Binance introduced Agent OS on 20 August 2026 as a developer layer between AI applications and its market data, trading, wallet and payment stack. Compatible clients named at launch include ChatGPT, Claude (including Claude Code), Codex and Cursor. A user can authorize an agent to read markets, inspect a designated account view, and place supported orders.
The control model is a dedicated subaccount. Withdrawals from that subaccount are blocked by default. The agent cannot pull funds from the main account into the agentic box; the user funds it. Binance has not advertised a separate loss cap on top of that balance, so the money you transfer in is the practical limit. Access can be revoked. Permissions are user-defined.
Users can also choose whether every order needs a human click or whether the agent may fire once those permissions are set. That is the difference between a copilot and an autonomous trader sitting on a fenced pile of capital. Prompt injection, a bad instruction, or a model that “helps” by overtrading still lose whatever sits in the box.
Agent OS lands in the same week-long wave as Coinbase for Agents and Kraken’s assistant, which recommends but will not execute until the user approves. The product question is no longer whether exchanges will let models see a book. It is who is allowed to press the button, and how small the blast radius is when they do.
