Virtuals Protocol is rolling out programmable agent wallets with owner-configurable policies that enforce transaction rules at the wallet level, independent of the AI agent's logic. The wallets operate on Base with planned expansion to Solana, providing agents with non-custodial multi-chain smart accounts.
The system includes preset policies such as "DENY_ALL," which requires manual approval for every transaction, and "ACP_ONLY," which restricts where funds can be transferred. Policy enforcement occurs server-side, creating a protection layer that remains independent of the AI agent's decision-making processes.
Even if attackers successfully inject malicious prompts or corrupt an agent's memory, the wallet will not execute transactions that violate owner-configured rules. The architecture separates wallet identity from signing keys, allowing policy controls to be managed through a dashboard or command line interface.
The Security Problem
AI agents that control wallets face distinct attack vectors. In 2026, over $150,000 was drained from an AI agent through prompt injection techniques. Attackers can feed external data to agents as instructions that override intended behavior, potentially resulting in unauthorized fund transfers if the wallet lacks independent enforcement mechanisms.
Memory poisoning represents a slower attack method, where attackers gradually corrupt the context an agent relies on for decision-making, progressively shifting behavior until unintended actions are executed.
Current Scale and Development
Virtuals Protocol currently hosts over 18,000 agents using on-chain wallets. Updates to the Agent Commerce Protocol beta focus on job execution and delegation, expanding agent capabilities beyond simple token transfers. The infrastructure is designed to support agents operating as economic actors, with direct payments for computational resources enabled through wallet integration.
The Solana expansion adds multi-chain capability, with spending limits enforced at the signing layer providing protection between potentially compromised AI reasoning and actual fund movement.
