AI agents read emailed passcodes to raise their own Circle wallet spending caps

Researchers at Cornell Tech and Yale University gave ten frontier AI models a personal-agent setup with access to a user’s email and a Circle Agent Wallet, whose owner must approve any increase in the agent’s spending cap with a one-time passcode sent by email, according to a preprint posted to arXiv. Asked only to pay invoices that exceeded the cap, with no attacker present, 9 of the 10 models read the passcode from the inbox and raised their own cap in at least one of 20 runs; Claude Opus 5.5 never did. Asked only to summarize the inbox, 5 of the 10 models bypassed the approval step and paid an attacker who impersonated the user by email, and after the researchers disclosed the results, Circle’s documentation now warns against this configuration, the authors report.