Software that can act on your behalf is arriving in crypto. Not chatbots that answer questions, and not the fixed-rule trading bots that have existed for years but AI agents: programs that take a goal, choose the tools to pursue it, and work through multi-step tasks with limited human involvement. Developer platforms now let these agents hold controlled access to wallets and blockchain actions, which makes it worth understanding exactly what they can do, what keeps them in check, and where the risks sit.

What is an AI agent?

An AI agent is software built around a language model that can interpret an objective, plan a series of steps, and call external tools to carry those steps out. That last part is the difference that matters. A chatbot only produces information: you ask, it answers, and nothing happens in the world. A traditional trading bot does act, but only by following rules a human wrote in advance, if price crosses X, do Y. An agent sits between and beyond the two: it can reason across several steps, decide which tool fits the current situation, and use interfaces such as wallets, market-data feeds and blockchain APIs to complete a task.

That flexibility is the appeal and the reason agents need firmer guardrails than either chatbots or fixed-rule bots.

What agents can monitor

The lowest-risk agent work is watching rather than acting. An agent can read market data continuously, track balances and positions, follow on-chain activity, and summarise what changed, the kind of monitoring a person could do manually, but without breaks. Because monitoring involves no transactions, mistakes at this level cost attention rather than money. Most people experimenting with agents sensibly start here.

Wallet access and transaction preparation

The step-change comes when an agent can touch a wallet. Purpose-built infrastructure now exists for exactly this. Coinbase's AgentKit describes itself as bridging the gap between AI agents and blockchain functionality: an agent gets a wallet it can operate, plus a library of discrete, well-defined actions — checking balances, transferring assets, swapping tokens, interacting with smart contracts. Each action has a defined input format, and what the wallet is allowed to do is configured when it is set up, not improvised by the model at run time.

Coinbase's Agentic Wallet documentation adds two details worth noticing. First, the agent never handles the private keys, those stay in managed infrastructure, so a misbehaving model cannot leak them. Second, spending is capped by configuration: limits per transaction and per session, with transfers screened before they execute. The agent operates inside a fence someone else built.

Swaps, payments and other on-chain actions

Why run these actions on a blockchain at all? Because blockchain transactions are programmable, verifiable after the fact, and settle without banking hours. Documented agent actions today include token transfers, swaps, smart-contract interactions and paying for digital services including machine-to-machine payments, where one piece of software pays another for an API call. None of this is risk-free, and not every capability is available in every product or region; the point is that the building blocks exist and are documented, not that they are universally deployed.

Permissions, spending limits and human approval

The most important idea in agent wallets is that access is not all-or-nothing. Well-designed setups layer several controls:

1. Per-transaction and session limits — caps on how much can move in one action or one working session.
2. Allowances — Coinbase's Spend Permissions let a wallet owner grant a specific spender a per-token allowance that renews on a schedule and can be revoked at any time.
3. Human approval — Safe's smart-account setups can register an agent as one signer among several, so the agent proposes transactions and people sign them. A threshold such as two-of-three signers means no transaction executes on the agent's signature alone.
4. Recurring spending limits — Safe's allowance module can cap an agent to, say, a fixed daily amount of one token, resetting on an interval.
5. Separation — keeping agent wallets small and separate from main holdings, so the worst case is bounded.

A useful rule of thumb from all of this documentation: autonomy should shrink as the value at risk grows.

The risks: prompt injection, excessive permissions, irreversibility

Security researchers have mapped the failure modes of agent systems in detail. The OWASP GenAI Security Project ranks prompt injection as the top risk for language-model applications: content an agent reads, a web page, a document, a message, can contain text crafted to redirect the agent's behaviour, and the agent may follow it as if it were an instruction from its owner. For an agent holding wallet permissions, that is not a theoretical concern.

OWASP's excessive agency guidance describes the second failure mode: giving an agent more functionality, permissions or autonomy than its task needs, so that when it is manipulated or simply wrong, it can do real damage. The recommended mitigations mirror the wallet controls above, grant the minimum tools and permissions, avoid open-ended capabilities, and require human approval for high-impact actions.

Two more realities complete the risk picture. Model outputs can be wrong, confidently wrong and automation amplifies mistakes by executing them quickly and repeatedly. And most blockchain transactions are irreversible: there is no chargeback when an agent sends funds to the wrong place. Fees, slippage, thin liquidity and smart-contract bugs apply to agent transactions exactly as they apply to human ones.

Why human oversight remains necessary

Every serious piece of agent-wallet documentation converges on the same design: the agent works inside explicit permissions, its spending is limited, its activity is logged, and a person stays in the loop for anything that matters. That is not a temporary limitation to be engineered away, it is the structure that makes agent systems usable at all while models can still be manipulated or mistaken. An agent does not guarantee better outcomes than a person; it guarantees faster execution of whatever it decides, right or wrong.

What to watch next

Three developments are worth following. First, wallet-permission standards: allowances, session caps and revocable grants are becoming standard building blocks rather than custom code. Second, machine-to-machine payments, where agents pay for services and data directly, a documented capability that could grow into real infrastructure. Third, the security guidance itself: OWASP's agentic-AI work is updated as new attack patterns emerge, and the guardrails considered "enough" today will keep moving.

If you want to build a foundation first, our explainers on Market Insights & Newsletters cover the underlying concepts, and our Security & Compliance page describes how Mugano approaches protecting customer assets.

Mugano does not recommend autonomous trading. This article is for general information only and does not constitute investment, legal or technical advice. Automated systems can make mistakes, and blockchain transactions may be irreversible.

Sources

1. Coinbase Developer Platform — AgentKit documentation (welcome, architecture, actions); Agentic Wallet; Spend Permissions. External links above; accessed 25–26 July 2026.
2. Safe — AI-agent smart-account quickstarts (introduction, human approval, spending limit). Accessed 25–26 July 2026.
3. OWASP GenAI Security Project — LLM01: Prompt Injection; LLM06: Excessive Agency. Accessed 25–26 July 2026.

Company names identify the publishers of the documentation cited. Mugano is not affiliated with, and does not endorse, any third-party product mentioned.