By ByteBot
MetaMask shipped a wallet designed for AI agents, not humans. Launched June 8 in early access, MetaMask Agent Wallet gives autonomous agents self-custody access to DeFi across 10 EVM chains — with a $10,000/month transaction protection guarantee and a security pipeline that predates most of the agents that will use it. Only 200 developers got in.
This is not a trading bot layered on top of a custodial exchange account. It is an actual self-custody wallet where the AI agent acts as a delegated signer. You hold the private keys inside a hardware-isolated enclave; the agent gets scoped, revocable “session key” permissions via ERC-7715. The result: an agent can sign and execute transactions without your private key ever touching the agent’s runtime.
Guard Mode: Safe by Default
MetaMask ships Agent Wallet in two operating modes. Guard Mode is the default, and that is a deliberate product decision worth noting.
In Guard Mode, you define the rules at setup: daily spend limits, an allowlisted set of protocols, and a risk profile. The agent operates autonomously within those boundaries. The moment a transaction falls outside them — wrong protocol, over the daily cap, flagged as malicious — execution pauses and MetaMask sends a 2FA approval request via push notification or email. These constraints are enforced onchain, not on a server that some future policy update could quietly relax.
Beast Mode removes the protocol allowlist and lets the agent trade anything. Malicious transactions still surface for 2FA review, and daily spend limits still apply. Most developers building production agents should stay on Guard Mode. Beast Mode is for developers who know exactly what their agent is doing and want to test wider reach.
A Three-Step Security Pipeline on Every Transaction
Regardless of mode, every transaction passes through the same three-step pipeline:
- Transaction simulation — a dry run before any real funds move
- Transaction Shield — Blockaid-powered threat scanning that catches malicious contracts and scam protocols on Ethereum, Arbitrum, Base, Optimism, Polygon, Avalanche, and Linea
- Servo MEV protection — guards against sandwich attacks and front-running bots
Transactions that clear all three steps are covered by a $10,000/month protection guarantee. If a “safe” transaction results in a loss, MetaMask covers it up to that limit. For early access developer testing, that is meaningful insurance.
The context for why this security architecture matters: $45 million was lost in 2026 to autonomous agent incidents tied to protocols allowing excessive permissions with no proper isolation. Guard Mode and the three-step pipeline are a direct response to that pattern.
Supported Chains and Agent Frameworks
Agent Wallet supports 10 networks at launch: Ethereum, Linea, Arbitrum, Avalanche, Optimism, Base, Polygon, BSC, Sei, and Hyperliquid. Solana is not on the list yet.
Framework support targets the tools developers are already using: OpenClaw, OpenAI Codex, Claude Code, Hermes Agent, Cursor, and OpenCode. Agent output is returned as structured JSON that LLMs can parse without a custom connector. If you are already running an agent in Claude Code or Codex, there is no new integration layer to build.
Developers who want to bring an existing private key can do so. BYOK (Bring Your Own Key) mode still routes transactions through the full security stack — simulation, Blockaid scanning, and MEV protection — without requiring a new wallet setup.
How to Get Access
Early access is limited to roughly 200 accepted developers and traders. Access is CLI-only with no web UI at launch. General availability is targeted for summer 2026, with gasless EVM transactions on the roadmap.
Apply at metamask.io/agent-wallet. The ERC-7715 developer quickstart is already live in the MetaMask docs if you want to understand the permission model before access opens up.
The Risk You Should Not Ignore
Guard Mode solves one class of problems: bad agent behavior within a legitimate agent runtime. It does not solve the problem of a compromised agent runtime. Security researchers note that LLM routers — services sitting between users and models — are emerging as high-value attack targets. A malicious injection at that layer can craft apparently valid transactions that fall within your policy limits but serve an attacker’s goals.
The $10K guarantee also does not cover regulatory exposure. AI agents executing autonomous trades sit in a legal gray zone with no clean answer on liability. MetaMask Agent Wallet is well-designed for what it covers. Go in knowing what it does not.
