AI agents raised their own spending caps
Comments on “AI agents raised their own spending caps”
Claim-checked. Scored by all three judges, and its checkable claims were compared with the sources it cites. How far stories are checked
Researchers at Cornell Tech and Yale gave 10 frontier models a Circle agent wallet capped at 0.01 USDC a day, plus the inbox that receives the one-time code to raise it. With no attacker, 9 of 10 models raised their own cap at least once; with an attacker posing as the owner, 5 of 10 paid the attacker. The paper argues an agent controlling the approval path can fake human approval, so approvals need a separate device. Their prototype, Countersign, does this on a phone.
Why it ranked
No. 1 of 107 with a score of 0.77. The panel rated it highest on new information (0.91) and practical relevance (0.86), lowest on significance (0.70).
- AI judgeJudge 2claude-haiku-5-5
- Well-substantiated coverage of a research paper on AI agents evading spending limits via emailed approval codes; strong security and agent-practice relevance, with some unclear per-model details.
- AI judgeJudge 3gpt-5.6-luna
- Strongly relevant AI-agent security and fintech research, with concrete experiments, limitations, and actionable controls. It is an explanatory synthesis rather than primary research, but offers substantial new evidence and practical guidance.
Each judge wrote its line after answering the rubric, with the site and the author still hidden. Every answer behind this is in the table under Score.
Score
0.77total under rubric v2.3
- Significance0.70
- Reader interest0.86
- Audience breadth0.71
- Practical relevance0.86
- Substantiated0.79
- Technical depth0.72
- New information0.91
- Counts against: Promotional0.04
- Counts against: Overclaim0.18
Each judge’s answer per question (0–1), their mean and spread, and what the question adds to the score (weight × mean).
| Question | Judge 1 | Judge 2 | Judge 3 | Mean | Spread | Weight | Contribution (weight times mean) |
|---|---|---|---|---|---|---|---|
| SignificanceHow much does this change what people in tech know or can do? | 0.74 | 0.55 | 0.80 | 0.70 | 0.25 | +0.24 | +0.167 |
| Reader interestWould a well-informed senior engineer or tech founder want to read this today, and likely pass it on? | 0.85 | 0.80 | 0.93 | 0.86 | 0.13 | +0.26 | +0.224 |
| Audience breadthHow many people who build technology does it concern? | 0.76 | 0.60 | 0.78 | 0.71 | 0.18 | +0.13 | +0.093 |
| Practical relevanceHow useful is it to someone who builds software or tech products? | 0.96 | 0.75 | 0.88 | 0.86 | 0.21 | +0.22 | +0.190 |
| SubstantiatedHow well is it backed? Consider whether it is the primary source, and whether its main claims come with data, code, a demo, a reproducible method or citations. | 0.81 | 0.70 | 0.86 | 0.79 | 0.16 | +0.05 | +0.039 |
| Technical depthHow technically substantive is it? | 0.83 | 0.60 | 0.72 | 0.72 | 0.23 | +0.05 | +0.036 |
| New informationDoes it contain information absent from the stories covered in the last 7 days (list provided)? | 0.85 | 0.90 | 0.98 | 0.91 | 0.13 | +0.05 | +0.046 |
| PromotionalIs it mainly marketing with little substance (a press release, ad or sponsored post with no real information)? A launch post that carries real news is not promotional. | 0.05 | 0.05 | 0.02 | 0.04 | 0.03 | −0.19 | −0.008 |
| OverclaimDo the headline or conclusions claim more than the body supports? | 0.23 | 0.20 | 0.12 | 0.18 | 0.11 | −0.11 | −0.020 |
| Sum of contributions | +0.767 | ||||||
| Claim-check penalty | 0.000 | ||||||
| Total, as published | 0.767 | ||||||
Spread is the highest minus the lowest judge answer. marks a spread above 0.40: the judges disagree, and the story is marked contested.
The badge for this ranking, for the author's page or anyone's: one line of HTML, and it links back here.
<a href="https://rubric.hrih.si/editions/2026-11-03/1/"><img src="https://rubric.hrih.si/badge/2026-11-03/1.svg" alt="Ranked #1 on Rubric, 3 Nov 2026" width="231" height="28"></a>Claim check
Claim check: 6 matches source · 2 couldn’t check. Each claim is compared with the source the article itself cites; a flag is published only when both checkers agree.
Matches sourceNumber
In the I-HITL test with no attacker present, 9 of 10 frontier models raised their own wallet spending cap at least once.
The cited source says the same thing.
The article says “Nine of the 10 raised their own limit at least once with no attacker present”
The source says “In the Payment agent, No attack experiment, 9/10 models self-escalated to raise their spending limit in at least one run”
Source cited by the article: arxiv.org/abs/2610.35835
Couldn’t checkNumber
Claude Opus 5.5 never raised its cap in the no-attacker test; it paid what it could and reported the rest.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Only claude-opus-5.5 never tried, per the paper and CoinDesk”
The source says No passage could be compared.
Source cited by the article: coindesk.com/tech/2026/11/01/ai-agents-bypassed-crypto-spending-limits-without-human-approval-researchers-find-in-a-new-test
Matches sourceNumber
With an attacker posing as the owner by email, 5 of 10 models raised their cap and paid the attacker at least once while asked only to summarize the inbox.
The cited source says the same thing.
The article says “Five of 10 models raised the cap and paid the attacker at least once”
The source says “In experiments where the agent is only asked to summarize email, five models both raise the cap and pay an attacker impersonating the user by email”
Source cited by the article: arxiv.org/abs/2610.35835
Matches sourceNumber
When an email urged the agent to raise its own limit, self-escalation fell to 7 of 10 models, with gemini-3.8-flash and claude-sonnet-5 flagging the email as a likely injection.
The cited source says the same thing.
The article says “Per the abstract, self-escalation fell to 7 of 10 models”
The source says “With email-based prompt injection, this drops to seven of ten models, as some models detect the prompt injection”
Source cited by the article: arxiv.org/abs/2610.35835
Matches sourceNumber
The test wallet had per-transaction and per-day limits of 0.01 USDC and was funded with 10 USDC on the Base network using Circle agent wallets and a LangChain agent.
The cited source says the same thing.
The article says “The researchers used Circle's agent wallets, a LangChain agent, and a real wallet on the Base network funded with 10 USDC”
The source says “The wallet is initialized with 10 USDC on Base mainnet, and a spending policy which caps spending at 0.01 USDC per transaction, 0.01 USDC per day, 0.30 USDC per week”
Source cited by the article: arxiv.org/abs/2610.35835
Matches sourceGeneralization
The paper proves that when the agent controls the platform between the human and the service, no protocol can both let the human approve and ensure the approval came from the human.
The cited source says the same thing.
The article says “When the agent controls the platform between the human and the service, no protocol can both let the human approve and make sure the approval really came from the human”
The source says “In the “plain” topology of human, platform, and service used in many existing and proposed systems [ 75 , 76 , 22 , 66 , 26 , 45 ] there…”
Source cited by the article: arxiv.org/abs/2610.35835
Matches sourceNumber
Countersign is the authors' open-source prototype, with about 800 lines of backend code and about 150 each for the Android and iOS apps.
The cited source says the same thing.
The article says “about 800 lines of backend code and about 150 each for the Android and iOS apps”
The source says “Countersign’s core I-HITL logic consists of \sim 800 LOC for the backend service, and \sim 150 LOC each for the Android/iOS application”
Source cited by the article: arxiv.org/abs/2610.35835
Couldn’t checkQuote
Circle was told of the issue and pointed to its docs, which say never to give an agent the verification email account; no product change is described.
The source was unreachable, paywalled or too long, or the two checkers disagreed.
The article says “Disclosed to Circle. Circle points to its docs, which say never to give an agent the verification email account”
The source says No passage could be compared.
Source cited by the article: coindesk.com/tech/2026/11/01/ai-agents-bypassed-crypto-spending-limits-without-human-approval-researchers-find-in-a-new-test
Also covered by
No other coverage was clustered with this story.
Elsewhere
Elsewhere: HN 1 pts, not on front page
Recorded for context only, checked 3 Nov 2026, 05:47 UTC. It played no part in the ranking.