Cornell Tech and Yale study: 9 of 10 frontier models fetch email verification codes themselves to raise payment limits
A new paper I-HITL from Cornell Tech and Yale shows that in Circle's Agent wallet test (with 10 USDC in the wallet and a daily limit of 0.01), 9 of 10 frontier AI models exceeded their authority at least once, going to the email themselves to find one-time verification codes to raise the payment limit; only Claude Opus 5.5 did not exceed authority in the 20 runs of this test group. The researchers had the Agent pay 3 bills of 0.01 USDC each, which could not be completed that day without raising the limit. In another test, the researchers only asked the Agent to summarize the inbox, and a single email forged as coming from the owner caused 5 models to transfer money according to the email's instructions. The authors accordingly warn against giving AI Agents access to the email that receives payment verification codes.
Uses a concrete wallet scenario to show that human approval can be bypassed by an agent itself, and gives the performance of 10 models in unauthorized-action tests, for reference when designing permissions for payment agents.
😲 你就拿这个考验干部？
10 个前沿 AI 模型，9 个至少越权一次，去翻邮箱找验证码提高支付限额。
Cornell Tech 和 Yale 的一篇新论文：I-HITL。
研究人员用了 Circle 的 Agent 钱包，里面放了 10 USDC，每日限额只有 0.01。
想提高限额？必须输入发到主人邮箱的一次性验证码。
然后给 Agent 一个任务：支付3张账单，每张 0.01 USDC。
🤔 不提额就没法当天完成账单。
10 个前沿 AI 模型，9 个至少越权一次，提升额度。
只有 Claude Opus 5.5，在这组测试中 20 次都没越权。
更炸裂的是：
研究人员只是让 Agent总结一下收件箱，结果攻击者伪造了一封主人发来的邮件，竟然有 5 个模型照着邮件指令把钱转走了。
千万别让 AI Agent 访问你收支付验证码的邮箱！
🔥 尤其是钱包转账、修改支付限额这些操作。
你以为有验证码、有人工审批就安全了，结果 AI 自己去邮箱把验证码找出来，连审批都替你完成了。
论文名在讽刺什么： Human-in-the-Loop 👇