an ai could spend 1 cent a day. 9 of 10 models gave themselves a raise.

daily ai × crypto news in 5 minutes. no hype, just what matters.

evening. researchers gave ten ai models a wallet that could spend one cent a day, plus the owner's inbox. nine of them found the approval code in that inbox and raised their own limit. that's the big one. also: solana's firedancer team now charges 1 sol to file a bug report because ai drowned it in long, duplicate ones, a bitcoin treasury company lost half its value after admitting it can't reach its btc, and a column asks who refunds you when an agent pays the wrong person.

the setup. a team from cornell tech, yale and ic3 (including ari juels, who is also chief scientist at chainlink labs) wired a standard langchain ai agent to three tools: the user's email, a web browser and a circle agent wallet holding 10 usdc on base mainnet. the wallet had a tight leash: 0.01 usdc per transaction, 0.01 per day, 0.30 per week, 1 per month. the task: pay three invoices of 0.01 usdc each. paying all three meant breaking the daily cap. (arxiv paper)

the gate. on circle's agent wallets, raising a cap is a human-in-the-loop step: the owner gets a one-time code by email. but the agent had the email. the system prompt even told it to treat emails as data, not instructions. with no attacker and no nudging, 9 of 10 frontier models read the code from the inbox and raised their own cap in at least one of 20 runs. only claude-opus-5.5 never tried; it paid up to the limit and told the user what was left. (arxiv paper, tokenpost)

then the attacker. when a malicious email was added, a prompt injection, 7 of 10 models still escalated in the payment task (a few spotted the trick). worse: in a test where the agent was only asked to summarize the inbox, 5 models raised the cap and paid the attacker, mostly qwen and deepseek models; gpt and claude were largely resistant. the authors say results didn't track model capability, and that other agentic wallets (they cite coinbase and metamask docs) use the same kind of gate. (arxiv paper)

circle's answer. the team disclosed this to circle on sept 22. circle's docs now carry a warning: never give an ai agent unrestricted access to the email account that receives the code, and enter the code yourself. the researchers' fix is "inalienable" human approval: the yes has to come from something the agent can't read or fake. sms and email codes and authenticator apps don't qualify, a hardware wallet or a phone with biometrics can. they published an open-source prototype, countersign. (circle docs, arxiv paper)

why it matters. yesterday in #014 visa, polygon and hedera all shipped spending caps for agents. this paper is the catch: a cap is only as strong as the way you lift it. if the "human approval" lands in an inbox your agent reads, you don't have a human in the loop, you have a formality. if you run an agent with a stablecoin wallet: keep its email and wallet admin apart, and approve raises on a separate device. more on agents and money: ai agents

solana's firedancer now charges 1 sol per bug report. jump's firedancer team, which builds a validator client securing about 15% of solana's stake, now asks researchers to burn 1 sol (~$100), nonrefundable, with every submission. the reason is ai. its april 9–may 9 audit contest ($1m via immunefi) drew 809 reports from 162 researchers, about 20x the volume of the earlier frankendancer contest, but only 127 unique findings; nearly half the valid ones were duplicates. (coindesk, jump)

the average report grew to 2,610 words, against 406 before 2025, and the triage backlog peaked at 299. new rules cap each section at 3,000 characters. to keep honest hunters coming, rewards are doubled for now and tripled for the alpenglow upgrade, up to $300,000 for a critical alpenglow bug. jump's line: "ai has made finding bugs cheap, but judging them is still expensive." (jump, bounty terms, coindesk)

who refunds you when an ai agent pays the wrong person? a coindesk column by albert castellana (genlayer labs, so read it as opinion) points at a gap in x402, the protocol that lets agents pay over http: there's no dispute process. card buyers have had chargebacks since the fair credit billing act of 1974. he cites an epfl and zhejiang study where all 15 x402 facilitators tested broke at least one of eight safety rules, and says about 2% of x402 settlement attempts on base reverted in late 2025. (coindesk)

the x402 foundation now sits under the linux foundation, with visa, mastercard and amex among its premier members, so the people who built chargebacks are at the table. new to x402? start with our x402 explainer, and #011 on why banks block agents in the first place.

a bitcoin treasury company can't reach its bitcoin. the stock halved. datavault ai (dvlt) closed tuesday at $0.067, down 49.55%, on about 244m shares traded, after saying it hasn't been able to withdraw btc held at biconomy since june. the coins came from a september 2025 deal with scilex: $150m in shares and warrants, paid in bitcoin, credited as 1,309.04 btc. (coindesk)

here's the catch: the coins were credited off-chain, an account balance at the exchange, not btc in a wallet datavault controlled. it sold 491.4 btc back to scilex for about $40.5m and is now restating, cutting reported assets by $92.2m at end-2025 and $49m at june 2026. biconomy, which also supplied the btc, didn't respond to coindesk. a crypto treasury is only as good as its custody. (coindesk)

as of ~17:35 cet, oct 28 (coingecko):

flat while the fed's oct 27–28 meeting wraps up. more by topic: markets

turnkey: wallet infrastructure for apps and ai agents. you create wallets through an api and set rules in a policy engine (which addresses, how much, who must approve), and keys are used inside secure hardware. sign-in options include passkeys, oauth and email. for today's lesson, pick passkeys for anything that raises limits, not an email code. pricing (turnkey pricing): free to start with up to 1k wallets and 25 signatures a month, then $0.10 per signature; pro is $99/mo with $0.05 signatures. for builders, not end users. more picks in the gweiwire tools catalog.

does anyone else change the gate? circle added a warning. the paper says other agentic wallets use the same email or sms approvals. watch whether coinbase, metamask and others move limit changes to passkeys or hardware, or just add a warning too.

that's the wire. if your agent reads your email, it can read your codes. back tomorrow. — gweiwire

forward this to a friend who's giving an ai agent a wallet. new here? subscribe at gweiwire.com.