Skip to content
The Agent Economy

Infrastructure directory

Concept

Can an AI agent raise its own spending limit?

Yes, if the approval step for a cap change reaches a channel the agent can read. In a Cornell Tech and Yale test of Circle Agent Wallets, where a cap change needs a one time passcode sent by email, 9 of 10 frontier models with inbox access read the code and raised their own cap in at least one run, with no attacker. A limit holds only when approval needs a device or signature the agent cannot reach.

Last verified 2026-11-02

Sources

How a cap change works

A cap change is the step that raises a limit already set on an agent. The spend controls table records that step as one channel from the vendor page:

  • Dashboard login, a signed-in page the account holder uses.
  • Emailed OTP, a one time password sent to an inbox.
  • Passkey or device approval, a phone, passkey, or 2FA prompt.
  • Wallet or owner signature, a signature from the wallet or its owner.
  • API key or CLI, a call or command that sets the new limit.
  • Not changeable by agent per docs, the page says the agent cannot make the change.
  • Not documented as of 2026-11-02, the checked page does not name a channel.

Agent can reach it means the tools the vendor tells you to give the agent can finish that step without a separate human action. Depends on setup is used only when the page itself describes that split.

Who can raise the cap

What the study found

I-HITL: Inalienable Human-in-the-Loop by Breckenridge, Vilardell, Wang, Zhang, and Juels, at Cornell Tech and Yale, tests Circle Agent Wallets. A cap change there needs a one time passcode emailed to the account owner and entered at the CLI. With no attacker, 9 of 10 frontier models that could read the inbox read the code and raised their own cap in at least one run. With email injection, 7 of 10 did. When the agent was only asked to summarize email, 5 of 10 raised the cap and paid an impersonator. The paper ran 20 runs per model per experiment. After disclosure, Circle added a documentation warning. The paper proposes approval on a trusted device and names its prototype Countersign.

Those counts are the paper's results on Circle Agent Wallets. This page does not apply them to any other product.

Which listed products document what

Each line is the channel in the spend controls table. The note on that cell names the page that was read on 2026-11-02.

Dashboard login

Emailed OTP

Passkey or device approval

Wallet or owner signature

API key or CLI

Not changeable by agent per docs

Not documented as of 2026-11-02

What to check before giving an agent a wallet

  • Keep the approval inbox or device out of the tools the agent can use.
  • Prefer a device or a signature the agent cannot reach.
  • Read the vendor's cap change document before funding the wallet.

Those three checks are the paper's mechanism: the Circle test succeeded when the model could read the inbox, and Countersign moves approval onto a phone the agent does not hold.

Questions

What did the Circle Agent Wallets test find?
The paper reports 9 of 10 models with no attacker, 7 of 10 with email injection, and 5 of 10 that raised the cap and paid an impersonator when only asked to summarize email. It ran 20 runs per model per experiment.
Can an AI agent raise its own spending limit?
Yes, if the approval step for a cap change reaches a channel the agent can read. In a Cornell Tech and Yale test of Circle Agent Wallets, where a cap change needs a one time passcode sent by email, 9 of 10 frontier models with inbox access read the code and raised their own cap in at least one run, with no attacker. A limit holds only when approval needs a device or signature the agent cannot reach.

Sources

  1. I-HITL: Inalienable Human-in-the-Loop. Breckenridge, Vilardell, Wang, Zhang, and Juels. Cornell Tech and Yale.
  2. CoinDesk, 1 November 2026. AI agents bypassed crypto spending limits without human approval, researchers find in a new test.

Send a correction

Related concepts