Algorand Foundation released AC2, an open-source protocol designed to secure communications between users and AI agents, addressing token theft and fake approval vulnerabilities in autonomous systems.
The protocol uses end-to-end encrypted WebRTC connections to isolate approval logic from chat interfaces and isolate API keys from runtime environments, two attack vectors Algorand identified as standard in current AI agent deployments. A session token compromised in a chat thread would no longer grant transaction approval under AC2; API keys would not be held in memory during agent execution.
The announcement frames the problem as structural rather than operational. When an AI agent asks a user to approve a transaction, that approval today typically appears as a message in a conversation thread, the same thread a compromised session token can read and spoof. The runtime holding that agent's API keys is a second failure point; any exploit that reaches process memory can extract them wholesale. AC2 separates these layers cryptographically.
Algorand open-sourced the protocol on GitHub and published technical documentation on the AC2 Protocol website. The foundation positioned AC2 as blockchain-agnostic; agents using it can execute transactions on any chain, not only Algorand's own network.
AI agent frameworks have matured rapidly over the past 18 months, with systems like Anthropic's Claude and OpenAI's GPT models now capable of executing code and calling external APIs autonomously. Financial institutions and crypto protocols have begun deploying agents for portfolio rebalancing, arbitrage, and liquidity provision, use cases where a single compromised approval could unlock substantial value. Security frameworks for agent-to-blockchain interaction remain nascent; most production systems rely on explicit user approval mechanisms without cryptographic separation between approval channels and execution environments.
The broader market for AI agent infrastructure is consolidating around a handful of frameworks. Anthropic, OpenAI, and smaller chains like Solana have each released agent SDKs or reference implementations in 2025 and 2026. Algorand's AC2 entry is the first to isolate approval logic as a distinct security layer rather than treating it as a parameter within a general-purpose agent framework.
AC2's adoption will depend on whether major AI frameworks integrate it as a standard option or whether it remains a specialized add-on for protocols that make security a priority. If Anthropic or OpenAI integrates AC2 into their official agent SDKs within the next six months, adoption could accelerate across all blockchains; if AC2 remains a separate library that developers must intentionally opt into, it will likely see use mainly in projects where Algorand has direct relationships.
