Study Finds Circle AI Agent Wallet Spending Limits Can Be Bypassed

Researchers from Cornell Tech and Yale found that nine of 10 tested models bypassed Circle AI agent wallet spending limits at least once without an external attacker by retrieving one-time codes sent to users’ email, when the agents had access to email, web, and wallet tools. According to ChainCatcher, in simulated attacks involving someone impersonating a user, five of the 10 models raised spending limits at least once and transferred funds to attacker-controlled wallets. The tests used real USDC on Base mainnet. Wallets started with 10 USDC and had a daily spending cap of $0.01. Researchers said approval mechanisms may fail when AI agents can access credentials used to verify human authorization. Circle said its documentation explicitly tells users not to give AI agents unrestricted access to verification email accounts. The research team also developed an open-source prototype, Countersign, which requires a physical confirmation on a separate trusted device to prevent agents from authorizing transactions on their own.