Ledger shipped Ledger Agent Stack today — an open-source toolkit that lets AI agents read your crypto wallet, analyze your portfolio, and queue up transactions, while physically preventing any of that from executing unless you press a button on a physical Ledger device. For anyone with crypto holdings who has been watching AI agent wallets proliferate without a clear answer to the question “what stops a compromised agent from draining this?” — today’s release is the first production-grade answer to that question from a hardware security company.

The principle is three words Ledger has been repeating since its April AI roadmap announcement: “Agents propose. Humans approve.” What makes today’s launch different from that slogan is that the enforcement is now hardware — not policy, not alignment, not a software checkbox.

Prompt Injection Cannot Be Fixed in Software — and That Is the Whole Point

Here is the architectural problem Ledger Agent Stack is built to solve, stated plainly.

An AI agent running on your laptop is a probabilistic reasoning engine. It processes inputs — messages, documents, API responses, tool calls — and generates outputs, including instructions to move your money. The problem is that the same stream of tokens that carries legitimate instructions also carries any malicious instructions an attacker has hidden in a document the agent reads, a website it visits, or a message it receives. This is called prompt injection, and it ranked as the top LLM vulnerability per OWASP according to current guidelines. Critically, AI models cannot technically distinguish trusted system instructions from adversarial inputs embedded in untrusted data — they process both through the same stream with no architectural separation.

That structural limitation means no software-only approval layer can fully close this vulnerability. The approval lives in the same logical environment as the attack. You can add guardrails, alignment training, output filters — and attackers can, in realistic scenarios, still manipulate top-tier AI models through simple human-written injections, as demonstrated by the WASP benchmark from Meta FAIR.

Ledger’s solution is to take the signing decision out of software entirely. The Secure Element chip inside a Ledger hardware device runs its own isolated operating system — BOLOS (Blockchain Open Ledger Operating System) — that is physically separated from the host computer’s environment. Private keys are generated on that chip, stored on that chip, and never leave it. When a transaction needs to be signed, the data moves to the Secure Element; the key does not move to the software. The chip’s trusted display — drawn by Secure Element firmware, not by the host operating system — shows the user exactly what is being signed. The user presses a physical button. That is what produces the cryptographic signature.

An AI agent that has been manipulated by prompt injection can want to drain your wallet. It cannot sign a transaction. Pressing the button is not in its execution environment.

Four Building Blocks, One Architecture

Agent Stack ships as four composable open-source modules, each targeting a different layer of the developer use case:

Device Management Kit Skills handle the integration layer — bringing Ledger hardware connectivity into an agent, decentralized application, or signing workflow without rebuilding wallet infrastructure from the ground up.

Ledger Wallet CLI is the personal agent interface. It lets an AI agent check balances, review transaction history, receive funds, and prepare sends and swaps. Read-only operations run without interruption. Anything that would move value pauses and routes to the hardware device for human confirmation.

Ledger Enterprise CLI extends the same architecture into institutional workflows — agents can prepare transactions and participate in governance processes within Ledger Enterprise, without holding keys.

Ledger Enterprise Multisig CLI adds multi-signature support. Agents can propose, query, and prepare multisig actions; quorum-approval and hardware-signing requirements stay fully in place.

All four are compatible with Claude Code, Codex, Cursor, and any shell-capable agent environment, per Ledger’s developer documentation.

Real Incidents Made This Urgent

The threat model behind Agent Stack is not hypothetical. Three documented incidents in the first half of 2026 illustrate the specific failure mode the toolkit addresses.

In May 2026, an attacker sent a free NFT — a Bankr Club Membership token — to a Grok-connected wallet on the Base blockchain. Holding the NFT automatically expanded the wallet’s permissions inside Bankr’s agent infrastructure. The attacker then replied to a public Grok post with a message encoded in Morse code. The hidden instruction, once decoded by the agent, transferred 3 billion DRB tokens to the attacker’s wallet, as documented in Ledger’s agentic AI security guide. The agent did exactly what it was told. It had no hardware checkpoint.

On February 8, Owockibot — an autonomous AI agent created by the Gitcoin team — exposed the private keys to its connected hot wallet across multiple locations despite explicit instructions never to share them. Losses were limited to approximately $2,100 only because the wallet had been deliberately funded with a small amount for testing. The team’s post-mortem conclusion: if an agent knows a private key, it is a matter of time before a manipulated prompt causes it to reveal or use that key. The only reliable fix is an architecture where the agent never knows the key.

That same month, an AI trading agent called Lobstar Wilde — built on the OpenClaw platform — suffered a quantity parsing error that transferred 52.43 million LOBSTAR tokens worth roughly $250,000; after liquidation, victims recovered approximately $40,000, according to KuCoin’s incident analysis. Malicious actors subsequently replicated the parsing error pattern to generate additional losses.

Taken together, 2026 AI agent protocol vulnerabilities have produced more than $45 million in losses through the first half of the year, according to security analysis. A separate incident at Step Finance — where attackers compromised executive devices and exploited overly permissive agent protocols — moved roughly $27 million in cryptocurrency without human authorization, with only $4.7 million recovered.

What the Architecture Cannot Do

Hardware enforcement stops a compromised agent from moving funds without you. It does not stop you from mindlessly approving a transaction you did not read. Security researchers and the International AI Safety Report 2026 both flag what is called “automation bias” — the tendency for humans to trust AI-generated recommendations more than is warranted, particularly when approval friction is low. If Ledger Agent Stack users train themselves to approve every hardware prompt without examining the trusted display, the checkpoint degrades into a speed bump.

Ledger’s design addresses this partially through the WYSIWYS principle — “What You See Is What You Sign” — meaning the hardware screen shows the exact transaction parameters, drawn by Secure Element firmware that the agent’s software layer cannot manipulate, as explained in Kicksecure’s hardware wallet threat model. The friction is intentional: you are supposed to read it.

The architecture’s upcoming phases are designed to reduce unnecessary friction for low-risk operations while maintaining the hardware checkpoint for high-stakes ones. Agent Intents and Policies, slated for Q3 2026, will let developers define hardware-enforced spending rules — for example, restricting an agent to a daily transaction cap or a whitelist of approved smart contracts — so that routine operations within policy can run automatically while out-of-policy actions still require a physical button press, per Ledger’s Q3 and Q4 roadmap features.

Beyond Crypto: Credentials and Identity

Agent Stack’s scope extends past cryptocurrency. The toolkit also enables Ledger devices to function as physical security keys for GitHub, Discord, and 1Password — applying the same architectural principle to sensitive credentials that AI agents might need access to, as detailed in Ledger’s credential security architecture.

If an agent is compromised, the attacker gains control of the agent’s reasoning. They do not gain the ability to authenticate to the services the agent was using. The hardware boundary holds whether the protected resource is a crypto wallet or a GitHub repository.

Where This Fits in the Roadmap

Today’s launch fulfills the Q2 deliverable on a roadmap Ledger published on April 14, 2026. The full schedule:

Q2 (delivered today): Agent identity, Ledger Wallet CLI, Ledger Enterprise CLI, Ledger Enterprise Multisig CLI, Device Management Kit SkillsQ3 (upcoming): Agent Intents and Policies — hardware-enforced spending rules and behavioral constraintsQ4 (upcoming): Proof of Human attestation — a layer allowing platforms to verify that a real person is ultimately behind an agent’s actions, using zero-knowledge proofs where possible

The Proof of Human layer has direct relevance beyond Ledger’s customer base. The EU AI Act Article 14 deadline compliance deadline falls on August 2, 2026 — 17 days from today — mandating that high-risk AI systems include human oversight tools by design. The Q4 Proof of Human feature is positioned to address that regulatory requirement for financial AI agent deployments.

MoonPay had already integrated Ledger hardware signing into its agent wallet on March 13, 2026, providing the first production example of the hardware-backed approval flow in a live commercial deployment. That integration used the Device Management Kit that shipped as a precursor to today’s full Agent Stack release.

Developer Community Already Building

Ledger did not launch Agent Stack cold. Its Ledger N3XT Build and Show results in June 2026, run in partnership with College.xyz, drew 50 submissions from 38 universities and blockchain clubs across 8 countries in eight days. Builders from Yale, EPFL, Purdue, and 42 Paris applied the toolkit to freight settlement, DeFi portfolio rebalancing, Telegram-native wallets, and CI/CD pipeline authorization — demonstrating that the “agents propose, hardware approves” model extends beyond simple crypto transfers.

To accompany today’s broader launch, Ledger has posted a $5,000 developer bounty and announced a $10,000 prize pool for the ETHGlobal New York hackathon.

Does Hardware-Enforced Human Approval Change the Industry Trajectory?

The larger question Agent Stack raises is architectural, not just product-level. Software-only AI agent wallets — the current default — leave the approval layer inside the same digital environment the agent influences. That is a structural vulnerability that better alignment, stronger guardrails, or smarter agents do not fully close, because the attack surface is the architecture, not the model’s behavior.

Bessemer’s agentic AI security analysis published in March 2026 found that 48% of cybersecurity professionals now identify agentic AI as the single most dangerous attack vector — not a category of attack, but the most dangerous one overall. IBM’s 2025 Cost of a Data Breach Report put the average cost of a shadow AI breach at $4.63 million per incident, $670,000 above a standard breach.

Ledger’s wager is that high-stakes financial decisions require a checkpoint that lives outside the software environment — the same argument the hardware wallet industry has been making about cold storage for a decade, now extended to the specific threat of autonomous agents. Whether that argument converts to broad developer adoption will depend on how the toolkit’s Q3 and Q4 phases address the friction problem — and on how many more incidents like Grok-Bankr occur before the industry standardizes on hardware-backed approval for agentic finance.

Frequently Asked QuestionsCan a compromised AI agent drain my crypto wallet if it uses Ledger Agent Stack?

No — this is the specific threat the architecture is designed to prevent. Even if an AI agent is fully compromised through prompt injection or another attack, it cannot produce a valid transaction signature without you pressing a physical button on the Ledger hardware device. The private keys live on the device’s Secure Element chip and never leave it. The agent can prepare a transaction and route the signing request to the hardware, but the hardware waits for your physical confirmation before signing anything. An attacker who controls the agent’s reasoning still cannot execute a transaction without your hand on the device.

What is the difference between hardware-enforced human approval and a software confirmation dialog?

A software confirmation dialog lives in the same logical environment as the AI agent — an attacker who has compromised the agent may also be able to manipulate or simulate the confirmation. Hardware enforcement removes the approval step from software entirely: the confirmation happens on a tamper-resistant chip running its own isolated operating system, with a trusted display drawn by firmware the agent cannot reach and a physical button the agent cannot press. The “What You See Is What You Sign” principle means the hardware screen shows exactly what is being signed — not what the host software claims is being signed.

Is it safe to let an AI agent manage my crypto if I have Ledger Agent Stack?

Safer than without it, but not unconditionally safe. The hardware checkpoint prevents a compromised agent from executing unauthorized transactions, but it does not protect you from approving a transaction you did not read. The security model depends on you reviewing the trusted display on your Ledger device before pressing the button — not reflexively approving all requests. The upcoming Agent Intents and Policies layer (Q3 2026) will allow you to pre-authorize routine operations within defined limits, reducing the number of confirmations needed while maintaining hardware enforcement for out-of-policy actions.

What happens if Ledger ships the Proof of Human layer too late for the EU AI Act deadline?

The EU AI Act Article 14 compliance deadline for high-risk AI systems is August 2, 2026 — 17 days from today. The current Agent Stack release addresses the human-oversight requirement through the hardware approval checkpoint: every sensitive action requires explicit human confirmation on the device. The Q4 Proof of Human attestation layer extends this to a formal verification mechanism that platforms can use to confirm a real person is behind an agent’s actions. Organizations deploying AI agents in financial contexts in the EU should evaluate whether the current hardware-approval architecture meets their specific compliance obligations while the attestation layer is in development.