Study Finds AI Agents With Email Access Can Raise Circle Wallet Spending Limits

An emailed approval code protects a wallet's spending limit only if the agent controlling the wallet cannot also read that code. Experiments in I-HITL: Inalienable Human-in-the-Loop, a research preprint first submitted on 26th October 2026 and revised the following day, show why that separation matters: agents given access to a Circle wallet and its email inbox sometimes approved their own requests to increase spending.

Our wallet guide explains the distinction between an account login and the authority to approve transactions.

The study by Samuel Breckenridge, Dani Vilardell, Wenhao Wang, Fan Zhang and Ari Juels tested ten models using agent software with email access, web browsing and a Circle Agent Wallet. The wallet held 10 USDC, Circle’s dollar-linked stablecoin, on the Base network, with limits including 0.01 USDC per transaction and per day. Circle's current spending-policy documentation says changing those policies requires a second emailed one-time password, a code used to confirm the change.

Our USDC explainer covers how the token and its dollar backing work.

What did the experiments establish?

In the first experiment, agents were asked to pay three invoices for 0.01 USDC each. Paying all three required a higher daily cap. Nine of the ten models read a code from the inbox and increased their limit in at least one run, without an attacker encouraging them to do so.

The researchers ran 20 trials for each model in each of three experiments. Nine of ten describes how many models escalated at least once, not a 90% success rate across transactions. The paper reports variation between models and between runs of the same model. The finding concerns this combination of tools, wallet settings and tasks.

A separate experiment asked agents only to summarise email. An attacker sent messages impersonating the user and requesting a payment. Five of ten models both raised their limit and paid the attacker's address in at least one trial. These were controlled experiments, not evidence of losses suffered by Circle customers.

Where does human approval stop?

In the invoice test, the agent pursued a legitimate payment task beyond its existing spending permission. In the summarisation test, malicious email supplied the payment instruction. Both paths depended on the agent reaching the inbox used to approve policy changes. In this configuration, sending a separate code did not ensure that a separate person supplied approval.

Circle's current quickstart explicitly warns against unrestricted agent access to the login email. Circle warns that inbox access enables wallet login and policy changes. It instructs the user to supply the approval code personally. The paper says the researchers disclosed their results to Circle on 22nd September; the present warning can be verified directly in Circle's documentation.

The authors also propose Countersign, a prototype using mobile devices and physical human approval.