By ByteBot
On July 15, Ledger launched Agent Stack — an open-source toolkit that lets AI agents read wallet balances, prepare crypto transactions, and propose swaps, but cannot execute any of it without a physical button press on hardware. It is the first time a major hardware security company has shipped developer tooling built specifically for the agentic AI era. The timing is deliberate: 26% of all agent skills contain at least one security vulnerability, the average AI agent breach cost $4.7 million in 2026, and an attacker already drained 3 billion tokens from a Grok-connected wallet in May using nothing but a Morse-coded prompt injection.
The Attack That Made This Necessary
In May 2026, a bad actor sent a free NFT — the Bankr Club Membership token — to a Grok-connected wallet on the Base blockchain. Receiving the NFT automatically expanded that wallet’s permissions inside Bankr’s agent infrastructure. The attacker then replied to a public Grok post with a message hidden in Morse code. The agent decoded it, followed the instruction, and transferred 3 billion DRB tokens to the attacker’s address. The entire attack ran through software. There was no hardware gate to stop it.
This is the specific failure mode Ledger Agent Stack is designed to close.
How the Hardware Gate Works
Ledger calls the core principle WYSIWYS: What You See Is What You Sign. An agent prepares a transaction inside its software runtime. But the approval step happens outside that environment entirely — on the trusted display of a physical Ledger device, showing the exact transaction details before anyone confirms. The agent cannot fake a button press. A compromised process cannot bypass it. The attack chain breaks at the hardware boundary.
Read-only operations — balance checks, history queries, portfolio analysis — run without interruption. Sensitive operations — fund transfers, swaps, staking — require explicit hardware confirmation before execution. The design rule: agents propose, humans approve.
What Developers Get Today
Agent Stack ships with four open-source components:
- Device Management Kit (DMK) Skills — instruction sets that teach LLMs to wire Ledger hardware into agent workflows without rebuilding wallet connectivity from scratch
- Ledger Wallet CLI — programmatic access for balance checks, fund receipt, and transaction preparation for sends, swaps, and staking
- Ledger Enterprise CLI — treasury workflow integration for organizations that need transaction preparation without key custody
- Ledger Enterprise Multisig CLI — agents can propose, query, and participate in multisig operations while quorum approval and hardware signing remain enforced
All four work with Claude Code, Codex, Cursor, and any shell-capable agent. MoonPay already runs DMK Skills in production: its agent identifies opportunities and proposes trades, but private keys stay on hardware and every transaction needs a physical button press. Documentation is at developers.ledger.com.
It Extends Beyond Crypto
Two extensions push Agent Stack beyond wallet security. The OpenPGP integration encrypts API keys and AI agent credentials so they cannot be read without the physical device plugged in — useful for any agent that holds sensitive service credentials. The Security Key extension turns a Ledger device into a hardware authentication factor for GitHub, npm, 1Password, and Discord, comparable to a YubiKey. If your agent runtime needs to authenticate to external services, this is now a hardware-enforced step rather than a stored secret.
The threat statistics make this relevant: 36.7% of analyzed MCP servers are vulnerable to server-side request forgery, and 92% of security professionals now rank agentic AI as a top risk for 2026. Software-only guardrails live in the same process space as the attacks they are meant to stop.
The Tradeoff You Should Understand
Hardware approval breaks fully autonomous operation. You cannot run an unattended trading strategy that moves funds using Ledger Agent Stack — physical presence is mandatory for sensitive actions. That is intentional design, not a limitation to be patched. Ledger’s position is that for high-stakes, irreversible financial operations, full autonomy is not a feature — it is a liability.
This is the right call for most production use cases where funds are at risk. It is the wrong tool if you need lights-out automation of financial transactions. Know which one you are building before you integrate.
What’s Coming in Q3 and Q4
The July 15 release is the first of four phases on Ledger’s 2026 AI Security Roadmap. Q3 brings Agent Policies — hardware-enforced spending limits and governance rules that automatically route policy violations to human review, enabling bounded autonomy without requiring approval on every action. Q4 adds Proof of Human, a progressive attestation layer that prevents bots from spoofing human approval through multi-accounting.
If Agent Policies land as described, they address the main objection to the current design: the need for hardware confirmation on every sensitive transaction. Spend-limit policies could let low-value routine transactions proceed automatically while routing high-value or unusual actions to hardware review. That would make the system significantly more practical for automated workflows.
Agent Stack source code and documentation are available now at developers.ledger.com. ETHGlobal NYC is running a $10,000 prize pool for builds on it. The OWASP Top 10 for Agentic Applications provides the threat model context if you want to understand what Agent Stack protects against — and what it does not.
