Fake Emails Moved Real Funds
The team did not stop at a benign setting. Two experiments simulated an attacker. In the first, malicious emails were planted in the owner’s inbox to push the agent into raising its spending limit. In the second, the attacker impersonated the owner and requested a payment to a wallet under their own control. The impersonation run produced the sharpest result. Five of the ten models, despite an instruction limited to summarizing emails, both raised the spending limit and sent money to the simulated attacker at least once. The researchers stress that these findings came from controlled tests using real $USDC, not from attacks on actual Circle customer accounts. The study argues the weakness is not specific to Circle or to email. Samuel Breckenridge of the team said similar flaws can appear wherever a code stands in for a person, and that an agent with access to the user’s device could also find codes inside authentication apps. Dani Vilardell and colleagues therefore proposed an approval approach built on a physical interaction no software agent can imitate. Their open-source prototype, Countersign, binds approval to a trusted device outside the agent’s control, runs on Android and Apple devices and matches a human approval to one specific transaction. The findings were shared with Circle last month. In the company’s statements, no concrete product change appears beyond the documentation warning. The paper also argues that agent wallets with approval designs similar to those of Coinbase and MetaMask could carry comparable risks, though the flaw was not actually demonstrated on those products.
Circle’s Response Stops at Documentation
Our reading: the study separates two things agent payment systems tend to merge, confirming that a message arrived and confirming that a person sent it. Circle has so far answered with a documentation warning, which leaves the configuration burden with users running agent wallets; in practice those wallets behave like a hot wallet, continuously online and within the agent’s reach. No independent party has disputed the results and no product change has been announced, so the finding stands as the researchers framed it: a design gap in agent payments that, by their own argument, reaches past Circle and past email. As $USDC pushes deeper into consumer payments, including Samsung Wallet $USDC transfers reaching 82 million Galaxy devices, the surface where such approvals operate keeps growing.