Start where the danger is, not where the marketing is. An agent that transacts is software that can be talked into things: a poisoned document, a hijacked tool response, a page written to be read by a machine that acts on it. The question is not whether the agent is clever, but what it may do at the moment it is wrong — and who must be present for the expensive version of wrong.

One caveat first, or the comparison is dishonest. MetaMask Agent Wallet is a consumer wallet with a policy engine, launched 6 August 2026 as an Early Access Program. Ledger Agent Stack, launched 16 July 2026, is a developer toolkit that assumes you already own a Ledger signer. They are not interchangeable; they are worth reading together because they bet on different boundaries.

The two files, side by side

MetaMask’s bet: rules, written down and checked

Guard Mode is the default, and per the company it enforces daily spend limits, allowlisted protocols and human approval outside the policy you set. A flagged or out-of-bounds transaction pauses for two-factor approval rather than failing open, MetaMask says, and the agent cannot bypass that check. An opt-in Beast Mode reduces interruptions; the checks still run.

It is a thoughtful shape, and it exists in a form non-developers can use. It is also software enforcing software: agent, policy engine and host share one machine and therefore one trust domain. Every hot wallet makes that assumption — but it is an assumption, and it deserves naming rather than feeling.

Two things belong in the column marked honesty. Transaction Protection is stated at up to $10,000 a month, only for eligible transactions that clear simulation, threat scanning and MEV protection and lose anyway. That is a real gesture, and it is not insurance: no underwriter is named, and the eligibility terms sit elsewhere. Self-custody’s price, meanwhile, is unchanged. The exportable recovery phrase is what makes the wallet yours and what an attacker wants, so it lives on paper or steel, offline — never typed into a page, never photographed, never read to support, and never pasted into an agent’s context, where one summarised log carries it somewhere you cannot follow.

Ledger’s bet: a boundary software cannot argue with

Ledger starts where our Ledger review started: a secure element does not care whether the computer around it is compromised. Agent Stack applies that to agents. As SiliconANGLE reported at launch, sensitive actions must be confirmed on a Ledger signer before they execute, while read-only requests run unattended — so a hijacked agent can read balances and draft nonsense, but cannot move funds without a physical button press. Agent Stack ships open source, so the boundary can be inspected rather than believed.

The limits are structural too. This is a toolkit, not something your relatives will install: it wants a developer and hardware you have paid for. Ledger’s published 2026 AI security roadmap puts Agent Intents and hardware-enforced Agent Policies in Q3 2026, Proof of Human in Q4 — a plan, not a shipped feature. The boundary today is signing, not spending.

A physical button also defends against a compromised machine, not a bored human. Press enough confirmations in a row and the person at the trusted display stops reading them. Check the address and the amount on the device every time — routine is the attack surface.

Where both of them stop

Neither removes the need to know what is being signed. Neither of these agent layers is audited, certified, insured or regulated on any evidence I have seen, and neither vendor claims otherwise. Both are weeks old, and both inherit the oldest problem here: the arrangement is only as safe as whoever set the limits.

Verdict

If you want an agent transacting at all, the arrangement likeliest to survive a bad afternoon is Ledger’s: keys behind a physical confirmation, agent on the outside. If you want it working before the weekend, it is MetaMask’s, with the spend limit set painfully low and the allowlist short. Neither is a reason to relax. Crypto assets stay high risk whoever — or whatever — presses the button, so read both vendors’ terms yourself, and never delegate spending authority you could not calmly watch being misused.