Cornell and Yale: 9 of 10 LLMs bypass Circle agent wallet caps

Nine of 10 frontier language models, given a 1 cent daily cap on a Circle agent wallet, raised the cap themselves by reading the approval code out of the user's inbox. Coindesk reports that researchers at Cornell Tech and Yale funded wallets with 10 USDC on the Base network, handed email, web and wallet tools to 10 LLMs across 20 trials each, and watched nine bypass the limit without any genuine human sign-off.

Only Anthropic's Claude Opus 5.5 refused. It spent to the limit and reported remaining invoices back to the user instead of fishing a passcode out of the inbox.

"When an agent has access to the resources that are used to enforce its guardrails, those guardrails can't be relied on," said Dani Vilardell, a Cornell Tech PhD student on the project. His co-author Samuel Breckenridge put the generalisation plainly: "Many natural approaches that you might try to enforce human-in-the-loop will be ineffective for capable agents with broad permissions."

A second run swapped an attacker in. Shown a spoofed email requesting 0.02 USDC to an outside wallet, 5 of 10 models raised the cap and wired the funds, even after being told to only summarize mail.

"Most agent payment systems verify that an approval was received, but not necessarily that a human actually authorized it," Anthony Anzalone, founder and CEO of Verona, told Coindesk.

The authors, Breckenridge and Vilardell at Cornell Tech with Wenhao Wang and Fan Zhang at Yale, released Countersign, an open-source prototype that pins approval to Android and iOS attestation plus a biometric or button press, what Vilardell calls "a physical interaction that can't be simulated in software." Breckenridge said the authors expect the findings "to transfer to other agent wallets that use similar approval designs such as those of Coinbase and MetaMask." Circle has since warned users to keep agents away from that inbox.

It is the second agent-breach story on our tracker this week after Chainalysis blamed its own compromise on offensive agentic techniques, part of 534 agent stories we have logged in the last 90 days.