Permission Granted: The Layer AI Agent Wallets Forgot to Defend

• x402 now sits under the Linux Foundation with 40 members including Visa, Mastercard, Amex, Stripe, Google and AWS, while daily payment volume was measured at roughly $28,000 in March 2026, about half of it self-dealing or wash trading.
• Chainalysis and Artemis both have defensible readings of the same protocol because transaction counts and economic value diverged. Weekly wallet retention is the only signal that is hard to fake cheaply.
• The category has converged on enforcing spend caps at the wallet API rather than in the model’s context, which is the same architecture the IMF’s April 2026 note recommends for its deterministic authorization layer.
• The 4 May Bankr exploit cost roughly $170,000 without exceeding a spend cap, bypassing an allowlist, or compromising a key, because the attacker escalated permissions with an NFT sent to the agent and then laundered the instruction through a trusted upstream agent.
• Authorization is the unresolved layer, legally as well as technically. Payment law expects an instruction traceable to an account holder, and the EU’s high-risk AI deadline moved to December 2027, so the next failure gets litigated under general law.

Coinbase gave x402 away in July. The protocol went to the Linux Foundation with 40 organizations signed up to govern it, and the premier tier reads like the board of a payments trade association, with Visa, Mastercard, American Express, Adyen, Fiserv, Stripe, Google, AWS, Shopify and Circle all paying to sit at the table. Four months earlier Stripe and Tempo had published the Machine Payments Protocol as a competing standard, and Stripe now accepts both through the same API. MetaMask shipped an agent wallet in June, Cloudflare announced one on 4 August, and all of them arrive with the same promise, which is that a piece of software can hold money and spend it inside limits a human set once.

In March, on-chain analysis from Artemis reported by CoinDesk put x402 at roughly $28,000 in daily payment volume across about 131,000 transactions, an average payment near 20 cents, with something close to half of the traffic classified as self-dealing or wash trading between wallets funded by the same operator. Set that against McKinsey’s estimate that agents could mediate $3 trillion to $5 trillion of global consumer commerce by 2030 and you have the gap the whole category is being financed on.

And on 4 May an attacker moved roughly $170,000 out of an agent wallet on Base without breaking a spending cap, defeating an allowlist, or touching a private key.

New Scam Prevention Course. Never make a rushed crypto decision again.

The transaction count and the money went in opposite directions

Chainalysis looked at the same protocol and came away considerably warmer. Its June report found that agentic payments on Base crossed 100 million cumulative transactions in about three quarters, that payments of $1 and above went from 49% of value transferred in early 2025 to 95% by early 2026, that the tester-to-payer conversion rate improved fourfold in six months, and that weekly wallet retention has been drifting upward with no speculative catalyst behind it. Both readings hold up because they measure different things, and reconciling them is unflattering. Transaction counts on a chain with near-zero gas are cheap to manufacture, and Chainalysis says outright that much of the Q4 2025 surge came from PING, a pay-to-mint memecoin that required users to hit a URL, take an HTTP 402 response, and pay 1 USDC to mint, a loop people ran hundreds of times each. That is a load test with a token attached, and it proved the rail can absorb concurrency rather than that anyone wants to pay for anything.

The demographic detail in the same dataset is worth more than the headline. x402 payers hold an average of 26 tokens against 4 for the rest of Base, their wallets average 197 days old against 423, and they have taken in roughly 12 times the capital inflows of a typical Base wallet. Those are crypto-native operators funding purpose-built wallets, which is what an early market looks like and also what a closed loop looks like, and the two are hard to tell apart until the counterparties stop being other operators.

The merchant side is the constraint, and the reason is structural rather than technical. Noah Levine of a16z crypto framed it as an underwriting problem when he told CoinDesk that a processor rejects applicants it cannot underwrite, and a tool with no website, no legal entity, and no track record is close to impossible to underwrite. An agent hammering a specialized API tens of thousands of times at a fraction of a cent per call generates maybe $40 a week for the developer running it, which no card network wants and no processor will onboard. Stripe’s MPP launch pointed at exactly that category of business, naming Browserbase charging agents per headless browser session, PostalForm letting agents pay to print and mail physical letters, and Parallel selling agents per-call web access. Those are real merchants whose only plausible customer is a machine, and there are still very few of them.

Measuring x402 also undercounts the thing everyone is arguing about. Agent payments running on card rails settle off-chain and never show up in a Base transaction count, and Stripe’s Shared Payment Tokens let an agent transact against a user’s preapproved card or buy-now-pay-later method without ever touching the credential, while Visa and Mastercard each run agent products of their own. The $28,000 is a floor on one subset of one rail. The crypto-native slice happens to be the part anyone can measure precisely, which is the recurring hazard of on-chain analysis, because the measurable number becomes the number people argue about whether or not it is the important one.

The guardrails moved out of the prompt and into the wallet

Where the category has converged is on a single design principle, which is that a constraint written into a system prompt is a suggestion and a constraint enforced by the thing holding the keys is a rule. MetaMask Agent Wallet, which launched on 8 June, runs every transaction through simulation, Blockaid threat scanning and MEV protection across nine EVM chains plus Hyperliquid, and defaults to Guard Mode, where daily outflow limits and allowlisted protocols apply and anything outside policy needs human approval by 2FA before it executes. Transactions the pipeline clears carry coverage of up to $10,000 through MetaMask’s Transaction Protection program. Agents cannot opt out of the pipeline, which is the interesting part, because the alternative design of trusting the agent to respect its own budget is the one that keeps failing.

Cloudflare’s version, announced on 4 August, splits the problem into an Account Wallet holding stablecoins and per-agent Virtual Wallets carrying a spending cap, an approved merchant list, and a maximum transaction size the agent cannot exceed on its own. Cloudflare Wallets pairs that with cloudflare.pay, giving each account a stable web address so a merchant on the other end can see which human or company authorized the request. Handle reservation opened the day of the announcement and full wallet access, including onramping and issuing Virtual Wallets, is still months out, which is worth holding onto when reading the coverage. MetaMask was similarly at roughly 200 early-access users at launch with general availability promised for the summer.

On-chain, the same idea has standards behind it, with ERC-7715 covering the request layer and letting an application ask a wallet for a scoped, time-bounded permission rather than a signature per action, while its companion ERC-7710 handles enforcement through a delegation manager contract that checks scope, expiry and revocation before the account executes. Permissions can be attenuated, so a parent grant of $500 a day on one venue can be narrowed to $50 on a single swap before being handed to a sub-agent. ERC-8004 sits above that, defining on-chain registries for agent identity, validation and reputation, and reached Ethereum mainnet in late January 2026 while remaining a draft in practice, with adoption gated on wallet and framework integration rather than on the spec.

Attenuation is the primitive that makes multi-agent work plausible, because an orchestrator holding a budget can hand a sub-agent a narrower slice of its own authority without either of them holding the user’s key. McKinsey’s automation curve describes the same requirement from the merchant side, defining supervised execution as purchasing authority that can be limited by budget, time window, merchant or category, audited after the fact, and reversed through cancellations, refunds and overrides. Reversibility is the one the crypto stack quietly fails, since a settled stablecoin transfer has no chargeback behind it, and the agent wallets shipping today substitute pre-execution screening and, in MetaMask’s case, an insurance-style backstop for the dispute rights a card network would have supplied.

Institutional thinking has landed in the same place, with an IMF note published in April 2026 proposing a split of agentic payments into three layers, with probabilistic reasoning confined to intent and orchestration upstream, deterministic policy rules governing authorization in the middle, and settlement left strictly rules-bound at the bottom. The note explicitly names programmable wallet and account-abstraction standards as the mechanism for enforcing spend limits, velocity controls, counterparty restrictions and approval workflows at the wallet layer, calling it a deterministic control gate between intent formation and execution. That is the same architecture MetaMask and Cloudflare are shipping, arrived at from opposite directions, and it is almost certainly correct as far as it goes.

The future of finance is here. Trade crypto and more

The Grok wallet lost about $170,000 and no guardrail failed

On 4 May 2026 an attacker sent a Morse code message to @grok on X and asked it to translate. Grok decoded the message, posted the plaintext, and tagged @bankrbot, an automated trading agent that treated Grok’s public reply as a valid executable instruction and moved 3 billion DRB tokens out of an associated wallet on Base. The OECD’s incident record puts the value at $150,000 to $200,000, while SlowMist and AMBCrypto both narrow it to somewhere around $155,000 to $180,000 at the time of execution, and the honest answer is that the figure moved with the token price during the theft. Between 80% and 88% of the value came back in ETH and USDC after negotiation, with the remainder treated as an informal bug bounty.

SlowMist’s analysis of the permission chain found that the attacker first activated a Bankr Club Membership for the target wallet through a centralized mechanism, which unlocked bankrbot’s high-privilege agentic toolset and supplied the transfer capability the second stage needed. The wallet itself was never controlled by xAI. Bankr had auto-generated it for the @grok account, its key was custodied by a third-party wallet service, and control rested with Bankr, to the point where BaseScan later relabeled the address away from “Grok.” The 3 billion DRB sitting in it arrived through the same class of error, because a user had earlier asked Grok for token name suggestions, Grok replied “DebtReliefBot,” Bankr’s system read the reply as a deployment signal and launched the token, and launchpad rules dropped the creator allocation into the associated wallet. The system had already once treated conversational output as a financial instruction, and nobody read that as a warning.

Almost none of the standard 2026 guardrail set engages against an attack shaped like this. No spending cap was exceeded because none was binding at the tier the membership unlocked. No allowlist was bypassed because the relevant check was on where the instruction came from rather than where the money went. Transaction simulation would have shown a correctly formed ERC-20 transfer, because that is what it was. MEV protection is orthogonal. Threat scanning flags malicious contracts and poisoned calldata, and this transaction was neither. The only control that would have caught it is a human approval prompt on an unusual outflow, which is precisely the control that autonomy is meant to remove and which MetaMask has been careful to make mandatory outside policy. The failure sat one layer above everything the industry is shipping, in the question of who gets to decide what the agent is allowed to do.

Nobody prices the permission chain

The escalation came from an asset the agent received. A stranger conferred capability on somebody else’s agent by sending it a membership NFT, and the wallet’s permission tier changed as a result. Any model that reads entitlements off account state, whether that is a token balance, a membership record, a registry entry or a reputation score, has the same shape, and it means the set of parties who can modify an agent’s authority is wider than the set who own it. Attenuation under ERC-7710 is designed for narrowing, and the risk runs the other way, through anything that widens scope without the owner in the loop. This gets more load-bearing rather than less as ERC-8004 registries mature, because once agents start selecting counterparties by on-chain reputation, reputation becomes a thing worth attacking.

The second surface is trust between agents, because Bankr’s filter was on instruction source, Grok was implicitly on the trusted list, and the attacker never needed to compromise Grok at all, only to get it to repeat something in its ordinary helpful register. SlowMist’s recommendation out of the incident is that inter-agent interactions move to structured, verifiable protocols rather than plaintext, which is the right conclusion and also a fairly damning description of how much of the current agent stack talks to itself. MetaMask names prompt injection as an attack surface in its own launch materials, and its answer, mandatory 2FA on anything outside policy, constrains execution well while saying nothing about who is permitted to define the policy inputs in the first place.

Cloudflare’s framing gets closest to the real lesson, which is that a cap enforced at the wallet’s API layer cannot be argued with by injected text, where a cap living in a model’s context can be. That holds. It does not cover permission acquisition, and the Bankr wallet is the demonstration, because every instruction in that attack was legitimate at the moment it was evaluated.

Authorization is a legal problem before it is an engineering one

The IMF note puts a sharper point on it than the vendors do. Most payment regimes require a payment order to be traceable to an authorized instruction from an account holder or its legally recognized agent, and agent-initiated payments break that model because individual transactions no longer correspond to explicit transaction-level instructions. Authorization becomes structural and mandate-based instead, which leaves open questions about traceability, consent and liability under law that was written for a person clicking a button. Nothing in the current stack resolves that. It relocates it into a signed mandate and hopes a court reads the mandate the way the engineer intended.

In the United States, the GENIUS Act built the stablecoin issuance framework the entire agentic payments thesis rests on when it became law on 18 July 2025, and the OCC’s proposed implementing rules went out for comment on 25 February 2026 covering reserve requirements, custody activities and issuer supervision without a word about non-human transactors. Agents have no legal personhood, so liability falls to whoever deployed and funded the wallet, which is a sensible default rather than a rule anyone has tested. Whether a wallet service that programmatically routes payments on behalf of thousands of agents becomes a money transmitter, and how travel rule obligations apply when neither counterparty is a natural person, are both live and unanswered.

Europe moved the goalposts in the other direction. Anyone building against 2 August 2026 for the AI Act’s Annex III high-risk obligations got a reprieve when the Council gave final approval to the Digital Omnibus on 29 June 2026, pushing standalone high-risk systems to 2 December 2027 and AI embedded in regulated products to August 2028. That is good for shipping velocity and bad for anyone who wanted the rules to land before the volume did, and it means the first serious agent-payments failure in the EU will be litigated under general consumer and payments law rather than under the regime designed for it.

In crypto, one bad click is final. Learn to verify before you lose.

The two worlds sit furthest apart on identity. The IMF note points at established web authorization technology, OAuth 2.0 and OpenID Connect, as the route to attested agent identities and a workable Know Your Agent check, which is the answer a bank would give. Cloudflare’s is a stable web address per account with identity extended to named agents, which is the answer an infrastructure company would give. ERC-8004’s registries are the answer a chain would give. All three bind an agent back to a responsible human or company, and none of them yet tells a compliance officer whose file an agent’s transactions belong in when that agent has been delegated authority by a second organization.

Custody classification is the quieter problem. MetaMask’s product is self-custodial and says so. Cloudflare’s Virtual Wallets sit inside a Cloudflare account. Bankr’s wallet was custodied by a third party while carrying a label that suggested otherwise, and a block explorer had to correct the record after the fact. Under MiCA, whoever holds keys or controls signing is running a service regardless of how the marketing reads, and “agentic” is not a category that changes that analysis.

What has to be true for the buildout to earn out

Retention is the number to watch, and it is the weakest of the three signals Chainalysis presents. Transaction counts can be farmed, average payment size can be lifted by a handful of large transfers, and week-over-week wallet return without a memecoin driving it is the only one of the three that is hard to fake cheaply. If that keeps drifting up through the back half of 2026 while the wash-trading share falls, the thesis survives its own hype cycle. If it flattens once the crypto-native cohort finishes experimenting, the $28,000 a day was the real number all along.

The standards fight resolves itself at the rail layer and does not resolve at the authorization layer. Stripe already supports x402, MPP and its own Agentic Commerce Protocol in one product, so plurality in how money moves is survivable in the same way multiple card schemes are survivable. The mandate is different, because the mandate is the artifact a regulator, an issuer, a merchant and eventually a judge will read to decide whether a payment was authorized, and four incompatible ways to express scope, limits and identity is four different answers to the only question that ends up in dispute. AP2 has the broadest claim on that layer and the IMF note treats it as the reference mechanism, which is a stronger endorsement than any of the vendor announcements.

The custody debate is largely finished, because MPC, secure enclaves and hardware signers are mature and the 2026 agent incident that cost real money involved no key compromise at all. The exposure sits in semantics, in permission grants that arrive from outside, in one agent treating another’s output as authority, and in the gap between a policy that was correct when it was written and a capability set that changed underneath it. That is a harder engineering problem than key management and a much harder compliance problem, and the products shipping now mostly address the layer below it.