Summary
- Ledger opened its Agent Stack toolkit to the public, letting AI agents manage crypto wallets while private keys stay locked inside hardware.
- Every transaction that moves value still requires a manual confirmation on a Ledger signer before it executes.
- MoonPay and Shisa.ai already run production tools built on the new architecture.
- Ledger plans hardware-anchored agent identities and human verification tools later in 2026.
Ledger opened its Agent Stack toolkit to the public on July 16, 2026, giving developers a standardized way to let AI agents read crypto balances and analyze portfolios, then draft the transactions that would move funds, all without ever touching the private keys behind them. The Paris-based hardware wallet maker built the release around a single constraint: an agent can draft a swap or a payment, but the decision to execute it still has to pass through a physical button press on a Ledger device, confirmed by the person who owns the wallet. The launch follows a preview period that started June 10 and ran with more than 1,000 test agents, and it marks the first public deliverable from the company’s 2026 AI security roadmap.
A Toolkit Built to Stop at the Signature
Agentic AI has spent the past two years automating research, monitoring and drafting for crypto users, and the obvious next step is letting agents move money on their own. That step runs into a specific trust problem. Hand an agent your private keys, and one hallucinated price, bad instruction, or successful prompt injection attack can drain an account in seconds. Lock the agent out of wallet access entirely, and most of the promised efficiency disappears with it. Ledger’s answer keeps agents fully capable on the read and analysis side while drawing a hard line at execution. The company frames the rule in three words used throughout its developer documentation: agents propose, humans approve.
Four Modules, One Shared Boundary
Agent Stack ships as four separate, composable pieces rather than a single locked product, so a developer only adopts what a given use case actually needs.
| Module | Function |
|---|---|
| Device Management Kit Skills | Markdown-based instructions that plug agent frameworks such as Claude Code, Codex or Cursor into a Ledger signer without custom wallet integration code |
| Ledger Wallet CLI | Lets an agent check balances and review history freely, since those are read-only. Preparing a send or a swap works too, but anything that would move value pauses there for a physical confirmation |
| Ledger Enterprise CLI | Connects agents to Ledger Enterprise so they can draft transactions and support governance workflows for institutional accounts without ever holding a key |
| Ledger Enterprise Multisig CLI | Allows agents to draft and query multisig actions for institutional accounts, though quorum approval and hardware signing still gate anything that actually executes |
Why a Screen and a Thumb Beat a Software Permission
The architecture rests on a principle Ledger calls WYSIWYS, what you see is what you sign. An agent prepares a transaction inside its own software environment, but the approval step happens outside that environment entirely, on the trusted display of a physical signer that shows the exact transaction details before anyone confirms it. Because the private key never leaves the device’s secure chip, a compromised agent, a poisoned skill, or a targeted prompt injection attack can still ask the signer to approve something. None of them can make it approve without a person physically present. Software-only wallet permissions, even carefully designed ones, ultimately live inside the same execution environment an attacker is trying to control. Hardware puts the final decision somewhere code cannot reach.
The Numbers Ledger Says Justify the Friction
Ledger backs the added approval step with two outside figures. The 26.1% vulnerability rate comes from an independent study, Agent Skills in the Wild, which scanned more than 31,000 published agent skills and found that share carrying at least one flaw. The human-error figure is a widely cited industry number that Ledger folded into its launch materials without attributing it to a specific study.
| Metric | Figure | Source |
|---|---|---|
| AI agent skills with at least one security vulnerability | 26.1% | Agent Skills in the Wild (arXiv, Jan 2026) |
| Security breaches traced to human error | Roughly 60% | Unattributed industry figure, cited by Ledger |
| Agents tested during the private preview | More than 1,000 | Ledger’s June 10 preview post |
Ledger argues the AI attack surface is expanding faster than most defenses can track, which explains the first figure. The second figure runs the other direction: it is the company’s case that agent-assisted preparation can actually cut down on ordinary mistakes even as it adds one manual step at the finish line.
What Changes for Traders, Funds and Developers From Here
MoonPay and Shisa.ai already have production tools running on the architecture, MoonPay’s integration lets an agent identify a trade and prepare it while the private keys stay confined to hardware and every transaction still needs a button press. The Enterprise Multisig CLI pushes the same logic into corporate treasuries, where quorum approval already slows execution down for other reasons and an extra hardware confirmation changes little in practice. Retail and high-frequency use cases sit in more tension with the model. A trading agent that spots an arbitrage window measured in milliseconds cannot wait for a person to glance at a device screen, and rival wallet designs built on smart-contract account abstraction already let bots execute autonomously within spending limits the owner sets in advance. Ledger is betting that the security case outweighs the speed cost for most users; whether that holds for latency-sensitive strategies is a separate question the market will answer independently of this release.
Ledger has already outlined its next moves. Agent Identity work later this year will anchor each agent to a hardware-registered identity recorded on-chain, replacing the spoofable software strings agents currently use to identify themselves to services and each other. A separate Proof of Human attestation is meant to let a counterparty cryptographically verify that a real person authorized a given action, not just that a signer approved it. In the meantime, Ledger is backing a $5,000 developer bounty on college.xyz and fielding a $10,000 prize pool at ETHGlobal New York for teams building agent payment and approval tools on the new stack, a near-term push to get more of the agent-building community testing the hardware-gated model before the identity and attestation tools arrive.
