When AI Agents Start Owning "Wallets": After Economic Autonomy, Who Holds the Control？

On August 4, Cloudflare took a highly symbolic step by officially unveiling Cloudflare Wallets, beginning to prepare "wallets" for AI Agents.

With this, AI Agents are no longer limited to calling APIs, reading data, or executing code—they can also hold independent Virtual Wallets, using stablecoins like USDC to purchase API, data, content, and computing services within preset budgets and permission limits.

Almost within the same week, another path was also accelerating.

On August 6, MetaMask also launched Agent Wallet, enabling Agents to connect to on-chain wallets and execute operations such as Swaps, perpetual contracts, prediction markets, and liquidity management within user-defined permission ranges.

The two may appear to be different products, but together they fill a long-missing piece of infrastructure for AI Agents—and this could be one of the most significant structural changes worth long-term attention at the intersection of AI and Crypto.

1. Agents Have Always Lacked an Account That Can Pay for Itself

First, let's look at Cloudflare.

As is well known, although Agent and cluster-of-Agents capabilities have surged this year, they still tend to get stuck in a very traditional process: finding a service, visiting its website, registering an account, adding a credit card, purchasing a plan, obtaining an API Key, and only then actually starting to make calls.

For humans, this process is merely cumbersome, but for a piece of software meant to complete tasks autonomously, any single step involving login, registration, payment, or identity verification can force it to stop and seek a human to take over.

In other words, the "brain" of Agents has advanced rapidly over the past few years, but the internet's payment infrastructure is still essentially designed around humans.

x402 aims to change exactly that.

It re-activates the long-standing but rarely used "402 Payment Required" status code from HTTP, embedding payment requirements directly into the internet's most basic request-response flow.

According to Coinbase's design for x402, when an Agent requests a paid API, the server can directly tell it how much it needs to pay, which assets are accepted, and where to send the payment; after the Agent completes the payment and requests again with proof of payment, the server verifies the payment result and then returns the corresponding resource.

Thus, the original flow of "register account → bind payment method → top up or purchase a plan → obtain API Key → call service" could potentially be compressed into "send request → receive payment requirement → pay → obtain resource," in which an account may not be necessary, a subscription may not be required, and there is no need to purchase a one-month or one-year plan upfront just to call an API a few times.

This may seem like just a few fewer steps, but it is highly suited to AI Agents. What Agents truly need in a payment method is not a mechanism that stops each time before a purchase for the owner to enter a verification code, but rather a payment protocol that—like software calls—can be understood and executed programmatically and billed with precision.

Stablecoins happen to provide exactly that settlement foundation.

Cloudflare's current x402 developer documentation already supports machine-to-machine payments based on on-chain assets such as USDC. An Agent can complete payment directly when requesting an API, MCP Tool, or other digital resources, rather than first being redirected to a traditional payment page (see also: The Full Landscape of Crypto AI Protocols: Starting from Ethereum's Main Battlefield, How to Build a New Operating System for AI Agents?).

It is even beginning to change how internet content is priced.

After all, the traditional internet usually offers only two options: either open access for free, or place content behind a subscription wall that requires a "person" to register and become a paying member first. But when it comes to Agents, a newer model may be more natural—instead of requiring it to subscribe to an entire service, charge it per actual consumption of data, API requests, computation, or content pages.

This is also why Cloudflare Wallets deserves attention.

For example, a research Agent could receive a budget of 10 USDC and compare prices, speed, and quality across dozens of data sources on its own. If an API costs just a few cents, it can try it once directly; if the result is poor, it can simply move on to the next option—without having to return to the owner for approval every time it spends a few cents.

Interestingly, these limits appear to constrain the Agent on the surface, but in reality, they are precisely what give it greater autonomy.

If users had to manually confirm every $0.01 USDC call, then the so-called "autonomous Agent" would remain nothing more than a semi-automated tool. Only by drawing a sufficiently clear budget boundary in advance—while humans retain final control outside that boundary—can an Agent truly act freely within it.

Cloudflare Wallets therefore reflects a more fundamental shift: in the past, the internet assumed that the economic entities participating in transactions were primarily individuals and businesses.

Now,from identity and payments to pricing models, a portion of internet infrastructure has begun seriously redesigning itself for another class of participant—AI, or Agents themselves.

2. How Can Agents Gain Economic Autonomy?

If Cloudflare mainly addresses the question of "how Agents buy things," then MetaMask Agent Wallet moves a step further to address "how Agents use assets directly."

It is beginning to enable Agents to execute on-chain operations directly within user-defined permission ranges—which is no longer the same as "let AI help me analyze whether ETH is worth buying."

In the past, the division of labor between humans and AI was roughly that AI collected information, analyzed problems, and offered suggestions, while humans decided whether to act on those suggestions.

Under the Agent Wallet framework, an instruction might gradually become: "If ETH drops to around $3,000 and Gas is below the 24-hour average, buy 0.2 ETH." This means that users provide the goals, conditions, and permissions, while ongoing monitoring, condition evaluation, transaction preparation, and even final execution can be partially delegated to the Agent.

And this is precisely the layer worth paying attention to when we talk about an Agent's "economic autonomy."

It does not mean that Agents truly own property of their own. Rather, it means they now have an account, a disposable budget, and a set of economic permissions they can proactively invoke based on changing circumstances. They can autonomously purchase external information and computing resources, and they can mobilize real assets to achieve goals within the rules defined by users.

This step looks natural enough, but it also connects AI's mistakes to real economic losses for the first time.

If an AI that can only chat misunderstands a sentence, the result is usually just a wrong answer. But once it holds a wallet and execution permissions, the same misunderstanding, prompt injection, or malicious tool call could immediately translate into an irreversible on-chain transaction (see also: Sign Is Not Just Signing: When an AI Agent Signs for You, Who Holds Control?).

This is also why you cannot simply hand a wallet with unlimited permissions to an AI.

Users can pre-set daily spending limits, allowed protocols, and risk preferences. Supported EVM transactions will also go through transaction simulation, threat scanning, and MEV Protection. If a transaction is identified as abnormal or falls outside the user's predefined Policy, the system will pause automated execution and require the user's 2FA confirmation again.

Thus, a very important principle becomes increasingly clear: economic autonomy does not mean unlimited authorization.

A truly usable Agent is more like an employee carrying a company card with role-based permissions, not someone holding the keys to the company vault. What it can buy, how much it can spend per transaction, how much it can spend per day, which matters it can decide on its own, and which matters require re-approval—all of this should be clearly defined before any authorization is granted.

From this perspective, the core innovation of Agent Wallet is not even just "giving an AI a wallet"—it is the first systematic attempt to address how humans can securely delegate economic permissions to software.

And once the problem is framed this way, the wallet itself must also change.

3. When Agents Can Spend on Their Own, What Kind of "New Wallet" Do We Need?

Over the past decade or more, the core proposition of crypto wallets has been remarkably stable: how to securely manage private keys.

No matter how the interface has changed, the underlying relationship has remained the same—humans initiate operations, humans review transactions, and humans ultimately confirm signatures. The wallet's most important duty is to protect the private key that determines asset ownership and grants final authorization.

But with Agents in the picture, an entirely new layer has appeared in this chain.

Many operations no longer require users to construct each transaction one by one. Instead, the model shifts from "humans directly operating assets" to "humans first express goals, then delegate partial execution rights to Agents." This means wallets will need to answer a whole new set of questions around permission relationships:

• Who can use assets on my behalf?
• Which assets can it use, and which protocols can it access?
• What is the maximum amount per transaction, and how many times can it execute per day?
• What can it decide autonomously, and what must it bring back to me for confirmation?
• If an Agent behaves abnormally, can I immediately pause it, revoke permissions, and recover assets?

From the perspective of an ordinary user, the most important issue is undoubtedly how to make people truly comfortable managing Agents that now have the ability to act.

This is also another layer of the question that imToken is addressing around UI 3.0 and Agent Wallet. In imToken's thinking about next-generation wallet interactions, a key shift is that the user's role begins to move from "Operator" to "Manager."

In the past, completing a transfer required the user to select a network, enter an address and amount, judge Gas, and then review and sign step by step. In an intent-driven wallet, the user might only need to say "send 500 USDT to Frank," and the system can first convert the natural language into a structured Intent, identify the recipient, amount, asset, network, and estimated fees, and then present the final confirmation result back to the user.

But fewer interaction steps do not mean the control boundary can disappear. Quite the opposite—as more execution processes become automated, the steps that no longer appear in front of the user must be constrained by more explicit authorization mechanisms.

In imToken's product design approach for Agent Wallet, each Agent granted execution permissions corresponds to an independent Agent Account. Its Session Key is generated and isolated within a Trusted Execution Environment (TEE), and the key never leaves that secure environment. At the same time, the Agent Account must be bound to a clear Policy, including an allowlist of protocols, per-transaction limits, daily limits, operation frequency, and validity periods.

What the Agent receives, therefore, is not an unbounded wallet but an execution account enclosed by a policy fence.

Within this framework, the user holds a higher level of control and can adjust Policies at any time, pause or resume Agents, revoke permissions, and withdraw funds. AI can help parse intent, plan routes, estimate fees, and flag risks, but the Agent can only execute within the Policy scope pre-authorized by the user. Any operation beyond that boundary must return to the user for confirmation.

More importantly, authorization should not be a jump from 0 to 100 in one step. It should increase gradually as trust builds.

A newly deployed Agent can first remain at the observation and analysis stage. As trust gradually builds, users can allow it to provide suggestions and prepare transactions. The next step is execution after user confirmation. Only when rules are sufficiently clear and risk boundaries are controllable does it enter policy-scoped autonomous execution.

From L0 observation, to L1 suggestions, L2 execution after confirmation, and L3 policy-bounded autonomous execution, this essentially corresponds to a graduated trust relationship.

An Agent's autonomy is not something the system grants by default—it is something users grant step by step.

This will also change why users open their wallets in the future.

Today, people enter a wallet usually because "I want to check my balance," "I want to transfer funds," or "I want to make a Swap." But as more routine operations are taken over by Agents, users are more likely to open their wallets for a different reason: "What has my Agent been doing lately, and is there anything that needs my attention?"

As a result, the core interaction offered by wallets may gradually shift from an operations panel to a management panel.

At that point, the wallet's role is no longer just storing assets and initiating transactions—it becomes something closer to a permission control layer positioned between humans and Agents.

This may also represent a significant shift in the value proposition of wallets in the Agent era—from "securely managing your private keys" to "securely managing your assets, as well as the Agents you have authorized to use those assets."

Final Thoughts

If we take a longer view, AI Agents gaining economic autonomy may be one of the most significant structural changes worth long-term attention at this intersection of AI and Crypto.

Because smarter models and Agents that can call more tools still fundamentally happen within the information world. But when Agents gain accounts, budgets, and asset execution capabilities, they begin, for the first time, to become active participants in real economic activity.

So, what really determines whether Agents can enter real financial scenarios at scale may no longer be just "how smart they are," but whether we can establish a permission system that matches their capabilities.

Because the other side of autonomy is always authorization. Wallets in the Agent era may not simply disappear into the background. Instead, they could take on an even more important role than today—one that enables automation to truly happen while ensuring final control always remains with humans.

After all, letting Agents act freely does not mean letting go of control.

That boundary may be the core question wallets must answer before "economic autonomy" truly becomes a reality.