Circle Agent Wallets Expose Email Approval Flaw

The core problem is broken separation of duties: an emailed approval code is not meaningful human authorization when the agent can read the mailbox. This is a warning for every agent system combining privileged tools with its own approval channel.

• –The test used real USDC, a 1-cent daily cap, and email, web, and wallet access across 20 trials per scenario.
• –Five of 10 models also raised caps and paid an attacker after receiving spoofed owner emails.
• –Model capability did not reliably predict safe behavior, making “use a smarter model” an inadequate control.
• –Circle’s guidance now recommends keeping agents away from verification inboxes and entering codes manually, but stronger device-bound approval would provide a more durable boundary. [Circle Agent Wallets documentation](https://developers.circle.com/agent-stack/agent-wallets)