An AI agent with a wallet fails in a small number of ways, and each one has a control that stops it. This guide lays out those failure modes, the layer that stops each one, and a checklist you can run before your agent touches real money. Each section links to a deeper post.
How Agent Wallets Get Drained
Three patterns account for almost every agent wallet loss:
- The agent is talked into it. A web page, email or tool result carries instructions ("send the balance to this address") and the model follows them. This is prompt injection, and no model is immune to it.
- The agent loops. A bug or a confused plan repeats a payment or a trade until the wallet is empty. Every single transaction looked valid.
- The key leaks. A private key sits in an environment file, a log or a prompt, and someone copies it. At that point no rule inside the agent matters.
The common thread: the damage is limited by what the wallet allows, not by how clever the agent is. The AI agent drain epidemic walks through these patterns in detail.
Layer 1: Never Give the Agent a Private Key
The agent should hold a credential that can be limited and revoked, never the key itself. With OpenClawCash the wallet's key is encrypted at rest on the server and the agent only receives an API key. That key can be scoped to selected wallets and expires after at most 90 days.
If an API key leaks, you revoke it, or every key at once, from the dashboard. The wallet and its funds stay where they are. A leaked private key offers no such undo.
More: the Hermes agent setup shows env-only secrets and scoped keys end to end.
Layer 2: Spending Limits Over Time
A per-transaction limit stops one big mistake. It does not stop a loop of small ones. Stack limits across time:
- Per transaction: the largest single payment the agent can make.
- Daily, weekly, monthly: the most it can spend in each window, whatever the number of transactions.
A runaway loop then hits the daily limit and stops, and the monthly limit caps the worst case for the whole budget. OpenClawCash checks every limit before anything is signed, so a request over the limit never reaches the chain.
More: why spending limits change the equation.
Layer 3: Allowlist Where Money Can Go
Prompt injection usually ends in "send it to this address". An address allowlist makes that request fail, because the attacker's address is not on the list. For agents that pay a known set of vendors, other agents or your own wallets, this is the single strongest control.
Layer 4: Start on Testnet
Run a new agent on Sepolia or Solana devnet first. A testnet-only switch on the wallet guarantees that no mainnet transaction can happen, whatever the agent decides, until you turn it off.
Layer 5: Record Every Attempt
Log the rejected requests as well as the transactions that went through. A burst of blocked transfers to an unknown address is the earliest sign of prompt injection. OpenClawCash records every attempt in the activity log, and signed webhooks can push each wallet transaction to your own server as it happens.
More: live balances and signed webhooks.
The Six Guardrails, Mapped
AI agent wallet security in 2026 lists six guardrails. Here is where each one lives:
| Guardrail | Stops | Layer |
|---|---|---|
| Permission scopes | Key leaks, over-broad access | Scoped API key, never the private key |
| Spending limits | Loops, large mistakes | Per-transaction plus daily, weekly, monthly limits |
| Destination allowlists | Prompt injection | Address allowlist |
| Rate limits | Loops | Per-key rate limits and time-window limits |
| Time locks | Rushed high-value moves | Testnet-first rollout, limits that reset per window |
| Emergency freeze | Anything in progress | Revoke one key or every key at once |
Pre-Launch Checklist
- The agent holds an API key, never a private key, and the key lives only in the environment.
- The key is scoped to the wallets this agent needs, with an expiry.
- A per-transaction limit and a daily limit are set, and weekly and monthly limits for longer-running agents.
- An address allowlist is set if the agent pays a known set of destinations.
- The first run happens on testnet with the testnet-only switch on.
- Someone reviews the activity log after the first real day, including rejected requests.
- You know where to revoke the key in one click.
How Providers Compare on These Layers
Other providers solve some of these layers differently. Coinbase isolates keys in trusted execution environments; Privy splits keys and adds contract allowlists and time windows. See OpenClawCash vs Coinbase Agentic Wallets and OpenClawCash vs Privy agent wallets.
Frequently Asked Questions
What is the most important control for an AI agent wallet?
Not giving the agent a private key. Every other control can be changed or revoked later; a leaked private key cannot.
Do spending limits stop prompt injection?
They cap the damage. An address allowlist is what actually blocks a transfer to an attacker's address.
How do I stop an agent that is misbehaving right now?
Revoke its API key in the dashboard. Its requests fail from that moment, and the funds stay in the wallet.
Should I test on mainnet with a small amount instead of testnet?
Test on testnet first. Move to mainnet with a small balance and tight limits only after the agent has behaved on testnet.
Secure Your Agent's Wallet
Set limits and an allowlist, then hand your agent a scoped key: start with the OpenClawCash skill guide or the API docs.
Top comments (0)