Algorand ships AC2, an open protocol that keeps AI agents off users' keys

The control problem at the heart of agentic commerce

The Algorand Foundation's launch blog¹ for its new protocol opens with a scene familiar to anyone running AI agents in production: a developer's agent had its runtime compromised by a malicious plugin dependency, and the attacker walked away with the API keys and session tokens sitting in that environment, plus enough access to push a code merge that appeared to carry the lead engineer's approval. The team could not prove a human had not approved it — the approval had been a message in a Slack thread. AC2², the Agentic Communication and Control Protocol, released by the Foundation on August 25, is the answer that scenario was written to frame. Days later, the latest episode of the Foundation's Verifiably Random podcast³ spelled out the stakes in its title: 'Who controls your AI agent?'

AC2 lands at the center of the Foundation's push into agentic commerce — machine agents that buy goods and services on a user's behalf. That push has produced concrete momentum this year: the Foundation's implementation of the x402 payment standard — which revives the dormant HTTP 402 'Payment Required' status code, letting a server demand payment and an agent settle it over blockchain rails in a single round trip — was merged by Coinbase in the first half of 2026. GoPlausible, the ecosystem's AI infrastructure provider, launched its production facilitator for verifying and settling those payments in July, and its public dashboard⁴ now logs 877,000 all-time settlements and $286,000 in settled volume, 77 percent of it on Algorand mainnet, at an average settle time of 0.4 seconds. CMO Marc Vanlerberghe told viewers on the episode that more than 1,000 developers have signed up for the Global x402 Challenge — which he says has produced roughly 3,000 endpoints — and that Algorand ranks third for x402 traffic, behind Base and Solana, per Token Terminal.

Yet the more agents can do, the more dangerous they become. Vanlerberghe's point in the episode is simple: they are non-deterministic systems, their behavior shaped by LLMs that no demo can fully predict. That is tolerable in a chat; it is not tolerable when the same system holds passwords, reads email, or spends money. Most agent frameworks today work by handing the agent a copy of the user's credentials — the model under which an attacker who compromises the runtime inherits everything. Chat confirmations, whether in WhatsApp, Telegram, or Slack, add a human check but no cryptography: a 'yes' in a thread proves nothing about who sent it or what they approved.

Signing like a dapp swap — with an agent on the other side

AC2's design transplants a pattern long used in Web3. When you swap tokens in a dapp, the application never touches your private keys: it asks your wallet to connect, you review and sign the transaction, and the dapp executes it. AC2 makes the agent the dapp. The agent prepares an action — a payment, a code commit, an API call — and sends a signing request over an end-to-end encrypted channel to your app. You review the details and approve with a passkey: a FIDO2 hardware-bound authentication, confirmed by face, fingerprint, or device PIN, that lives in the device's secure hardware rather than in software an attacker could phish. The signature is delegated back to the agent, which completes the action. The key itself never leaves your device.

The transport is assembled from open standards rather than invented fresh: DIDComm v2.0⁵ for message formats, WebRTC for direct peer-to-peer communication after an initial handshake, and Liquid Auth, the Foundation's passkey-based connection layer. There is no central relay — no operator in the middle that can log, map, or block the conversation. Identity is built in rather than bolted on. Both the user and each agent hold a decentralized identifier (DID), the W3C's standard for identifiers that an entity controls itself rather than receiving from an authority, and on first pairing the two are cryptographically linked. That link is what will eventually let a merchant ask an unknown shopping agent to prove who actually owns it — a provenance chain that chat interfaces cannot produce.

AC2 is specifically blockchain-agnostic; it operates with no blockchain at all. The AC2 Wallet app, published by Pera Wallet, Lda in partnership with the Foundation, is a self-custodial Algorand wallet, so a user who wants to spend USDC⁶ through an agent can approve the payment and settle it in the same interface. The Foundation says a basic integration runs 'just about fifty lines for a basic flow.'

What a user can actually approve

The layer between intent and execution

AC2's most consequential slot in the wider agentic stack is the one it shares with Google's AP2 protocol, announced in late 2025 with Algorand among its launch partners. AP2 defines how an agent records an intent mandate — the auditable description of what it may do — but it does not specify how that mandate reaches the user or how the user signs it. AC2 is precisely that missing mechanism: the agent sends the mandate, the user signs it on their device, and the signature is handed back for the agent to execute against. The same separation of powers applies to x402 payments: the agent assembles the payment details, the user approves, the agent completes the call.

Korea IT Times's analysis⁷ of the release stresses what the design does and does not guarantee. AC2 establishes who approved a specific request; it does not judge whether the request is appropriate. A user can still approve a malicious or misleadingly constructed transaction if the wallet does not clearly present its destination, amount, and consequences — cryptographic proof can establish that approval occurred, but not that the user understood what they approved. And because the current version asks for a signature on every action, the design carries an approval-fatigue risk: users bombarded with prompts may stop reading them. The Foundation's announced next step is bounded delegation — letting users define spending ceilings, permitted counterparties, and time windows once, after which the agent acts freely within those limits and returns to the user only for exceptions.

The self-custody tradeoff deserves equal billing. The wallet's terms are explicit: 'If you lose your device or your recovery phrase, your access to anything you have linked through AC2 may be permanently lost.' Nobody has a copy of the keys to restore.

A spec one week old

What shipped on launch day is an open specification and reference implementation⁸ — a Draft dated April 1, 2026 — alongside 1.0.0⁹ releases of an SDK, a CLI, and a reference plugin for OpenClaw, the open-source agent framework. Early adoption is measurable precisely because it is small: the GitHub repository carries 20 stars, and npm telemetry shows the OpenClaw plugin was downloaded 458 times in the past week and the SDK 247 times — figures consistent with a days-old launch rather than broad deployment. As the Korea IT Times piece puts it, an open specification becomes an industry standard only when wallets, agent frameworks, and service providers implement it consistently; what was released starts that process without demonstrating it.

OpenClaw users can test the flow today: install the AC2 plugin and enable it, run the setup command, restart the gateway, and pair the AC2 Wallet — available on Android and iOS — by scanning a QR code. That is the demo Bruno Martins ran on the podcast, chatting with an agent and approving an action live. The episode closes with Fred Estante, Head of DeFi, surveying the wider ecosystem — DeFi, x402 adoption, and upcoming governance changes — a reminder that AC2 is one piece of a broader push rather than a standalone tool.

Who holds the keys

The question the episode title poses has a reflexive answer in crypto: whoever holds the keys controls the account — 'Not your keys, not your crypto.' AC2 extends that discipline from accounts to agents. An agent may be fast, cheap, and indefatigable, but under AC2 it is structurally incapable of acting without asking — and each answer it receives is a signature, not a chat message. The protocol's fate now rests with the wallets and agent frameworks that choose to make that distinction standard.