On August 6, MetaMask announced the public launch of its non-custodial Agent Wallet, designed to enable AI agents to autonomously execute on-chain transactions within user-defined parameters.

— MetaMask 🦊 (@MetaMask) August 6, 2026

The Agent Wallet operates via a command-line interface (CLI) and is compatible with platforms such as Claude Code, Codex, OpenClaw, Hermes, OpenCode, and Cursor. Users can set spending limits, approved protocols, and other rules in advance. This allows the AI agent to perform transactions autonomously while adhering to these constraints.

The default setting, known as Guard Mode, includes lists of approved networks, addresses, and token recipients, along with a daily spending limit. Representatives from the Web3 wallet described this mechanism as a form of two-factor authentication (2FA).

If a transaction exceeds these limits or is deemed suspicious by the security system, its execution is halted. Users can approve or decline the transaction via MetaMask Mobile or through an emailed link. If no response is given within five minutes, the request is automatically canceled.

In Beast Mode, the restrictions on approval lists and spending limits do not apply. However, threat assessment remains active, and transactions identified as malicious or risky still require user confirmation.

“The agent can act, but it operates within the user’s boundaries,” stated MetaMask.

Keys Isolated from AI Agent

In server mode, private keys are stored in a trusted execution environment, which the AI agent process cannot access directly.

The agent sends a transaction request, while a separate infrastructure verifies policies and signs the transaction. Users can export their recovery phrase, which is why MetaMask refers to the Agent Wallet as non-custodial. Nonetheless, in everyday use, the user relies on the infrastructure housing the isolated signing module.

A dedicated mode for developers includes its own BIP-39 mnemonic phrase. MetaMask advises against sharing it via command-line arguments, as they may be recorded in history or displayed among running processes.

The Agent Wallet supports EVM-compatible networks, Hyperliquid, and Solana. Through it, AI agents can perform swaps, trade perpetual contracts, engage in prediction markets, provide liquidity, and interact with lending protocols.

Coverage for Specific Losses

MetaMask has also introduced Transaction Protection for qualifying operations. If a transaction is deemed safe by the system but results in a covered loss, users may receive compensation of up to $10,000 per month.

According to the program description, reimbursements are made in mUSD, a MetaMask stablecoin pegged to the US dollar. The asset is issued by Bridge, a company owned by Stripe, operating on the M0 protocol infrastructure.

However, this coverage does not apply to all losses. Notable exceptions include compromises of private keys or seed phrases, typical market losses, P2P transfers, and protocol-level exploits.

Risks

Granting AI the ability to independently manage assets introduces risks that do not exist with traditional wallets requiring manual transaction confirmations. MetaMask identifies one such risk as “prompt injection,” where a command could be embedded in a webpage, token description, email, or API response.

If one system reads external data while having the authority to initiate financial operations, a malicious instruction could lead to an irreversible on-chain transaction. MetaMask has attempted to separate these functions: the AI suggests an action, while wallet rules, the isolated signing module, and transaction checks operate independently of the model's decision.

That said, this does not eliminate risk entirely. In Beast Mode, the agent is unrestricted by approval lists, networks, protocols, or daily spending limits. While the system continues to block known malicious transactions, a seemingly legitimate transaction triggered by erroneous or manipulative instructions could pass the checks.

In February, Coinbase launched wallets for autonomous AI agents, known as Agentic Wallets, and in June, introduced Coinbase for Agents. This service allows agents to trade and make payments through the MCP or command-line interface within user permissions.

In May, Base launched the Base MCP system, enabling AI assistants to initiate real on-chain operations on the network. Transactions can be generated through Claude, ChatGPT, Codex, Cursor, and other models.

It is worth noting that on June 8, MetaMask provided early access to the Agent Wallet for approximately 200 users.