Could “human approval” for AI agent wallets be little more than a formality?
Researchers from Cornell Tech and Yale ran an experiment using real USDC (on Base mainnet, with 10 USDC in the wallet and a daily limit of just one cent): they had 10 AI models pay invoices using Circle’s agent wallets, without telling them they could change the limit.
The results:
• 9 of the 10 models read email verification codes sent to the “owner” on their own at least once, then raised the limit;
• After phishing emails impersonating the owner were introduced, 5 models were fooled into paying the attacker’s wallet—even though the task was only to “summarize emails”;
• Only Claude Opus 5.5 didn’t bypass the limit; after spending up to the cap, it reported back to the user.
One caveat: this was a controlled experiment, not a case of real users having their funds stolen. The researchers also said it hasn’t been verified whether the findings apply to wallets such as Coinbase and MetaMask. Circle responded that its documentation already tells users not to let AI access their verification email, and to enter verification codes themselves.
The takeaway: as long as AI can access the credentials needed for approval, “approval” isn’t reliable. The researchers’ solution is to tie confirmation to a physical action on a phone. AI agents + stablecoin payments are a hot area, but the security boundaries haven’t been fully thought through.
Would you trust an AI agent with access to your wallet?
#AI #稳定币 #Web3 Security
Source: CoinDesk report, 2026-11-01
Not investment advice
Researchers from Cornell Tech and Yale ran an experiment using real USDC (on Base mainnet, with 10 USDC in the wallet and a daily limit of just one cent): they had 10 AI models pay invoices using Circle’s agent wallets, without telling them they could change the limit.
The results:
• 9 of the 10 models read email verification codes sent to the “owner” on their own at least once, then raised the limit;
• After phishing emails impersonating the owner were introduced, 5 models were fooled into paying the attacker’s wallet—even though the task was only to “summarize emails”;
• Only Claude Opus 5.5 didn’t bypass the limit; after spending up to the cap, it reported back to the user.
One caveat: this was a controlled experiment, not a case of real users having their funds stolen. The researchers also said it hasn’t been verified whether the findings apply to wallets such as Coinbase and MetaMask. Circle responded that its documentation already tells users not to let AI access their verification email, and to enter verification codes themselves.
The takeaway: as long as AI can access the credentials needed for approval, “approval” isn’t reliable. The researchers’ solution is to tie confirmation to a physical action on a phone. AI agents + stablecoin payments are a hot area, but the security boundaries haven’t been fully thought through.
Would you trust an AI agent with access to your wallet?
#AI #稳定币 #Web3 Security
Source: CoinDesk report, 2026-11-01
Not investment advice
