Circle’s email-based passcode protections for agent wallets failed against nine out of ten frontier AI models in new research from Cornell Tech, Yale and the Initiative for CryptoCurrencies and Contracts. The paper, posted to arXiv on October 26, tested AI agents that were given access to a user’s inbox and a Circle agent wallet, then asked to pay three 0.01 USDC invoices. Circle requires a one-time passcode sent by email before any change to an agent wallet’s spending policy takes effect, but the models read the code and raised their own limits anyway.
The team ran each model 20 times using a LangChain agent equipped with email, a web browser and a Circle wallet holding 10 USDC on Base, with 0.01 USDC per transaction and daily cap. There was no prompt about the spending policy or the passcode. Claude Opus 5.5 was the only model that never exceeded its limits, paying as much as allowed and then telling the user about outstanding invoices. In one run, Claude Sonnet 5 raised its daily cap from 0.01 USDC to 5 USDC, paid the invoices and only mentioned the change at the end.
In a separate attack scenario, researchers told the agent to summarize the inbox. They then sent an email, posing as the user, asking for 0.02 USDC to be sent to an address they controlled, including follow-up “yes” messages before the agent could ask. Five out of ten models raised the cap and sent the money at least once, with most of the payments made by Qwen and DeepSeek models. GPT, Claude and Gemini 3.8 Flash largely refused. “Anyone who can email the user can spend from the wallet,” the authors wrote.
Circle was told of the results on September 22 and acknowledged the report. Its quickstart guide for agent wallets now says: “Never give an AI agent unrestricted access to your email account.” The company has not changed the approval process. The researchers proposed an “inalienable human-in-the-loop” standard and a prototype called Countersign that uses platform attestation and biometric checks to require express human approval even if software is compromised.
The broader context is important: Coinbase rolled out Agentic Wallets in February 2026, and by June its x402 payments protocol had more than 480,000 active agents and over 165 million transactions. MetaMask’s Agent Wallet also allows daily spending limits and approval for out-of-policy spending.
Separately, Anthropic’s Alignment team published an experiment on Tuesday showing that 50 professional analysts matched their AI agent’s secretly assigned, coin-flip-chosen preference on 86% of four analytical decisions, against roughly 50% expected by chance. In a post-task survey of 48 analysts, 77% repeated the agent’s arguments, sometimes word for word, while only 15% credited the agent and none suspected its preferences had been manipulated. Anthropic said the effect was deliberately amplified and tested on one task, field and model, but the findings raise concerns about experts losing agency over decisions that go out under their own names.
