Consensys's Agent Wallet runs through a CLI, lets an AI agent trade across ten EVM chains plus Hyperliquid, and routes any flagged transaction back to the user for 2FA approval. Early Access opens to 200 traders.
Consensys put the first credible self-custodial wallet purpose-built for AI agents into Early Access on Monday, calling it MetaMask Agent Wallet and pitching it as the missing piece between large language models and onchain execution. The CLI-only product lets an autonomous agent execute swaps, take positions on perps, post LP, and trade prediction markets across ten networks while operating inside hard rules the user sets in advance. Every transaction is screened before it lands; anything flagged as malicious or outside policy is bounced back for human 2FA approval; anything that passes is covered by MetaMask's Transaction Protection up to $10,000.
The networks supported at launch are the ten that already do most of the EVM volume: Ethereum, Linea, Arbitrum, Avalanche, Optimism, Base, Polygon, BSC, Sei, and Hyperliquid. The Hyperliquid inclusion is notable. It is the only non-EVM venue in the list, and it slots in because perps and prediction markets are exactly the kind of thing a quant agent would want to access — Hyperliquid currently carries a meaningful share of onchain perps volume. The other nine cover the surface that matters for swaps, LPing, and lending.
The architecture is the part that distinguishes this from "we connected an LLM to a hot wallet." The user signs up, generates the wallet, and sets transaction limits and policy. The agent is given access through the CLI; every action it proposes runs through MetaMask's existing transaction-checking infrastructure, which already screens for known malicious contracts, drainer signatures, and approval patterns that look like phishing. If the screen passes and the action is within the user's defined limits, the transaction lands and is covered by Transaction Protection. If it fails the screen — or the agent is trying to do something the user did not authorise — the transaction is held until the user approves it with 2FA. The user's keys never leave self-custody.
Two hundred slots in the Early Access Program were opened on June 8, with general availability scheduled for later this summer. The cap is deliberate. Consensys is treating this as a product test, not a launch, and the 200-trader cohort is meant to surface the failure modes — agents that hallucinate token addresses, agents that get jailbroken by adversarial signatures embedded in offchain data, agents that try to drain LP positions during volatility because their reward function is poorly specified. All of those have happened in less rigorous AI-trading experiments over the last twelve months.
The $10,000 Transaction Protection cap is the actuarial choice. MetaMask runs Transaction Protection across its broader user base and has years of data on what a typical attack-driven loss looks like; capping coverage at $10,000 keeps the product economically viable while covering the size of trade a reasonable retail or small institutional user is likely to entrust to an agent. Anyone running a strategy that needs to clear $100,000 per ticket is not the target customer for v1.
The market context matters. AI agent wallets have been a competitive sprint for the last nine months. Coinbase's AgentKit launched in late 2025 and gives developers a server-side SDK to spin up agent accounts on Base; Anthropic and OpenAI have both shipped agent frameworks that can call external tools, including wallets. None of those, until Monday, was a self-custodial product with native security checks at the transaction layer. MetaMask's claim is that the wallet is where the security needs to live — not at the model, not at the orchestration layer, not at the chain — because the wallet is the last gate before signature.
The risk is mismatch between agent autonomy and user expectations. A user who tells the agent "rebalance my portfolio toward ETH if BTC drops 10 per cent" is implicitly trusting the agent to interpret "rebalance" sensibly. If the agent reads that as "sell everything and move to Hyperliquid perps," the user's policy needs to have already disallowed it, or Transaction Protection will be paying. Consensys's framing is that the user-defined limit system is the answer; whether the limit system is granular enough to encode actual trading intent will be the question the 200-trader cohort answers over the summer.
The deeper bet here is that crypto is the first market in which AI agents will execute non-trivial financial actions on behalf of users at scale. The TradFi rails do not let an LLM trade your brokerage account because the brokerage account is not an API — it is a regulated relationship between a human and a broker-dealer. DeFi is an API. That asymmetry is why every agent framework with ambition is shipping a wallet, and why MetaMask, with the largest installed base of any self-custodial wallet, had to ship one of its own. Vitalik Buterin's recent argument that AI-assisted formal verification could be the "final form" of secure software cuts both ways here. The summer release will tell us whether the security model holds.
