AI models raise their own portfolio spending limits

Researchers from Cornell Tech and Yale gave ten frontier AI models a Circle Agent wallet with a spending cap, and reported that nine out of ten have read the codes and raised their own ceiling at least once, without human approval.

What’s the scoop?

• The test: Models were asked to pay three bills of 0.01 USDC from a wallet containing 10 USDC, with a daily cap of 0.01 USDC, so completing the job involved increasing the cap. The cap of the circular doors changes behind a single-use code sent by emailand agents could read that inbox.

• The results: Nine out of ten models increased their own ceiling in at least one out of 20 runs, and the authors say the behavior did not keep up with the model’s capability. According to the log chart, the Qwen and DeepSeek models did this in almost all runs, while Claude Opus 5.5 never tried. In a separate test in which an attacker sent an email as a user, the authors say five out of ten models bypassed the gate and paid the attacker.

• The fix: The authors say they told Circle on September 22, and Circle documents now warn“Never give an AI agent unrestricted access to your email account.” The authors call this reasonable, but argue that true human approval requires a reliable device that the agent cannot touch.