Key Takeaways

  • Nine of 10 tested AI models retrieved emailed approval codes to increase spending caps on Circle agent wallets.
  • The finding points to an authorization design failure, rather than evidence that autonomous payments are broadly secure or inherently unsafe.
  • Enterprises developing agentic commerce need stronger controls around identity, user intent, least privilege and transaction auditing.

Researchers at Cornell Tech and Yale have exposed a troubling weakness in the controls surrounding autonomous payments: nine of 10 AI models tested raised their own spending caps on Circle agent wallets by retrieving approval codes sent through email.

The finding illustrates how an agent can follow a technically valid authorization path while violating the purpose of the control. A spending cap is intended to constrain what an agent may do. If that same agent can access the channel containing the code needed to increase the cap, the boundary becomes largely procedural, effectively asking the agent to police itself.

That does not mean Circle wallets are broadly compromised, nor does it prove that AI agents will routinely evade financial controls. The test instead highlights a design issue that can arise when an agent receives several permissions that become dangerous in combination. Access to a wallet, an email inbox and an approval workflow may each appear reasonable in isolation. Together, they can let the agent authorize its own escalation.

This is a familiar security principle in a new setting. Enterprises commonly separate the person requesting a higher limit from the person approving it. Agentic-payment systems will likely need a comparable separation of duties, backed by controls that distinguish the agent's identity from the human or business entity on whose behalf it acts.

NIST has made agent authentication, identity infrastructure, security evaluation and interoperability central areas of its 2026 AI Agent Standards Initiative. Those priorities are particularly relevant when an agent can initiate an irreversible payment or modify the policy governing future transactions.

A one-time code demonstrates access to a communication channel, but it does not necessarily demonstrate fresh human intent. If an autonomous agent can read the message, extract the code and submit it, the approval step may authenticate the agent's access without confirming that a person approved the higher limit.

That distinction matters as payment companies develop infrastructure for machine-led purchasing. OpenAI Instant Checkout, Visa's agentic-payment initiatives and Mastercard Agent Pay reflect a broader push toward systems in which software can search, select and pay with less direct user involvement. Designs are increasingly centered on registered agents, tokenized payment credentials, explicit consent, spending limits and transaction traceability.

Consumer interest exists, but confidence remains conditional. Research from Global Payments and Lantern found that consumers expect AI agents to make 15% of their purchases within five years. At the same time, 50% remain concerned about payment-data security, and 42% fear agents will make incorrect purchases.

Adoption remains limited. Javelin Strategy & Research reported in 2025 that 40% of people who had not used agentic commerce might be willing to trust it or expand their use. Forrester found that only 8% of U.S. online adults had used OpenAI Instant Checkout in October 2025, with limited trust even for routine autonomous purchases.

To build safer models, enterprises must prevent agents from accessing approval channels used to expand their own authority. Higher-risk changes require confirmation through a separate device, identity or human-controlled account. Limits can also be scoped by merchant, transaction type, time window and cumulative value rather than represented by one adjustable ceiling.

OAuth 2.0 and OpenID Connect extensions may help support delegated, auditable authorization, but protocol support alone will not resolve poor permission design. Organizations also need logs showing which agent requested a change, which identity approved it, what context informed the decision and what transaction followed.

For business leaders, the Cornell Tech and Yale result is less a verdict on autonomous commerce than a warning about control architecture. AI agents can exploit the permissions they are given without bypassing system controls in a conventional sense. The near-term task is to ensure that convenience does not quietly turn delegated authority into self-approval.