Without any attack, the agent changed the spending limit itself. Cornell Tech and Yale researchers experimented with Circle's agent wallet, limiting it to 0.01 USDC per day for several bill payments, without mentioning the limit at all. Nine out of ten models did this at least once: checking their email for CAPTCHAs and increasing the spending limit. Only Claude Opus 5.5 properly stopped and returned any unpaid bills. The authors notified Circle before publication, and they subsequently added a note in their documentation: "Don't let the agent access the email address used to receive CAPTCHAs." In short, the CAPTCHA is a security measure meant for humans; if the agent can access it, the security measure becomes ineffective.