How do I decide whether Guard Mode or Beast Mode fits me?
The official documentation explicitly recommends Guard Mode for most users, and that's not just boilerplate — under Guard Mode, four layers work simultaneously: network allowlist, address allowlist, Token-recipient allowlist, and a rolling 24-hour outflow limit. Anything outside those bounds pauses for 2FA. Beast Mode turns off all three allowlist layers and keeps only threat scanning, meaning the agent can interact with any protocol directly without getting blocked just because "this protocol isn't on the list."
Beast Mode tends to fit situations where your agent needs to interact with new protocols frequently — chasing freshly launched opportunities, for instance — where an allowlist would turn into a daily manual-update chore. If your operating scope is relatively fixed — running a strategy across a handful of protocols you already know — Guard Mode's allowlists cost you almost no extra friction while adding a real layer of protection.
Why did MetaMask launch Agent Wallet right around the moment Prompt Injection attacks started getting serious industry attention? Is that a coincidence?
Looking at the timeline, Blockaid's H1 2026 report came out in late July, classifying the May Bankr incident as the first-ever exploit of an AI Agent. MetaMask's Agent Wallet, by contrast, started early access in June and reached general availability on August 6 — earlier than the report's publication. That means MetaMask's security architecture wasn't a reactive patch bolted on after seeing the Bankr incident; the premise that "an agent's judgment can be wrong" was built into the product's core design from the start.
That also explains why MetaMask's protection is layered rather than a single line of defense: transaction simulation, Blockaid threat scanning, and MEV protection each operate independently. Even if the agent itself gets fooled by prompt injection into deciding to execute a malicious transaction, the threat-scanning layer still has a chance to intercept it before it lands on-chain — which is exactly the layer that was missing in the Bankr incident.
How do Server Wallet and Bring Your Own Key actually differ in practice, and which should I choose?
Under Server Wallet mode, private keys are held in a trusted execution environment (TEE) — a hardware-level isolated environment that even MetaMask itself can't directly read the key contents from. The agent executes transactions indirectly through this environment but never touches the user's main wallet Private Key at all, effectively inserting a hardware isolation layer between "authorizing an agent to act" and "exposing the main wallet's keys." Bring Your Own Key mode has the user supply their own BIP-39 mnemonic directly, keeping full key control in the user's hands — optionally encrypted at rest with a password — but that path loses the extra hardware isolation the TEE provides.
For most users, especially those who don't want to dig into the details of key management, Server Wallet is the lower-risk default — it hands the job of "key security" off to a purpose-built isolated environment. If you already run your own key management workflow — say, a Hardware Wallet paired with specific signing tools — Bring Your Own Key lets you integrate Agent Wallet into your existing setup, but the tradeoff is that key security responsibility falls entirely back on you.
If I'm setting up my own Agent Wallet, what specific parameters actually need to be thought through upfront?
Three parameters get locked in at initialization and directly determine your real risk exposure. First, the rolling 24-hour outflow limit — a single number that caps how much damage an attacker (or an agent's misjudgment) can do in a single day. Set it to an amount you could lose entirely without it affecting your life, not to "an amount I don't think I'll actually need." Second, the protocol allowlist under Guard Mode — only add protocols you actually use and trust, not everything for the sake of convenience. Third, the channel for 2FA approval requests — mobile push versus email link — which should match how often and how promptly you actually check it. If an approval request sits unread for hours, that safeguard has effectively stopped functioning.
Together, these three parameters determine "how bad the worst case gets if the agent makes a wrong call" — not how impressive the threat scanning sounds on a marketing page. Threat scanning intercepts known malicious patterns; the outflow limit is the loss ceiling that still holds even when interception fails. Both need to be set deliberately — neither substitutes for the other.
On August 6, MetaMask opened Agent Wallet to general availability — a self-custodial wallet purpose-built for AI agents, letting users authorize an agent to execute on-chain transactions automatically while keeping full control over spending limits, approved protocols, and risk mode. This follows a June early-access phase limited to roughly 200 testers, marking MetaMask's first broad rollout of the feature.
The timing isn't a coincidence. The same week MetaMask launched, security firm Blockaid published its H1 2026 Onchain Security Report, naming AI Prompt Injection as one of three emerging attack surfaces and citing the May Bankr agent incident as the first-ever recorded exploit of an AI Agent. MetaMask chose this moment to build its security model directly into the agent wallet's architecture, rather than leaving users to assemble their own defenses.
Setting up Agent Wallet requires choosing between two trading modes. Guard Mode is the officially recommended default, automatically applying network allowlists, address allowlists, Token-recipient allowlists, and a rolling 24-hour outflow limit — any transaction outside these rules pauses and requires Two-Factor Authentication (2FA) approval. Beast Mode is built for power users who want fewer interruptions: allowlists are turned off entirely and the agent can interact with any protocol directly, but threat scanning can't be disabled — malicious or risky contracts still get flagged and paused for approval.
In other words, the difference between the two modes isn't whether security exists — it's how often that security intervenes. Guard Mode defaults to letting allowlists do the gatekeeping; Beast Mode hands that judgment call to real-time threat scanning instead.
Regardless of mode, every supported EVM transaction runs through the same three-step pipeline. First, transaction simulation surfaces balance changes and approval scope before signing. Second, Blockaid-powered threat scanning detects malicious transactions and auto-rejects anything flagged as such. Third, MEV protection is applied. Transactions deemed safe also carry Transaction Protection coverage of up to $10,000 per month.
Key management is another deliberate design choice: under Server Wallet mode, keys are held in a trusted execution environment (TEE) and the agent never touches the user's main wallet at all. A Bring Your Own Key mode is also available for users who supply their own mnemonic in exchange for more direct control.
If you're considering authorizing any agent — not just MetaMask's — to operate funds on your behalf, this rollout gives you a concrete checklist. Does your agent wallet have a clear daily or rolling outflow cap? Is there a protocol allowlist, or can it interact with any contract? Is malicious-transaction detection built into the architecture itself, or something you have to configure separately? And most critically: when a transaction gets flagged as suspicious, does the approval request actually halt the agent's execution, or is it just a notification you can ignore. The tradeoff between Guard Mode and Beast Mode is, at its core, friction traded for confidence — there's no universally right choice, but you should know exactly which one you've picked.