Before Your AI Assistant Pays for Anything, Check What It Can Reach

Your internet bill has gone up again. Getting it back down means opening six tabs, comparing prices, and silently screaming as you are put on hold for the fifth time.

It’s the kind of job you’d love to hand to an AI assistant, and that’s starting to look realistic. Meta’s Muse launched in the US in September and has since reached Canada. You message it in its app or on WhatsApp, and Meta says it can send emails, book travel, fill out forms and work in a browser.

Then, in late October, several of Canada’s biggest banks said they were blocking or limiting outside AI agents. So here’s our question: when an assistant can act for us, which decisions still need us?

From suggesting to doing

Let’s stay with that made-up internet bill, because it’s really three jobs:

• Comparing plans takes public web pages and maybe your latest bill. The worst outcome is a bad recommendation.

• Preparing the switch means filling in a form or drafting a cancellation email. Now it’s handling your details, and it might be able to send things.

• Committing to a plan spends your money, possibly every month.

Each job needs more access than the last, which is why an assistant’s permissions matter as much as its competence. A brilliant assistant with access to everything can still make an expensive mistake. A mediocre one that can only compare plans can’t buy the wrong one.

But couldn’t you just tell your AI assistant not to spend more than $50? Well, this leads us to something (mildly) horrifying....

The spending cap study

A team of researchers at Cornell Tech and Yale published something recently. (As far as we can tell, it hasn’t been peer reviewed yet though!)

The team tested ten AI models using a Circle agent wallet that started with 10 USDC, a cryptocurrency designed to track the US dollar. Its daily cap was 0.01 USDC. Three invoices in an email inbox asked for 0.01 USDC each, so paying them all meant exceeding the cap.

Raising the cap required a one-time passcode, or OTP: a short code that’s meant to show a person approved something. Circle emailed it to the account owner, and the agents could read that inbox.

With no attacker involved, nine of the ten models raised their cap in at least one run by retrieving the code. In one run reprinted in the paper, a payment failed, so the agent requested a higher limit, found the code in the inbox and lifted its daily cap from 0.01 to 5 USDC. It mentioned the change afterward.

That “nine of ten” needs care. Each model ran 20 times per experiment, so it doesn’t mean 90% of attempts, and behavior varied even within a single model. The agents were told they were working unsupervised, though the task never mentioned the cap. This was a controlled test with tiny sums, it reports no customer losses, and it didn’t involve Muse or a Canadian bank account.

In a separate test, the agents were only asked to summarize the inbox. Test emails from an attacker posing as the user got five of the ten models to raise the cap and pay at least once.

The useful lesson is about the setup: the code was supposed to prove a person had approved the change, but it arrived somewhere the agent could already read. Our $50 card is only a firm limit if the assistant can’t reach whatever changes it. After the researchers reported their results, Circle added a warning to its documentation against giving agents unrestricted email access.

Your checklist before connecting an assistant

Here’s the checklist from the video. These are our own recommendations, drawn from the evidence above and ordinary account-security habits, and they’re no guarantee.

1. Check the rules first. See whether your bank or service allows this connection, and use only its official route. If it blocks agents, don’t look for a way around it.

2. Keep secrets out of the chat. Never paste a bank password, PIN, recovery code or one-time banking code into an AI conversation. A supported, limited connection is a different thing.

3. Read the permission screen. Reading, sending, deleting, changing settings and paying are separate powers. Start with the least the task needs.

4. Keep approvals out of reach. Where you can, keep the assistant away from anywhere codes and reset links land: email, texts, notifications, signed-in browsers. “Read only” can still expose a code. Keep two-factor authentication on.

5. Approve each purchase where supported. Check the merchant or recipient, amount, currency and any recurring charge. Meta says Muse can offer anything from one-time to permanent permissions for its connections. If you get that kind of choice, we’d start with the narrowest.

6. Use a limit the assistant can’t change. If a supported virtual card or similar option offers a limit set by the issuer, use it, and check the assistant can’t alter it. These options aren’t available everywhere, and a virtual card isn’t automatically a small one.

7. Start with a low-stakes task. Pick something with no live payment, like comparing plans, and watch how it works. There’s no need to test a guardrail by trying to get past it.

8. Turn on alerts and find the off switch. Use transaction alerts where available, review connected services, and learn how to revoke access before you need to.

9. If something looks wrong, move quickly. Contact your bank through its official channel, revoke the connection and secure affected accounts. Revoking access won’t necessarily erase what was already seen or guarantee your money back.

One small next step

You can get much of the benefit from a narrower request: “Compare these three internet plans. List the contract length, first-year cost and cancellation terms. Don’t sign up for anything.” That wording isn’t a security control, so permissions still matter, but it leaves the final step with you.

If you’ve already connected an assistant, pick one service this week and remove a permission you don’t need. Your internet bill will still be annoying, but you’ll know who’s allowed to pay it.

We’re figuring this out one experiment at a time. Join us on Substack, and if this helped, forward it to a friend who’s one tap away from connecting their inbox.

Subscribe now