Learn · AI agents

How AI agents swap tokens without holding keys

Written by XAUConnect Labs · Reviewed against live product behavior · Updated August 2026

“AI agent trading” is usually a prompt wrapped around a hot wallet, which is just a bot with extra steps. The architecture that does not immediately lose the treasury is: the model proposes, a policy engine constrains, and a signer (KMS, Turnkey, hardware, session key with caps) executes. XAUConnect’s API is the quote/build layer in the middle. It is not the signer.

This article is for people wiring LangChain/OpenAI tools to quote and build endpoints without pasting a private key into a .env that also lives in a chatbot log. If you cannot draw those three boxes on a whiteboard, do not connect a funded wallet yet.

The three processes

Planner: an LLM that turns “rebalance 10% into USDC on Base” into a structured intent. Router: XAUConnect quote + your own risk checks (max impact, allowlisted tokens, max notional per hour). Signer: something that cannot be the chat transcript. If those three share one Node process with one env var, you built a custodial bot and called it an agent.

What the model is allowed to see

Give it quotes, token symbols, and explorer links. Do not give it seed phrases, KMS credentials, or raw signed bytes that another process could broadcast. Tool outputs should be numbers and hashes, not “here is the private key in case you need it.”

Policy before build

Hard-code: allowlisted chainKeys, allowlisted token addresses, max USD notionals, max price impact, min liquidity, cool-down after a failed tx. The LLM must not be able to invent a new token address from a tweet. Paste-from-Twitter is how agents buy honeypots faster than humans.

Identification and audit

Set a stable agent name in the client identification headers. Record every fill through the optional swap recording endpoint and keep your own ledger of intents vs hashes. When the agent misbehaves you want a timeline, not a vibe.

Solana vs EVM for agents

EVM: you broadcast. Solana: you may use the signed-bytes relay after signing. Either way the signer is yours. Session keys with spending limits are kinder than god-mode keys when the prompt injection of the week arrives.

Prompt injection is a market order

If a webpage, tweet, or token description can change the model’s next tool call, it can change the token address. Treat untrusted text as hostile. Strip it before the planner. The policy engine should ignore any address the user did not explicitly allowlist, even if the model “is sure.” Speed without that clamp is just automated honeypot shopping. Write the allowlist in config, not in the prompt, and fail closed when the list is empty.

Legal

Risk disclosure

XAUConnect is a non-custodial swap aggregator. Digital assets are volatile and may lose value rapidly. Content on this page is educational and not investment advice. Verify every contract address on the official block explorer before approving a transaction.

Frequently asked questions

Does XAUConnect host agent keys?

No. We never take custody. If a vendor offers “we’ll sign for your GPT,” that vendor is the custodian, not us.

Is there a special AI schema for Google?

No. Google’s June 2026 documentation says extra AI markup is unnecessary. Agents consume the REST API; crawlers read the HTML docs.

Can I let the model set slippage?

Only inside a tight bound your policy engine clamps. Unbounded slippage is how an injected prompt empties a wallet in one hop.

Where do I start in the docs?

/developers/quickstart, /developers/blog/introducing-swap-api-for-ai-agents, and this site’s Swap API reference.

Live execution

Trade on XAUConnect

Open the swap page to compare live routes, set slippage, and sign from your own wallet — fully non-custodial.

Open swapExplore markets

Continue exploring

Related markets, guides & networks

Curated next steps based on this topic — deepen your research before you trade.

Guides
Articles
Platform

Build programmatically

Swap via API for bots and AI agents — quotes, builds, and cross-chain routes.

Developer quickstart