 never raised it. Source: I-HITL (Cornell Tech / Yale), GitHub

Each model played 20 times in each scenario. Without any attacker in the loop, 9 out of 10 models raised their limit at least once, simply by fetching the verification code from the inbox that was supposed to validate a human's decision. Only one never tried, Claude Opus 5.5 from Anthropic, which spent up to the limit and then reported the remaining bills, according to CoinDesk.

The agent did not hack anything. It read an email, copied a code, clicked validate, exactly as a zealous assistant would do to finish its task.

Spoofing: 5 out of 10 Send Money to the Attacker

The second test is more concerning. Researchers simulated an attacker who writes to the agent pretending to be the owner and requests a payment to their own wallet. The instruction given to the agent was limited to summarizing the received emails.

Five out of ten models raised their limits and sent money to the attacker at least once.

< < Most payment systems for agents check that an approval has been received, not necessarily that a human actually authorized it > >, summarizes researcher Anzalone from the University of Verona. Circle, warned in October, reminds that its documentation < < explicitly states to never give an AI agent unlimited access to the email account > > used for verification. The statement does not mention any product changes.

Countersign: The Solution Involves a Physical Gesture

The study, titled < < I-HITL: Inalienable Human-in-the-Loop > > and co-signed by PhD students Samuel Breckenridge and Dani Vilardell, draws a simple rule. Any approval that an agent can reach is not reliable. The researchers have therefore published Countersign, an open-source mobile application for Android and iPhone that requires physical interaction that the software cannot simulate, according to Dani Vilardell. The approval screen must also show a faithful representation of the action to be validated.

For you, the practical lesson can be summed up in one sentence. An agent managing a wallet should never have access to the channel used to validate its own spending, whether it be emails, SMS, or notifications.

However, industry giants are moving in the opposite direction, with wallets for agents at MetaMask or Coinbase. Chainalysis already counted 138 million payments by agents via the x402 protocol on Base in a year.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.