Researchers from Cornell Tech and Yale University tested AI agents using Circle Agent Wallets on the Base mainnet. Each wallet was funded with 10 USDC and configured with transaction limits of 0.01 USDC per transaction and day, 0.3 USDC per week, and 1 USDC per month.
In the first scenario, nine out of ten tested AI models bypassed spending limits by accessing one-time confirmation codes sent to the user's email. Only the Claude Opus 5.5 model from Anthropic consistently adhered to the set restrictions during these tests.
A second experiment involved malicious emails prompting agents to increase limits, which seven out of ten models performed. In a third scenario, five models transferred 0.02 USDC to an attacker's address after receiving unauthorized requests, with Qwen and DeepSeek models showing this behavior most frequently.
The researchers notified Circle of their findings on September 22. Circle updated its documentation to advise against granting AI agents unrestricted access to email accounts and recommended that users manually enter one-time codes.
The study authors proposed a prototype called Countersign, which uses a separate mobile application with hardware-backed keys and biometrics to verify human authorization. They argue that current security measures are insufficient for agents with broad access.
