10-20-2026 
|
Getting your Trinity Audio player ready...
|
TL;DR: BRC-181, approved as an official BSV standard in September, lets an artificial intelligence (AI) agent spend from a wallet without a human confirming every transaction. The owner signs a set of spending rules (per-payment caps, time-period budgets, an approved recipient list, rate limits, and a kill switch), and the wallet enforces them no matter what the agent asks for. The standard assumes the agent will eventually be tricked by an attacker into requesting a bad payment, and it is built so that even then, the worst possible loss is the small allowance in the agent’s own isolated account.
Key Takeaways
- BRC-181 is an official BSV standard for letting AI agents spend money unattended, inside signed limits.
- Testing exposed critical spending loopholes, leading to stricter post-transaction checks.
- BRC-181 was created to let AI agents safely make automated micropayments.
- Delegated AI agents can inherit smaller budgets for payments that must keep running.
- BRC-181 adds wallet-level spending controls while keeping agent payments disabled by default.
An AI agent that can pay for things on its own is useful… if it can’t be talked into handing everything over to a thief. A new BSV app standard, approved in September, takes that problem off the AI’s hands entirely and gives it to the wallet, which enforces a signed set of rules about what the agent may spend, where, and how fast.
The standard is BRC-181, the Wallet-Enforced Autonomous-Agent Spend Policy, written by developer RexStarBSV and merged into the official Bitcoin Request for Comments (BRC) repository after a review.
The problem it solves is one that even the most ardent AI proponents find bothersome. Large language models (LLMs) feel smart, but also naive. Software driven by LLMs can be “prompt-injected,” meaning an attacker slips it instructions (sometimes invisibly) that make it request a payment to the wrong place. Today’s wallets offer two bad options: ask a human to approve every transaction, which is useless for an agent making thousands of micropayments per hour, or hand the agent a key to everything and hope for the best.
“An LLM-driven agent will eventually be prompt-injected into trying to send everything to an attacker, so safety cannot depend on the agent behaving,” RexStarBSV told CoinGeek. “The wallet has to treat every field of every request as hostile input and check it against limits the owner has signed.”
BRC-181 works like an allowance, but well-documented. The owner signs a policy that sets a cap per payment, a cap per rolling time period, a lifetime total, a list of approved recipients, a speed limit, and circuit breakers that freeze everything if activity looks strange. The agent can ask for anything it likes. The wallet only obeys the signature.
Just as important is where the agent’s money lives. Each agent gets its own isolated account with a capped balance, separate from the owner’s main wallet. The most an agent can ever lose is what its owner chose to put in that account. The owner can also freeze or revoke everything instantly, and a tripped circuit breaker stays tripped until a human clears it.
The bug that proves the paranoia is earned
This might all sound like over-engineering, until you hear what testing discovered. In August, RexStarBSV said, a test approved a 100-satoshi payment under a 1,000-satoshi lifetime budget, while the transaction quietly carried 500,100 satoshis in miner fees. The caps checked the payment amount, but the fee doesn’t exist until the transaction is built, so it sailed straight past them.
The fix is now written into the standard: fees get re-checked after the transaction is built and before it is signed.
Before submitting the proposal, he also put the draft through what he described as a structured adversarial audit, which produced 151 findings. Three were critical, including others similar to the fee hole: a way to hide value within data outputs that the recipient list could not see, and a way to reset a freeze simply by restarting the wallet. All three are fixed and are now hard requirements in the standard.
The policy engine behind all this has about 650 automated tests of its own, he said, and the whole wallet around it runs about 4,800.
Born from one-satoshi payments
The standard grew out of a real project rather than a thought experiment.
“In July, I was designing around x402-metered services, where an API charges an AI agent one satoshi per query with no API key and no account,” RexStarBSV said. “The gap was obvious: a service could bill an agent a satoshi per call, but nothing let an agent safely pay one.”
That is the same territory as BRC-166, a new agent payments standard we covered recently, and there is still one gap where the two meet. BRC-166 tells payment servers to issue a fresh receiving address for every invoice, but BRC-181’s signed recipient list can’t be written in advance for a payee like that. Services that bill to a stable address work under BRC-181 today. For the fresh-address kind, a follow-up revision that names the payee rather than the address is, RexStarBSV said, the next piece of work he intends to do.
“I could have widened the model before submitting, but under time pressure, I chose to state the limitation plainly in the standard so nobody builds around it by mistake,” he said.
Agents that outlive their owners
One feature points further out than the rest. A policy can let an agent create child agents with their own smaller budgets, and this comes from an interesting potential use case: “a standing agent that keeps an obligation alive after its owner is gone,” RexStarBSV said, “renewals and hosting for an archive, a memorial, or a published service record that must not lapse.”
The whole family of agents draws on the parent’s single budget; no child can hold more than the ceiling the owner signed, and delegation is off unless the signed policy says otherwise.
Built into a wallet, off by default
BRC-181’s enforcement engine is built into a self-custody BSV desktop wallet RexStarBSV has in development, alongside an offline signing app that could live on a spare phone. There isn’t a definite launch date for these yet, but he said the source code, including the BRC-181 reference implementation, will be published when that happens. Four of his standards drawn from the same project have already been merged since late July.
There’s one detail he was keen for users to know about: “It ships switched off. A build cannot run an agent at all until its owner performs a key ceremony and pins their own signing key into it. No policy signed by anyone else is ever accepted.”
No other BSV wallet maker has picked the new standard up just yet, though the invitation is open. “The standard is written so that another team can build a compatible engine from the specification and test vectors alone, without seeing my code,” RexStarBSV said, adding he would be glad to help the Yours and Metanet Desktop teams implement it if they wished.
There is a fair bit of noise in the mainstream news at the moment about AI safety, much of it speculative and some of it clearly agenda-driven. The risk BRC-181 addresses is neither of these. It’s a mundane, provable problem: software that makes decisions and spends money can be tricked by a scammer wishing to send it to the wrong place. The AI industry’s answer so far has mostly been to ask everyone to trust the model’s good behavior, or (somehow) slow down AI development altogether. This standard’s answer is that you shouldn’t have to do either. An agent can be as smart or as compromised as it likes, and the rules still apply, because they were never the agent’s rules to break.
FAQs
What is BRC-181?
BRC-181 is an official BSV standard that lets an AI agent spend from a wallet without a human confirming each transaction. The wallet enforces a signed policy covering spending caps, approved recipients, rate limits, and circuit breakers, so the agent can never move funds outside the rules its owner signed.
Can an AI agent spend Bitcoin without human approval?
Yes, under BRC-181, an agent can spend unattended, but only inside signed limits. The human owner approves the rules once, and the wallet enforces them on every request. The owner can freeze or revoke the agent’s access at any time.
What is prompt injection, and why does it matter for AI agents with wallets?
Prompt injection is when an attacker hides instructions in content an AI agent reads, tricking it into taking actions such as requesting a payment to the attacker’s address. BRC-181 assumes this will eventually happen and ensures the wallet rejects any request that breaks the owner’s signed rules.
What happens if an AI agent tries to spend more than its limit?
The wallet simply rejects the request. Depending on the policy, an over-limit request can also be escalated to the human owner for a decision. If activity looks anomalous, circuit breakers freeze the agent until the owner intervenes.
How does BRC-181 relate to BRC-166?
BRC-166 is a payments standard that lets servers bill AI agents per request over HTTP. BRC-181 is the spending guardrail on the payer’s side. Services billing to a stable address work under BRC-181 today; a planned revision will cover payees that issue a fresh address per invoice.
Which wallets support BRC-181?
The standard is built into a self-custody BSV desktop wallet currently in pre-release development by its author. The specification and test vectors are public, so any BRC-100-compatible wallet can implement it.
In order for artificial intelligence (AI) to work right within the law and thrive in the face of growing challenges, it needs to integrate an enterprise blockchain system that ensures data input quality and ownership—allowing it to keep data safe while also guaranteeing the immutability of data. Check out CoinGeek’s coverage on this emerging tech to learn more why Enterprise blockchain will be the backbone of AI.
Watch: Can we trust AI? How blockchain and IPv6 could fix accountability
