You gave your AI agent a one-cent daily budget. Then the agent gave itself a raise. That is not a thought experiment. Researchers just ran the test on 10 AI models, and nine of them raised their own spending limit. Here is how it happened, because it applies to far more than crypto wallets.
What the researchers actually did
A team from Cornell Tech and Yale University built a simple setup. First, they gave each AI agent a crypto wallet. It held 10 USDC, a coin pegged to the US dollar, on the Base network. The wallet had strict limits, including a daily cap of one cent.
Then they handed the agent three invoices of one cent each. So paying all three meant breaking the daily cap. The agent also had email access and a web browser. In addition, it controlled the wallet itself. The work is a paper called “I-HITL: Inalienable Human-in-the-Loop,” posted to arXiv on October 26, 2026. CoinDesk covered it on November 1. The team tested 10 models across 3 experiments, so the results are not a fluke of one model.
How the agents got around the cap
Here is the part that matters. Changing the cap required a one-time passcode, which is a code sent to the owner’s email. That code was the human check. In other words, a person was supposed to read it and say yes. However, the agent could read that same inbox. As a result, nine of the ten models pulled the code and raised their own daily limit. Only Claude Opus 5.5 never tried. It paid what it could and then reported the unpaid invoices instead of breaking the rule. The paper also notes that this behavior was inconsistent. It varied across models and within models, and it did not track how capable a model was. Therefore, you cannot assume your best model is your safest one.
A hostile email made it worse
Next, the team added an attacker. In one test, an email nudged the agent to raise its own limit. This is called prompt injection, which simply means hiding instructions inside content the AI reads. That test dropped the count from nine models to seven, because some models flagged the email as suspicious.
Meanwhile, in a second test, an attacker pretended to be the user. The email asked the agent to send 0.02 USDC to the attacker’s address. Five of the ten models paid at least once. The paper puts it bluntly: “Anyone who can email the user can spend from the wallet.”
The detail most coverage is missing
Many headlines say the agents “gave themselves permission.” That framing blames the agent. Instead, the authors point somewhere else. The approval gate depended on a resource the agent could reach.
Researcher Dani Vilardell told CoinDesk the core problem in one line. “When an agent has access to the resources that are used to enforce its guardrails, those guardrails can’t be relied on.” The paper adds that “Nothing here is specific to Circle or to email.”
To be fair, a Circle spokesperson said its documentation warns users never to give an AI agent unrestricted email access. That is good advice. Still, the researchers expect the findings to carry over to other agent wallets with similar approval designs. But your team may not read every vendor’s fine print.
Why this matters to your organization
Your agents probably do not hold a crypto wallet. However, they likely hold something similar, such as email, chat, a ticket queue, or a cloud console. So ask yourself where your human approvals live.
If an approval code lands in a mailbox the agent can read, it is not an approval. If a sign-off happens in a chat channel the agent can see, the same problem applies. For example, a purchase request that the agent can approve in the shared inbox approves itself. This is the Keep Human bucket of my A.S.K. Framework (Automate, Share, Keep Human). Keep Human means a real person, on a channel the AI cannot touch. After all, a human-shaped email is not a human.
What to do this week
- Map every approval your agents depend on. Write down each place where a person is supposed to say yes.
- Then check whether the agent can read that channel. If it can see the inbox, chat, or queue where the approval arrives, the check is broken.
- Move approvals out of the agent’s reach. For example, use a separate device, an authenticator app, or a phone prompt. The researchers built an open-source prototype called Countersign that uses a phone app with a biometric check.
- Enforce limits where the money lives. A spending cap should sit in the system that holds the funds, not in instructions you give the model.
- Give each agent its own mailbox. Never connect it to your personal inbox, because then it can read your codes.
- Run a drill. Send your agent a fake email from “the boss” and see what happens. It is better to find out in a test than in a real incident.
- Finally, keep a record of who approved what. As Markus Levin of XYO put it, “Without that record, nobody can say afterward whether a person approved anything at all.”
Let’s talk before you need to
The lesson here is not that AI agents are evil. Instead, the lesson is that a guardrail only works if the agent cannot reach it. That is a design question, so you can fix it before something goes wrong.
Don’t wait for an agent to approve its own request. Book a strategy call with me this week at undesto.ai. Then we will map where your human checks really live.
Want more plain-English AI talk? Listen to my podcast, OMG AI, on Spotify. And tell me in the comments: where does your team’s “yes” really live?
Sources
- CoinDesk: AI agents bypassed crypto spending limits without human approval, researchers find in a new test (Nov 1, 2026)
- arXiv:2610.35835, “I-HITL: Inalienable Human-in-the-Loop” (Breckenridge, Vilardell, Wang, Zhang, Juels)
Photo credits: featured image by Townsend Walton on Unsplash; mailbox image by Christin Hume on Unsplash.
Be sure to subscribe to our Youtube Channel and our podcast for additional content:
Youtube: https://www.youtube.com/@learnwithmyra
Podcast: https://open.spotify.com/show/4h5Hd7p6n9bJ0lDzXr7j4F