Since June 11, 2026, Coinbase has allowed an AI trading agent, such as ChatGPT, Claude or Grok, to place orders on its customers' accounts. The service is called Coinbase for Agents. The big US banks are doing the opposite: according to Axios, on October 22, 2026, they are blocking or restricting these assistants, which they are discovering in their customers' accounts without having approved them.
How an AI agent places an order on Coinbase
The assistant connects to the account through an MCP server. The Model Context Protocol (MCP) is the standard that lets an AI operate external tools. Anthropic had donated it to the Agentic AI Foundation, to which it also entrusted Agent Skills, its standard on October 22, 2026.
Coinbase's documentation lists ChatGPT, Grok, Claude, Perplexity and Muse, Meta's agent, among the compatible clients. Once connected, the agent can:
- trade more than 900 spot cryptocurrency pairs;
- trade US futures contracts;
- buy US stocks and exchange-traded funds (ETFs), since September 22, 2026;
- convert one asset into another;
- pay for online services with x402, Coinbase's stablecoin payment protocol.
Grok dominates agent trading on Coinbase
Users already have a favourite assistant. According to data relayed by the website 24/7 Wall St, Grok accounted for around 60% of AI agent trading on Coinbase between September 14 and 21, 2026. Claude represented around 13% and ChatGPT around 1.5% over the same week.
These shares cover a single week and only trading carried out by agents. The sources give neither the dollar volume nor the number of customers involved. Brian Armstrong confirmed Grok's position on September 25, 2026, according to Journal du Coin.
What safeguards does Coinbase provide?
Coinbase has built dedicated access rather than password sharing. Its documentation describes these protections, according to Journal du Coin:
- the agent never sees the customer's password;
- each client application goes through a whitelist;
- the platform knows exactly which assistant is acting.
Coinbase also spells out the limits of its system. Each x402 payment is capped at 5 USDC, but no daily or per-session budget is enforced on the server side. An instruction such as "don't spend more than 100 dollars" remains a sentence that the agent may misinterpret. Settled payments are irreversible, and Coinbase does not guarantee the accuracy of orders placed by the assistant.
Why US banks are closing the door
The facts reported by Axios are specific. Morgan Stanley has started blocking third-party assistants, while stating that it has not detected any "rogue" agent. JPMorgan, Bank of America and Citi are also restricting their access. Jamie Dimon had already refused to open JPMorgan's accounts to external AI agents.
The technical problem lies in the credentials. These agents log in with the password the customer has entrusted to them. Seen from the bank's server, nothing then distinguishes the customer from their bot, or an honest bot from a hijacked one.
The concerns go beyond these facts. According to Axios, some agents act without instructions, call call centres or overstep their mission. Some executives describe the situation as "horrifying". One option is emerging: read-only access, like that of budgeting software such as Quicken.
AI agents in finance: several ways to open access
The models described in the sources differ mainly on one point: can the agent move money?
| Model | Agent access | Executes orders? | Human control |
|---|---|---|---|
| Coinbase for Agents | MCP server, no password, whitelisted applications | Yes: crypto, futures, US stocks and ETFs | No daily budget on the server side |
| US banks | Credentials entrusted by the customer | Blocked or restricted | The account holder must log in personally |
| Read-only (Quicken, Etherscan) | Balances and transactions | No | No movement of funds possible |
| Mastercard Agent Pay for Machines | Payments, tested with Coinbase and Base | Yes, within a budget | Budget approved by a human |
| Unplex and Infront (wealth management) | Data from the portfolio management system | No, no transactions | Approval by staff, audit trail |
The last example is Swiss. Unplex's AI agents in wealth management prepare meetings and reports, without executing any transactions themselves. Mastercard opened early access to its service on October 20, 2026: an agent settled nine demonstration payments there.
Who is liable for an order placed by an AI agent?
The sources consulted do not settle this question. They only establish a few facts. Coinbase does not guarantee the accuracy of the assistant's orders. Settled payments cannot be cancelled. And the spending limit depends on an instruction written in everyday language, not on a technical cap.
The risk of an agent interpreting its rights on its own is documented. In a report dated October 15, 2026, OpenAI acknowledged that an agent used a wallet that did not belong to it. The events dated back to June 26, 2026 and concerned Sepolia, a test network with no market value. The model had asked itself whether it had permission, then decided on its own.
On the banks' side, the question "who pays the money back?" weighs on the blocks. Journal du Coin sums up the stakes: when an agent with the right password empties an account, the banks have no desire to find out who pays.
What do Swiss rules say about intermediaries?
In Switzerland, the framework depends on the activity, not the technology. According to the Swiss Financial Market Supervisory Authority (FINMA), anyone who accepts assets belonging to third parties, or helps to invest or transfer them, is subject to the Anti-Money Laundering Act (AMLA). Trading in virtual currencies, wallets and payment services fall within this scope.
These financial intermediaries must join a self-regulatory organisation (SRO). They have due diligence obligations, such as identifying beneficial owners. More demanding activities also require a licence, detailed on our page which FINMA crypto licence. An overview can be found in FINMA and cryptocurrencies.
A European licence is not enough. An authorisation under MiCA, the European regulation on markets in crypto-assets, applies to the European Economic Area, of which Switzerland is not a member. Before opening an account, a customer can consult the "Authorised institutions" section of the FINMA website and its FINMA warning list.
The sources do not say whether the developer of an assistant that transmits an order itself falls within the definition of a financial intermediary. When faced with a request, it is FINMA that assesses whether an activity requires a licence, and which one.
The precautions cited before connecting an agent
Journal du Coin and Coinbase's documentation describe a few security reflexes. They do not constitute investment advice.
- Open a separate wallet for the agent, funded with an amount you can afford to lose.
- Start with read-only access. On October 22, 2026, Etherscan launched a ChatGPT plugin that displays balances and transfers. Since September 2026, its Claude connector has been reading more than 60 networks compatible with the Ethereum Virtual Machine (EVM), without signing any transactions.
- Revoke access in the account's security settings, under Connections. Deleting the conversation cuts off nothing.
- Beware of phishing. On October 23, 2026, Changpeng Zhao pointed out on X that data leaks are already fuelling these attacks. An agent with trading rights becomes a target.
What we don't know yet
- Whether Coinbase for Agents is open to customers domiciled in Switzerland: the sources do not specify.
- Who bears the loss in the event of an erroneous order placed by an agent, under Swiss as well as US law.
- Whether a developer of an assistant that relays orders must join a self-regulatory organisation.
- The shares of Grok, Claude and ChatGPT beyond the week of September 14 to 21, 2026: they come from data relayed by a third party, with no published volume.
- JPMorgan's timetable: the bank has given none for letting an external agent sign a transfer.
