An AI agent that can move money is, by construction, an agent that can be tricked into moving money. The whole security literature of the last year — prompt injection through a poisoned tool description, a confused-deputy call, a payment agent talked into the wrong transfer — comes down to one fact: if the authority to act lives in the same runtime the attacker can reach, the guardrail is only as strong as the model's judgment on its worst day.

Ledger Agent Stack, open-sourced July 15, 2026, answers that with hardware. Its design rule is one sentence: agents propose, humans approve, the signer enforces. The agent can read balances, pull history, and draft a transaction all it wants. It cannot complete one. The signature is produced on a physical Ledger device — outside the agent's software entirely — and only after a human confirms the exact details on the device's own screen.

The model: the agent gets the keys to nothing#

Split every operation into two piles. Read-only work — checking balances, transaction history, wallet info — the agent does autonomously; nothing needs a key, so nothing stops. Anything requiring a signature — a transfer, a swap, staking, any on-chain write — stops at the device and waits.

Ledger's name for the guarantee is WYSIWYS: What You See Is What You Sign. The agent prepares the transaction in its runtime, but the approval happens on the trusted display of the hardware device, which renders the real amount and destination before anyone confirms. A compromised agent can lie to your screen; it cannot lie to a screen it doesn't control. That is the entire trick, and it is a good one.

A server-side spend cap lives in a system an attacker might reach. A hardware signature lives in a system the software never holds. For an irreversible action, that difference is the whole ballgame.

What's actually in the kit#

It's a set of CLIs and apps, not a framework — you bolt it onto the agent you already run.

Everything is open source under github.com/LedgerHQ.

Wiring it in#

The stack targets the agents founders already run — Claude Code, Codex, Cursor, Cline, Windsurf, and any MCP-capable client. Installing the skills is one command:

# install Ledger's agent skills into your IDE / coding agent
npx skills add LedgerHQ/agent-skills

# or let the Wallet CLI install its own skill for a detected agent
wallet-cli skill install --agent claude

From there the agent has the vocabulary to prepare transactions the correct way — draft, present for hardware confirmation, and never expect to sign on its own. If your workflow is read-only, you can run the whole thing without a device connected and add the hardware the day an agent needs to write.

The idea that outlives the crypto framing#

Strip away the wallets and this is a statement about human-in-the-loop design generally. Most approval gates we build are software gates — a requires_approval flag, a server-side policy check, a Slack "approve?" button. Those are the right default for speed and volume, and they're enough when a mistake is bounded and reversible. But they all share the runtime with the thing they're supposed to constrain.

Ledger's move is to put the final authority somewhere the agent has no software path to: a device with its own screen and its own key, held by a person. That's not the right tool for every action — it's slow, and it needs a human present. It is the right tool for the class of actions where a single wrong call is catastrophic and can't be undone. The lesson to carry into your own architecture, crypto or not: decide which of your agent's actions are irreversible, and for those, ask whether your guardrail lives inside the blast radius or outside it. The best ones are outside.

If you're mapping where automated authority should stop, the companion reads are the policy-gated software wallet for the reversible-and-frequent case, durable human-approval that survives an agent restart for the plumbing, and agent payment protocols for the rails underneath it all.