Is Virtuals ACP (acp-cli) safe to connect to an AI agent?

What an AI agent can do

• Live vs paper: live on Base mainnet (ACP v2.0, April 2026); Base Sepolia and BSC testnet also supported source
• Order approval: agent wallets are Privy-managed and signer keys sit in the OS keychain after browser approval; signer policy is restricted by default (all ACP transactions), deny-all needs manual approval for every transaction, unrestricted needs none; wallet policies are address allowlists enforced server-side on every transaction and changed only in the dashboard; cards carry a spend limit; job payments stay in escrow until the client completes the job (released to the provider) or rejects it (refunded) source
• Markets: USDC agent-to-agent job payments held in escrow, agent wallets (EVM and Solana), virtual payment cards
• Pricing: not stated (providers set job prices)

Safeguards that exist

• Paper, demo or testnet mode: Paper, demo or testnet mode available source
• Withdrawal permission needed or allowed: Signers default to a 'restricted' policy allowing only Virtuals contracts; address-allowlist policies are enforced server-side, and 'unrestricted' is opt-in (official docs) source
• Scoped keys, permission scopes or IP whitelisting: Each agent signer is approved in the browser and bound to a policy (restricted, deny-all, unrestricted or custom allowlist) (official docs) source
• Open source or audited: Open source source

Safeguards that are missing

• Can it place live orders unattended?: Can place live orders with no documented approval step source
• Order approval or confirmation options: No approval or limit option in our listing source

Sources

• https://github.com/Virtual-Protocol/acp-cli

Full listing: Virtuals ACP (acp-cli) · How the score works: Safety score method