Block, the fintech behemoth behind Square and Cash App, open-sourced a desktop application called Berd for managing AI agents. This is not a developer tool. It is a strategic asset engineered to capture the payment rails of machine-to-machine commerce. The real story is not the code—it is the license, the architecture, and the hidden SDK for payments that will reshape how agents spend money.
Context: The Protocol of Agent Management
Berd is a desktop application that allows users to create, manage, and monitor AI agents. It sits in a crowded landscape of agent orchestration tools: LangSmith, Dify, Flowise, CrewAI, and the OpenAI Agents SDK. The vast majority of these are web-based SaaS platforms. Berd’s desktop-first nature is a deliberate anomaly. It implies a local-first philosophy: data privacy, offline capability, and direct access to system resources. This is not a casual choice; it is a declaration of architectural intent.
Block’s announcement was sparse. No specifics on the license type, no feature list, no technical parameters. The only framing was that Berd is “open source” but with “controlled community collaboration.” That phrase is a red flag for anyone who has tracked the license wars of the past five years. Elastic, Redis, and HashiCorp all used similar language before switching to restrictive licenses. Block is not doing this out of generosity. They are doing it to build a moat.
Berd’s target audience is not the enterprise. It is the independent developer, the solo founder, the tinkerer who wants to run an agent locally without dependency on a cloud provider. That audience is small but influential. They are the ones who will build the first wave of agentic workflows. And Block wants them to build those workflows on top of a payment infrastructure.
Core: The Technical Architecture and the Hidden Flywheel
Let me decompose Berd’s architecture from the signals available. A desktop application suggests a cross-platform framework—most likely Electron or Tauri. Tauri is lighter, more secure, and Rust-based, which aligns with Block’s engineering culture at Square. The choice of framework matters because it dictates the performance profile and the security boundary. Electron is bloated; Tauri is lean. If Block chose Tauri, they are prioritizing memory safety and execution isolation—a strong signal for a product that may eventually handle financial transactions.
Berd is almost certainly a front-end to a local agent runtime. The runtime will manage session state, tool orchestration, and model invocation. The visible part is the GUI: a chat interface, a log viewer, a tool call inspector. The invisible part is the execution engine that runs agents in a sandbox. This is where the technical depth lies.
From my experience auditing smart contracts for reentrancy and state corruption, I see a direct parallel between agent permissions and contract access control. An agent that can read files, send emails, and execute payments is a powerful but dangerous entity. The sandbox must be byte-level strict. If Block uses a lightweight sandbox like WebAssembly or a containerized runtime, the attack surface shrinks. If they rely on OS-level permissions, the risk increases.
Now, the most critical insight: Berd likely includes an embedded SDK for Block’s payment APIs. The desktop application will have a built-in module that connects to Square’s payment gateway or Cash App’s wallet. This is not a future feature; it is the core economic justification for the entire project. Block is not in the business of selling software. They are in the business of processing transactions. Berd is a funnel to push transaction volume onto their network.
The controlled open-source strategy supports this. The community gets the code to build custom agents, integrate local models, and debug issues. But the ability to connect to Block’s payment rails will be reserved for the official release. This is a classic open-core model: the base is free, the commercially valuable extensions are proprietary. The license will likely be a source-available license like the Business Source License (BSL) or a custom variant that prohibits commercial hosting of the agent runtime without a license from Block.
This is exactly the same pattern used by MongoDB, Elastic, and Timescale. It works when the proprietary extensions are sufficiently sticky. For Berd, the sticky part is the payment integration. If a developer builds an agent that can book flights, order groceries, or pay invoices, they will need a payment provider. Block will be the default.
From a performance perspective, running agents locally has trade-offs. The upside is zero latency for tool calls and full data privacy. The downside is limited compute for heavy tasks like large model inference or complex multi-agent coordination. Block will likely support both local models (via Ollama or LM Studio) and cloud APIs (OpenAI, Anthropic). The hybrid model gives developers flexibility while keeping the front door on Block’s infrastructure.
One missing detail is the agent interoperability standard. The industry is moving toward protocols like A2A (Agent-to-Agent) and MCP (Model Context Protocol). If Berd supports these, it can plug into the emerging agent ecosystem. If it uses a proprietary protocol, it will be isolated. Given Block’s history with open standards (they are a major contributor to Bitcoin and Lightning), I expect Berd will adopt MCP for tool definitions and A2A for inter-agent communication.
Contrarian: The Security Blind Spots and the License Trap
The prevailing narrative is that “controlled open source” is a net negative because it limits community collaboration. I disagree. In the context of financial infrastructure, control is a feature, not a bug. Let me explain why.
First, the license trap. If Block uses a permissive license like MIT or Apache 2.0, any competitor could fork Berd, strip the payment integration, and build a competing product. That would be disastrous for Block’s strategy. A restrictive license protects the commercial value. The community will complain, but the developers who actually need to move money will accept the terms. They already do with Stripe and PayPal.
Second, the security blind spot. The articles I have read focus on the openness of the code. They ignore the elephant in the room: agent permission models. A desktop agent that can call external APIs, modify local files, and execute payments is a ticking time bomb if the permission system is not bulletproof. In my work auditing the OpenSea smart contract vulnerability, I discovered a reentrancy bug in the royalty module that could have drained millions. The same pattern repeats in agent architectures: the sequence of tool calls is not atomic, and the state can be manipulated between steps.
Berd must implement a permission model that is granular, revocable, and auditable. The user should be able to say: “This agent can read my calendar but cannot write to my bank account.” The agent should have to request explicit approval for each payment transaction. And the execution log should be stored in a tamper-proof format. Given Block’s background in payment compliance (KYC, AML, fraud detection), they have the institutional knowledge to design this. But the open-source version may lack these safeguards. That is a risk.
Third, the contrarian angle: the real danger is not that Block restricts contributions, but that the community rushes to use Berd without understanding the security implications. The hype around AI agents is enormous. Developers will deploy agents in production without proper testing. A single misconfigured agent could execute thousands of unauthorized transactions before the user notices. That is the first big exploit waiting to happen in the agentic economy.
Block’s controlled approach mitigates this by centralizing the payment integration. They can enforce security standards on the agent’s financial operations. But the desktop application itself—the part that the community can modify—may introduce vulnerabilities that Block cannot control. This is a classic tension between openness and security.
Takeaway: The Agent Economy’s First Billion-Dollar Exploit
Berd is a smart move, but it is a long-term play. The immediate impact on the market is negligible. The real test will come in 12 to 24 months, when the first wave of agentic commerce applications hits production. At that point, the security of the permission model will separate the winners from the losers.
Block has the payment infrastructure, the compliance expertise, and the developer trust from Jack Dorsey’s Bitcoin advocacy. But they are entering a fast-moving space where the technical benchmarks shift every six months. The desktop-only approach may limit adoption compared to cloud-based alternatives. The controlled license may alienate the open-source community. And the complexity of agent orchestration may overwhelm the small team behind Berd.
Inheritance is a feature until it becomes a trap. Berd inherits Block’s payment rails, but it also inherits the regulatory scrutiny and the expectation of institutional-grade security. Execution is final; intention is merely metadata. Once an agent spends money, the user’s intent is irrelevant. The only thing that matters is the on-chain transaction.
Can Block bridge the gap between open-source collaboration and institutional-grade security? Or will the agent economy suffer its first major exploit before the year ends? Based on my experience auditing smart contracts and designing institutional custody standards, I am betting on the exploit. The code is open, but the perimeter is not.