MetaMask, Trezor and ChangeNOW shared a stage at Token2049 Singapore this week to talk about AI agents and wallet security. The panel landed on a tension that's getting harder to ignore: the same automation that makes a wallet convenient is the thing that can drain it. Robust safeguards, the participants argued, are the only way to keep convenience and user control from pulling in opposite directions.
Two philosophies sharing a panel
The lineup made the discussion more interesting than it might have been otherwise. MetaMask is a software wallet built for a browser tab. Trezor makes hardware devices whose entire pitch is that your keys stay offline. ChangeNOW is a non-custodial exchange service. Put those three in one room and you get three very different answers to what "security" even means.
For a hardware maker, an AI agent that wants to sign transactions is close to a contradiction. The device exists to force a human decision at the moment of approval. For a browser wallet, agents are more like a feature request — something users will build on top of it whether the wallet team sanctions it or not.
The convenience problem
AI agents in a wallet don't just read balances. They act. They can swap, bridge, approve contracts, and move funds while the user is asleep or looking at something else. That's the point of them. It's also the risk.
The panel's framing was blunt about the trade-off: convenience and control pull against each other, and the industry hasn't settled where the line goes. A wallet that asks you to confirm every AI action isn't much of an agent. One that never asks is a liability with a nice interface.
None of the three companies announced a product or a standard during the session. The discussion was about norms, not specifications.
Why the timing matters
Wallet vendors are already shipping AI-adjacent features, and the security conversation is running to catch up. The panel didn't produce a shared rulebook, but it made the split visible. Hardware and software wallets are approaching the same problem from opposite ends, and their users will feel the difference first when something goes wrong.
The unresolved question is who sets the guardrails. Wallet teams can build their own approval layers, but an agent that operates across several wallets and chains sits outside any single vendor's control. The Token2049 session named the problem. It didn't assign anyone to solve it.
