Where Does an AI Agent Keep Its Money? Wallets Built for Machines

An AI agent can sign a payment in about 150 milliseconds. It cannot hold a hardware wallet, type a password, or pass a CAPTCHA. It cannot remember a seed phrase, and it should never be given one. A single leaked key exposes every dollar behind it.

So where does an agent actually keep its money?

In the last four parts of this series, we covered how agents pay, how they prove who they are, how they settle in USDC, and how their spending gets capped.

This part is about the last piece of the puzzle, the place where the money and the code live. The industry calls it the machine custody stack, and it is being built right now by a small group of companies.

Rule One • The Agent Never Holds the Key

Every serious design starts from the same rule. The agent can request a payment, but it never touches the private key that signs it. The key sits somewhere the agent cannot reach, and a separate system decides whether to sign.

This matters because the biggest risk to an agent with money is not a hacker breaking cryptography. It is a hidden instruction in a web page, a poisoned document, or a bad tool response that convinces the agent to send funds somewhere it should not.

If the key lives with the agent, a hijacked prompt can drain the account. If the key lives behind a policy engine with spending caps, allowlists, and time limits, the same attack hits a wall.

The Three Layers of Machine Custody

Layer 1 • Key Infrastructure

Companies like Turnkey generate and use keys inside secure hardware enclaves, so the key is never reconstructed outside that environment.

Anyone can verify what code is running in the enclave; signing takes 100 to 150 milliseconds, and the cost at scale is as low as $0.0015 per signature. Coinbase takes a similar route with multi-party computation, splitting the key so no single machine ever holds all of it.

Layer 2 • The Wallet

Coinbase Agentic Wallets, launched in February 2026, give each agent a smart contract wallet with programmable session caps, per-transaction limits, and gas-free settlement on Base, plus a free tier of 1,000 transactions a month.

Crossmint goes a different direction and bundles stablecoin rails with card networks and licensed on-ramps and off-ramps, so an agent can pay a merchant that has never heard of crypto. Privy, now owned by Stripe, focuses on embedded wallets with session keys and delegated limits.

Layer 3 • The Runtime

A wallet is useless if the code around it is compromised. AWS Bedrock AgentCore, generally available since October 2025 and now running in 20 regions, gives every agent session its own micro virtual machine and wipes the memory when the session ends.

Microsoft Foundry does the same with per-session sandboxes and persistent home directories. In both cases, the agent's reasoning, its tools, and its payment ability are kept in separate compartments so one failure does not leak into the next.

What This Looks Like in Practice

A company deploys a procurement agent. The agent runs inside an AgentCore session. It holds a Coinbase Agentic Wallet funded with a monthly budget. When it needs to buy data from an API, it sends a payment request.

The policy engine checks the merchant against an allowlist, checks the amount against the session cap, and only then asks the enclave to sign. The signed payment settles on Base in under a second. The agent never saw the key, never saw the card, and could not have spent more than it was allowed to, even if someone had tried to trick it.

What Still Breaks

The custody stack is young, and the trade-offs are real. Hosted wallets mean the exchange or the vendor sits between the company and its money, which is fine for a business and less fine for an individual. Enclave-based signing is the strongest model but is enterprise-only and priced per signature.

Cross-chain support is uneven, and a wallet that works on Base and Solana may not work on the chain a supplier prefers. And the market is consolidating fast. Stripe bought Privy, Coinbase bundled its wallet with a marketplace, and the standalone players are getting squeezed.

The goal was never to give agents complete financial freedom. It is to give them a budget they cannot exceed, inside a box they cannot escape, with a key they never see.

Next episode is 4,000 Payments a Day • Who Checks the Bill?

Dorman Review | Meaningful Insight. Responsible Decisions.

Written by Aybars Dorman | 9 September 2026

#AgenticWallets #AIAgents #AgentEconomy #AgenticCommerce #Web3 #Fintech #Custody #MPC #DormanReview