MetaMask's Agent Wallet Lets AI Trade Onchain: Inside Your Rules

MetaMask launched Agent Wallet on August 6, a self-custodial wallet designed to let AI agents execute onchain transactions while staying inside rules the user defines in advance. The product, first tested with roughly 200 early-access users in June, is now open to traders and builders ahead of a general release the company says is coming this summer.

Related reading: Senate Republicans Release a 630-Page Clarity Act Rewrite Days Before a Do-or-Die Vote · Binance Pauses Withdrawals as Up to $5.6 Billion Leaves Its Wallets.

The framing is a direct response to the obvious objection. Giving an autonomous agent a wallet means giving it the ability to lose your money, quickly and at machine speed. MetaMask's answer is not to restrict the agent to a fixed script but to constrain it at the wallet layer. Users set daily spend limits, an allowlist of protocols and a risk profile; the agent then monitors markets, prepares transactions and executes within those boundaries. "Agent Wallet is not about giving an agent unlimited access," the company wrote. "It is about defining what the agent is allowed to do, then enforcing those rules at the wallet layer."

Guard Mode, Beast Mode and the security pipeline

MetaMask offers two operating postures. Guard Mode, the default, enforces daily spend limits and protocol allowlists and requires two-factor approval for anything outside the user's policy. Beast Mode is opt-in for users who want fewer interruptions: it permits trading with any protocol, but malicious or flagged transactions are still blocked and surfaced for approval. In both modes, the company says, the agent cannot bypass the security check.

Supported EVM transactions pass through a three-step pipeline before they land. First, transaction simulation previews what a transaction will actually do, balance changes, approvals and gas routing. Second, threat scanning powered by Blockaid, which MetaMask says has been tested across millions of its transactions, tries to catch malicious transactions before they reach the user. Third, "Smart Transactions" execution applies MEV protection so that transactions do not leak value to front-running bots. Flagged transactions are auto-rejected or routed to the user for 2FA through MetaMask Mobile or an email link.

For eligible transactions that clear all three checks and still result in a loss, MetaMask offers Transaction Protection coverage of up to $10,000 per month. The coverage is a notable concession: it implicitly acknowledges that even a well-reviewed transaction can go wrong.

An interface built for software, not thumbs

The deeper design choice is the interface. Most wallets are built for a person tapping a screen: a confirmation dialog, a fee selector, a QR code. An agent needs something else, a command surface it can call, structured output it can parse, and error codes precise enough to let it retry intelligently.

MetaMask's answer is a command-line tool, mm, plus installable "skills" that translate natural-language requests from an agent into wallet commands. The wallet connects to a striking list of agent frameworks: Claude Code, Codex, OpenClaw, Hermes, OpenCode and Cursor. The intent is framework-agnostic plumbing, the wallet does not care which model is driving, only that the requests arrive as commands and the responses come back as JSON an LLM can read. MetaMask says the setup also lets agents self-improve over time through granular error codes and hints.

Self-custody is preserved in the familiar way: users hold their own keys and can export their Secret Recovery Phrase. Developers can bring their own wallet or use a server wallet whose keys are held separately from the user's primary wallet.

The wallet is not replacing the human with an agent. It is inserting the agent into a transaction flow that the human still governs.

The real question: what does "permission" mean?

MetaMask's permission model draws on an idea already common in blockchain gaming and some DeFi tools: the session key. Rather than handing an agent the master private key, the wallet grants a scoped credential that can authorize only certain transaction types, up to certain values, within a certain window. When the limit is hit or the session expires, the agent's authority evaporates. The master key is never exposed.

That is a meaningfully better design than account abstraction wallets that fund an agent with a prepaid balance and hope for the best. But it also has limits, and the company is honest that the first version is limit-based rather than intent-based. Independent analysis noted that MetaMask has not said whether Agent Wallet includes intent verification at launch, with richer policy enforcement described as a roadmap item.

The distinction matters because the hard security problem in agentic finance is not whether the agent can overspend (limits solve that) but whether the agent can be tricked into authorizing a transaction the user would never have approved. A prompt-injected agent can compose a transaction that is within every rule and still economically disastrous. Simulation and threat scanning catch known patterns; they cannot fully solve adversarial reasoning. That is why the industry's next battleground is likely intent verification: proving both that a transaction is permitted and that it is what the user meant.

The wider agentic-wallet race

MetaMask is not first to market. Coinbase introduced agentic wallets in February 2026, MoonPay expanded its AI-agent strategy in March and brought its MoonAgents platform to Telegram in July, and Cloudflare shipped a custodial wallet-as-a-service primitive for AI agents in June. The dominant designs so far have been custodial or built on prepaid account-abstraction wallets, which put the keys and the risk in someone else's hands.

MetaMask's differentiator is that it is non-custodial, multi-chain and, per its own pitch, framework-agnostic with mandatory security on every move. It also has distribution: MetaMask is one of the most widely installed crypto wallets in the world, which means an agentic layer reaches an existing user base rather than trying to build one. Disclosure: MetaMask is a product of Consensys, an investor in Decrypt, whose coverage this article draws on.

There is a broader reason the timing is not accidental. Stripe, Cloudflare and several crypto-native protocols have each shipped or announced mechanisms for AI agents to hold and spend funds over the past year. The payments layer for machines is being built in public, and whoever supplies the wallet becomes the choke point through which agent-initiated value moves. For a wallet company, being early to that is existential.

Self-custody, and what it protects

The label "self-custodial" carries weight in crypto, and it is worth being precise about what MetaMask is and is not claiming. The user's keys remain under the user's control; the wallet can export the Secret Recovery Phrase, and a developer can supply their own key material rather than trusting MetaMask to hold it. A server-wallet option exists for teams that want keys held separately from a user's primary wallet, but the architecture still routes through MetaMask's security pipeline.

The benefit is that no intermediary can freeze the agent's funds or change the terms mid-stream, which is the failure mode that makes custodial agent wallets uncomfortable for crypto-native users. The cost is equally real: there is no support line that can reverse a bad transaction, and no custodian to blame. Self-custody gives the user control and, with it, the responsibility. For a person who barely understands what their agent did, that is a difficult combination.

Gasless execution is a quiet but important unlock

One of Agent Wallet's less-discussed features may matter more than the modes. MetaMask abstracts gas: an agent can transfer or swap without holding the chain's native token, because the wallet settles the network fee in the asset being moved. For human users this is a convenience. For agents it is closer to a requirement. An autonomous strategy that has to pause because it ran out of the chain's gas token is not autonomous at all, and requiring a human to top up a balance defeats the premise. Removing that dependency is what lets an agent run unattended long enough to be useful.

The design question the whole sector is circling

Step back, and Agent Wallet is one attempt to answer a question every payments and wallet company now faces: when software spends money, who is accountable? The custodial model answers it with an institution that can intervene. The key-based model answers it with cryptography and, increasingly, with policy engines bolted onto the signing path. MetaMask's contribution is to insist that the checks be mandatory and the keys stay with the user, then to price the residual risk with an insurance-like cap. It is neither the cheapest nor the most permissive design. It may be the most defensible one to ship to consumers first.

Why this matters

Agentic finance has a trust problem that is different from ordinary crypto security. A person who loses funds to a scam can usually point to a moment where they clicked the wrong thing. When an agent loses funds, there may be no such moment, just a transaction that satisfied every rule. That erodes the intuition on which most self-custody advice rests: that the user is the last line of defense.

MetaMask's bet is that the line of defense can be moved into the wallet itself, made mandatory rather than opt-in, and expressed as rules a user can actually understand. It is a reasonable place to start. But rules-based guardrails are a ceiling, not a floor, on what agentic finance can safely do, and the industry will keep testing that ceiling.

What to watch

Three things will show whether Agent Wallet works. First, adoption beyond crypto-native early users, whether ordinary traders trust an agent with even a limited budget. Second, whether intent verification arrives, and how quickly. Third, how the coverage and liability question resolves: if an agent loses money inside the rules, who is responsible? MetaMask's Transaction Protection gives a partial answer. The rest is still policy, not product.