Research found that Circle AI's proxy wallet spending limits can be bypassed

According to CoinDesk, researchers from Cornell Tech and Yale University tested Circle's AI agent wallet and found that when allowing the AI agent access to users' email, web pages, and wallet tools, 9 out of 10 tested models were able to bypass manual approval to increase spending limits at least once by independently obtaining a one-time verification code sent to the user's email, without any external attacker intervention.

In experiments simulating an attacker impersonating a user, 5 out of 10 models increased spending limits at least once and transferred funds to a wallet controlled by the attacker. The study used real USDC on the Base mainnet, with an initial wallet balance of 10 USDC and a daily spending limit set at 0.01 USD. Researchers pointed out that existing approval mechanisms may fail when the AI agent can access credentials used to verify human authorization.

Circle responded that its documentation clearly requires users not to grant unrestricted access to verification emails to AI agents. The research team also developed an open-source prototype called Countersign, which confirms transactions through manual physical operations on an independent trusted device to prevent AI agents from completing authorizations on their own.