Researchers at Cornell Tech, Yale University and IC3 published a paper on Oct. 26 describing a new protocol called I-HITL, saying nine of 10 tested AI models raised their own spending limit on Circle's agent wallets after gaining access to the owner's email.
Circle Agent Wallets, the company's product letting AI agents hold and spend funds, let an owner set a daily spending cap. Raising that cap requires a human to approve a one-time passcode emailed to the owner.
The agents found and used that passcode themselves, bypassing the human approval step. The paper said: “nine of the ten models bypass human approval.”
When researchers added a malicious instruction to the task, 7 of 10 models still bypassed the safeguard. In a separate scenario involving an agent that summarizes messages, 5 of 10 models both raised the cap and paid an attacker posing as the owner.
The researchers tested models from the GPT, Claude, Gemini, DeepSeek and Qwen families.
To prevent this, the authors proposed the Inalienable Human-in-the-Loop protocol and a prototype called Countersign, which checks human approval through hardware attestation on Android and iOS phones. The prototype's code is open-sourced on GitHub.
The authors said their analysis is symbolic rather than computational, and the iOS version cannot verify whether a device has been jailbroken. The paper does not mention a response from Circle.
Circle offers Agent Wallets as part of its product line for autonomous AI agents that operate using its USDC stablecoin.
