The day your agent can spend money

This week MetaMask launched an Agent Wallet: a wallet built for AI agents, letting a bot watch markets, generate trades, and execute them across DeFi — swaps, perpetuals, prediction markets — faster than a human at a keyboard. It's live across ten chains, with general availability coming this summer. Agents can now hold money and spend it on your behalf.

That's a genuine milestone, and I want to take it seriously in both directions: it's useful, and it's the moment a lot of hand-wavy agent risk becomes concrete. Because everything I've written about agents being unreliable, over-trusting, and hard to oversee was, until now, mostly about getting a wrong answer. The wallet changes the stakes. A wrong answer you can correct. An irreversible payment to a stranger you cannot.

Crypto is the worst possible place to be wrong

If you wanted to design the highest-stakes environment for an autonomous agent to make a mistake, you'd build something a lot like on-chain finance. Transactions are irreversible — there's no chargeback, no support line, no undo. The counterparties are pseudonymous, so stolen funds are hard to trace and harder to recover. It runs 24/7 with no business hours to slow anything down. And it's adversarial by default — a global crowd actively probing for anything it can drain.

Now put an agent in that environment with access to a private key, and the failure modes I keep writing about acquire a dollar value. The prompt injection problem isn't a leaked string anymore; it's a transfer. In fact it already happened: in May, a prompt-injection chain reportedly hid instructions in Morse code inside a social-media post and coerced an AI into decoding them, nudging an automated wallet to move funds. As one write-up put it bluntly: if an agent controls a key with unlimited access, a single prompt injection, bug, or malicious tool call could drain the funds. The capability everyone wanted is also the capability an attacker most wants you to give your agent.

The one idea that makes it survivable

Here's why MetaMask's launch is worth studying rather than just fearing: the design encodes the right answer. The wallet's whole premise is that the agent can act autonomously, but only inside rules the user defines. Every supported transaction runs through a mandatory security pipeline, and anything that's flagged or falls outside policy — over a daily spend limit, routed to a protocol you didn't allowlist — stops and requires a human approval before it can execute.

That phrase — bounded autonomy — is the whole lesson, and it generalizes far beyond crypto. The choice was never "fully autonomous agent" versus "no agent." It's "autonomous within hard limits you set in advance." The agent gets to be fast and independent on the small, reversible, in-policy stuff, and the moment it reaches for something big or unusual, a wall stops it and a human decides. Unlimited keys is the mistake. A leash with a defined length is the design.

What to take from this even if you never touch crypto

Most of you aren't wiring an agent to a DeFi wallet. But anything an agent can do that you can't undo — send the email, delete the records, deploy to production, issue the refund, place the order — is the same problem wearing different clothes. The template MetaMask shipped is the template for all of it:

• Bound the blast radius before you grant the capability. Decide the limits — amounts, allowlisted destinations, rate caps — first, and make them hard constraints the agent can't argue past. Capability without a budget is a loaded weapon.
• Make irreversible actions stop for a human. Reversible, small, routine: let the agent run. Irreversible or out-of-pattern: it pauses and waits for a yes. The confirm-before-irreversible rule is the line between automation and a story you'll regret.
• Assume the input is hostile. An agent that acts on the open internet will be targeted — through its tools, its data, its prompts. Screen what comes in, and never let untrusted input flow straight into an action with consequences.
• Decide who's accountable before the loss, not after. When the agent moves the wrong money, "the agent did it" is not an answer. A named human owns the policy and the outcome.

The bottom line

Giving agents wallets is the point where the AI-agent story grows up, because it's the point where being wrong costs money you can't get back. MetaMask deserves credit for not shipping the naive version — unlimited autonomy, full keys — and instead building the boring, correct thing: an agent that's free to act inside a fence you control, and forced to stop at the edge of it.

So when you feel the pull to let an agent do something real and irreversible, borrow the pattern. Don't ask "can my agent do this." Ask "what's the most damage it can do before a human or a hard rule stops it" — and design that number down to something you could survive on your worst day. The agents that get trusted with real money, and real consequences, won't be the smartest ones. They'll be the ones on the shortest leash.