Self-custody wallets have long rested on a single principle: only the user touches the keys. At Token2049 Singapore, representatives tied to MetaMask, Trezor and ChangeNOW took up the question of whether an AI agent should ever get a turn — and what safeguards are needed if it does.
The wallet session brought together three companies occupying different layers of the self-custody stack. MetaMask is the software wallet many users first encounter when opening a decentralized application. Trezor builds hardware wallets that keep private keys on a dedicated offline device. ChangeNOW runs swap infrastructure that moves assets between chains.
MetaMask's Agent Wallet sets the backdrop
MetaMask arrived with a shipping product behind the discussion. Its Agent Wallet launched in early access on June 8, 2026, with the company expecting a broader rollout in summer 2026.
The pitch is that AI agents can execute DeFi transactions across platforms while the user remains in charge. The wallet is self-custodial, meaning keys stay private and are not handed to MetaMask or the agent. Users set their own safety rules, and the wallet enforces them.
Several protections sit underneath that framework:
- Transaction simulation: transactions are simulated before execution so users can see the likely outcome first.
- Threat scanning: Blockaid-powered scanning looks for malicious contracts and suspicious activity.
- MEV protection: MEV, or maximal extractable value, refers to profits that bots and block builders capture by reordering or front-running pending transactions — for an ordinary user, it can mean quietly paying more for a trade than expected.
The Agent Wallet's Transaction Protection coverage extends up to $10,000 per month.
Where Trezor and ChangeNOW fit
Trezor's hardware wallets store private keys on a dedicated device and secure transactions on EVM networks, the family of blockchains compatible with Ethereum.
ChangeNOW's API enables non-custodial swaps and integrates with MetaMask, helping users trade assets across networks without first depositing them with a centralized exchange.
Why agents complicate wallet security
Self-custody has always placed the burden on the user: you hold the keys, you sign every transaction, and you live with every mistake.
AI agents change that equation. The entire point of an agent is that it acts without the user approving each step. That is convenient, and it is also precisely the behavior security teams have spent years warning users against.
That is why the guardrails matter more than the AI itself. User-defined limits, pre-execution simulation and threat scanning are the difference between delegation and abdication.
What to watch
For everyday users, the immediate takeaway is that AI-powered wallets are no longer a slide in a pitch deck. MetaMask has a product in early access, and the rest of the stack is being built to plug into it.
The open questions are practical ones. Does the broader Agent Wallet rollout happen on the schedule MetaMask expected? Do hardware makers add agent-aware approval flows?
The industry spent a decade teaching people never to share their keys. Its next challenge is teaching them how to share authority without sharing control.
