2026-11-03 –, Lightning Stage
I connected an AI agent to my own wallet through scoped, revocable permissions — never my keys — and kept a six-month dry-run journal before letting it touch real funds. You'll leave with the permission-not-possession pattern, what the journal caught that I didn't, and why the industry's custody shortcut isn't the only way.
The setup: a friend's Telegram channel flags on-chain deployment events on a perps venue; I wired those signals to an agent that executes from my own wallet. Open-source, personal GitHub, open standards.
The trap: approve every trade and the timing edge dies; never ask and the agent holds unbounded power — and prompt injection means I must assume it can be turned against me. The industry's fix is a custodian: the decade-old trade we came here to refuse, back through a side door.
Instead: scoped delegation (ERC-7715/7710, session keys) — spend caps, time bounds, an allowlist, one-tap revoke. A company card with a limit, never the vault key.
Six months of dry-run journals show where the caps would have saved me, where latency genuinely fights safety, and why ~a dozen events is a narrative, not statistics — so it's still not fully live.
The stakes: agent wallet defaults are being set now, and they harden. Permission-not-possession must become the default grant, not the expert path.
Francesco Andreoli leads developer relations at MetaMask and has been in Ethereum since 2016. He works at the layer where wallets, smart accounts, and AI agents meet, and builds open-source agent tooling under andreolf to test his own arguments.