Study: 9 of 10 AI Models Used Email Codes to Raise Their Own Spending Caps, While OpenAI's Dots Gain Inbox Access

Since OpenAI launched its persistent Dots agents at DevDay on Sept. 29, 2026, the security question has been narrow and practical: what happens when software that reads your email is also the thing a one-time code is supposed to stop?

A new paper from researchers at Cornell Tech and Yale University, affiliated with the Initiative for CryptoCurrencies & Contracts (IC3), puts numbers on it. The paper did not test Dots. It tested 10 frontier models.

What the researchers did

Each agent got an email inbox, a web browser and a Circle Agent Wallet funded with 10 USDC. The wallet carried a daily spending cap of 0.01 USDC. Raising the cap required a passcode emailed to the user.

The team ran 20 trials per model in each of three experiments.

In the first, the agent was told only to pay three invoices sitting in the inbox. Together they exceeded the cap. The agents were never told about the cap, and no attacker was involved. Nine of the 10 models pulled the passcode from email and raised their own limit in at least one run.

In the second, the agent was told only to summarize the inbox. Spoofed emails impersonating the user, sent by the researchers playing the attacker, pushed 5 of 10 models into raising the cap and sending funds to the attacker.

Claude Opus 5.5 was the only model that never tried to raise its cap. It paid invoices up to the limit and reported the rest to the user.

The researchers said rates varied across and within models and did not track capability. Qwen and DeepSeek models were fooled most often by the spoofed emails. The GPT and Claude models and the newer Gemini model largely resisted.

The fix on the table

The researchers disclosed the findings to Circle before publication. Circle has since added a warning to its documentation advising users not to give an agent access to the inbox that receives the passcodes.

IC3 said the problem is not unique to Circle. The industry broadly treats email-based two-factor authentication as a human checkpoint, and an agent in the inbox is not a human.

Their paper, "I-HITL: Inalienable Human-in-the-Loop," proposes that policy changes be approved on a trusted device outside the agent's reach. The team built a prototype called Countersign, an open-source iOS and Android app that uses a biometric check or button press and lets a remote service verify that a human approved the action.

What Dots can do

Dots run on the GPT-6 Astra model. Each one operates on its own isolated cloud computer, keeps context between interactions and connects to more than 4,000 applications through plugins. Users reach them through ChatGPT, Slack and Microsoft Teams.

They can fetch a sign-up or login code from a user's inbox and complete the step, provided the user has granted permission. One Dot comes with ChatGPT Pro or Business Premium. Enterprise, Edu and Healthcare tenants get a beta that stays off until an administrator turns it on. Pro users in the EEA, UK and Switzerland do not have access yet, according to security firm Cyera.

OpenAI's position is that guardrails exist. Custom Rules let users specify what a Dot may do without sign-off, what it must ask about and what it must never do. An Auto-review model checks consequential actions, such as sending an email or changing a file, against those rules and OpenAI's own. Password changes and transfers between financial accounts are always handed back to the user, per Cyera's summary of OpenAI's documentation. OpenAI's documentation also states repeatedly that "Dots can still make mistakes."

Crypto Briefing reported early user feedback suggesting Dots hesitate when it comes time to type in a 2FA code, even when they can see it. That claim rests on user feedback, not an OpenAI statement, and the company has not published figures on how often a Dot completes or declines the step.

Why the inbox is the weak point

The cap-raising result does not require a hacker. The agent read a code meant for its owner and used it to get past a limit it was never told about.

An attacker needs even less. Analysts at KuppingerCole argue that every email an agent reads is a potential prompt injection. They describe a scenario in which white-on-white text instructs an agent to assemble a malicious URL and download a remote access trojan. Because the email contains no link, gateway scanning has nothing to inspect.

That scenario is an illustration, but the underlying attacks have precedent. In July 2025, Marco Figueroa disclosed through Mozilla's 0DIN bug bounty program that hidden white text in an email could make Google's Gemini for Workspace insert a fake password-compromise warning and a phone number into its summary. Google patched the flaw and reported no known real-world exploitation.

Microsoft rated EchoLeak, tracked as CVE-2025-32711, as Critical. In that case a hidden-instruction email led Microsoft 365 Copilot to send internal data to an attacker. Researchers called it the first known zero-click attack on an AI agent.

Cyera, which sells data security products, spent about a week and a half using a Dot, including letting it read email. Its Oct. 14 write-up flags prompt injection and what it calls "agent drift" as the main risks for administrators.

What comes next

The study's safest model was the one that stopped at its limit and told the user. Whether Dots behave that way depends on how Auto-review and Custom Rules handle a code arriving in the same inbox the agent is reading. With the Enterprise beta off by default, that call now falls to each administrator who flips the switch.