MetaMask Launches Agent Wallet for Autonomous AI Trading

MetaMask has opened general access to Agent Wallet, a self-custodial wallet built for AI agents to trade and transfer funds within spend limits and protocol allowlists the user sets in advance, moving the product out of the early access period that began in June 2026.

What the Wallet Does

Agent Wallet is separate from a user's main MetaMask wallet. It is built specifically for AI agents to execute swaps, perpetual futures trades, prediction market bets, and transfers, all inside rules configured before the agent starts operating. The pitch is straightforward: let an agent act on opportunities in real time without handing it unrestricted access to a user's funds.

The problem it targets isn't agent capability. Models are already capable of monitoring markets and reasoning across protocols. The problem has been custody: giving an agent enough access to act without giving it unrestricted control of a wallet's funds. Agent Wallet draws that boundary at the protocol and infrastructure level rather than relying on the agent's own judgment.

Setup runs through the MetaMask Agent Wallet CLI. A user installs the CLI, adds the relevant skills, sets spend limits and an allowlist of protocols, picks an operating mode, and then interacts with the agent through plain-language prompts. MetaMask handles simulation, threat scanning, and execution protection before anything reaches the chain.

The wallet works with a range of agent frameworks, including Claude Code, Codex, OpenClaw, Hermes, OpenCode, and Cursor. Agents don't need to hold native gas tokens to transact. MetaMask settles fees in whatever token is being moved, removing a common friction point for automated wallets that otherwise need a separate balance just to cover gas.

Guard Mode and Beast Mode

The wallet ships with two operating modes that set how much latitude an agent has.

Guard Mode is the default. It restricts the agent to an allowlisted set of protocols, enforces daily spend limits, and requires two-factor approval for any transaction that falls outside those bounds. It's aimed at everyday users who want automation without much exposure.

Beast Mode removes the protocol allowlist, letting the agent interact with anything onchain. Malicious transactions are still blocked automatically, and anything flagged gets escalated for two-factor approval rather than executed outright.

The two-factor step itself works through a push notification, sent by email or to the MetaMask mobile app, that describes the pending transaction in plain language. Users approve or reject with a single tap, and an unanswered request auto-declines after five minutes.

On custody, users choose between a server wallet, where keys sit inside a trusted execution environment run through infrastructure from Cubist, or a bring-your-own-keys setup. Keys can be exported at any point under either arrangement.

The Security Pipeline

Every supported transaction on EVM chains passes through three checks before it's allowed to land. MetaMask first simulates the transaction to preview balance changes, approvals, and gas costs. It then runs threat scanning through Blockaid, which is designed to catch and block malicious transactions automatically. Execution itself is routed to limit MEV exposure, aiming to prevent value from leaking to sandwich attacks or similar extraction during the trade.

MetaMask says eligible transactions are covered under its Transaction Protection program up to $10,000 per month, a figure the company has attributed to its own coverage terms rather than an independently audited guarantee. Policy enforcement and the two-factor human approval step function as the final backstop for anything a transaction can't clear automatically.

Supported Chains and What Agents Can Do

Agent Wallet supports a wide set of EVM-compatible networks, including Ethereum, Optimism, BNB Chain, Polygon, Monad, Hyperliquid, Sei, MegaETH, Base, Arbitrum, Avalanche, and Linea, among others.

Within those networks, agents can check balances, send tokens, swap and bridge assets, open perpetual futures positions on Hyperliquid, place bets on prediction markets such as Polymarket, batch multiple swaps through ERC-7821, and decode raw calldata into readable instructions. That decoding step is meant to keep an agent's context window focused on clear, structured commands rather than raw transaction data. This kind of bounded access could expand how much onchain activity happens without direct human execution, particularly for tasks like portfolio rebalancing or opportunistic trades that need to happen faster than a person can act.

What to Watch

Open questions remain around agent-held capital: how adoption looks among non-technical users, how attack surfaces shift as more agents hold funds directly, and how regulators eventually treat autonomous trading agents operating with real money. Whether competing wallets ship comparable guardrails, and whether the amount of capital held directly by agents becomes a metric worth tracking, are likely the next signals of how far this model spreads beyond early adopters.