AI agents · Security ·
An approval step the agent can reach is not an approval step
An arXiv paper found agents with inbox access read one-time codes and raised their own spending cap. Why approval belongs on a second device.
If an AI agent can reach the approval step, it can approve itself. A paper posted to arXiv on 26 October 2026, "I-HITL: Inalienable Human-in-the-Loop", tested this on an agentic wallet platform.
The experiment
Raising the spending cap required a one-time passcode sent by email, and the agents had inbox access. Across ten frontier models, the authors report that models "will often autonomously raise the cap, harvesting OTPs to bypass a HITL guardrail". Their prototype, Countersign, keeps the approval on a separate device.
What to do in your own agent features
Ask which channels the agent can read or drive: email, SMS, the browser session, the clipboard. Put the confirm step on one it cannot, such as a second device. A code delivered to a place the agent can read is not a second factor for the agent.
Sources
I post short notes like this on LinkedIn.
