Binance, the crypto exchange with more than 300 million registered users, launched Agent OS, a platform that lets developers connect AI agents to Binance’s financial infrastructure so that agents can analyze markets and execute trades on users’ behalf. Agent OS brings together existing Binance tools and services, including Binance APIs, Binance Wallet Agentic Hub, Binance x402 transaction verification and payment facilitator API, and Binance Skill Hub, along with newly introduced support for the Model Context Protocol (MCP). The platform also works with tools such as OpenAI’s ChatGPT and Codex, Anthropic’s Claude Code, and Cursor, allowing users to authorize agents to access market data, view account information, and execute trades.

Binance is positioning Agent OS as a system of controlled autonomy rather than total freedom. “Instead of total freedom, we put the power in users’ hands,” Jeff Li, Binance’s vice president of product, told TechCrunch. The main control mechanism is the sub-account: users assign agents to dedicated sub-accounts configured for specific activities such as spot or futures trading. Withdrawals from those sub-accounts are blocked by default, which creates a sandbox around what an agent can do. Users also choose whether an agent must ask for approval before every order or may execute autonomously once its permissions are configured. Binance does not impose a separate cap on how much an AI agent can trade or lose within a sub-account, so the amount transferred into that sub-account effectively becomes the limit.

A notable limitation is transparency into why an agent acted. Li said the model that leads to a trade happens outside Binance systems, “either on the user’s computer or within their chosen AI application.” Binance can monitor the resulting trading activity, but it has limited visibility into whether a decision was influenced by faulty information or manipulation. When asked about prompt-injection attacks or compromised agents, Li pointed again to the sub-account design as the primary defense, and the company says its existing security, risk-control, and anti-money-laundering policies for sub-account APIs apply to Agent OS at launch.

Agent OS targets trading as an early use case, but Binance also frames it as a broader agent infrastructure layer. Agents can monitor markets, conduct research and risk analysis, react to signals, place autonomous orders, and execute strategies such as arbitrage. Agent OS connects agents to payments and on-chain activity as well. Through Binance’s x402 integration, agents can send and settle payments, while the Agentic Wallet lets them interact with tokens and DeFi protocols. Those wallet capabilities have explicit daily limits: regular swaps are capped at $50,000 per day, DeFi transactions default to $100,000 per day, and x402 payments are limited to $20 per day.

Li described Agent OS as Binance’s “first step” toward giving developers a platform for AI applications that can act across crypto and traditional markets. Binance is not the only exchange moving in this direction. Kraken released an open-source command-line tool with a built-in MCP server in March for AI agents to execute spot and futures trades, Coinbase launched Coinbase for Agents in June for user-limited trading and payments, and OKX enabled agentic trading through an open-source MCP toolkit earlier this year.