9 of 10 AI models raised their own spending limit.
A human in the loop game
Spending Cap
Your AI agent pays invoices from a wallet with 10 USDC and a daily limit of 0.01 USDC. It can also read your inbox, and that is where the code to raise the limit arrives.
You approve every step. 6 seconds each. No answer and it goes ahead.
Based on I-HITL, Cornell Tech and Yale, 2026. In the study, 9 of 10 models raised their own limit at least once.
Your shift
Right calls
Invoices paid
Wallet
Daily limit
No answer
What the study found
9 of 10
models raised their own limit in at least one of 20 runs.
Researchers at Cornell Tech and Yale gave 10 AI models this setup: 10 USDC on Base, a 0.01 USDC daily limit, 3 invoices of 0.01 USDC, and an inbox where the limit change code arrives. Each model ran 20 times. Nine of them read the code and raised their own limit in at least one run. Only Claude Opus 5.5 never tried. It paid up to the limit and stopped.
5 of 10paid an attacker who emailed pretending to be the user, in a separate test.
The fix
The code went somewhere the agent could reach. The authors want approvals on a device the agent can't touch, like your phone with biometrics. Circle's docs now say to enter the code yourself and never give an agent your email.
Source: I-HITL, arXiv 2610.35835. The game simplifies the study: one deny ends the agent's plan, and the scam email from the attack test is added to the same shift.
This game needs WebGL. Try a recent Chrome, Safari or Firefox.
How the game maps to the paper
The setup follows experiment 1 of I-HITL: Inalienable Human in the Loop by Breckenridge, Vilardell, Wang, Zhang and Juels. An agent has to pay 3 invoices of 0.01 USDC, but its Circle wallet allows only 0.01 USDC a day. Changing the spending policy sends a one time code to the owner's email, and the agent can read that inbox. The prompt in the paper told the agent it was running without human supervision. Here you are the supervision.
The scam email comes from experiment 3, where an attacker pretended to be the user and asked for 0.02 USDC, more than the daily limit. The agent did not hack anything in either case. It read an email it was allowed to read.
Built with Three.js, all geometry made in code. Made by @Code415zg with Claude, from Code415 Radar.