Coinbase gave agents a portfolio and put stocks onchain. Neither move names a counterparty

Published August 28, 2026 · Last reviewed September 5, 2026

On June 11, 2026, Coinbase launched Coinbase for Agents, a platform that lets assistants such as ChatGPT and Claude connect directly to a user’s Coinbase account and execute trades, rebalance a portfolio, and settle payments.¹ The design decision worth noticing is not the trading. It is the container: an agent operates inside an isolated portfolio with no visibility into the rest of a user’s holdings, under guardrails described at launch as maximum trade sizes and daily limits.² The stated analogy from the coverage is a gift card rather than a bank account.

On August 24, 2026, a second thing happened that also puts agents closer to regulated assets, and it arrived by a completely different route. Coinbase issued tokenized shares of Apple, Nvidia, Meta and Alphabet natively on Base, using its B20 token standard, each backed one to one by a real share held with the custodian Alpaca.³ The tokens were issued under Abu Dhabi Global Market rules and are open only to eligible investors outside the United States.⁴ Base has been explicit that it sees tokenized stocks as infrastructure for autonomous agents, and named projects already routing tokenized assets into agent-based trading systems.⁵

Two paths, one direction of travel. Both are real answers to what an agent is allowed to do with money. Neither answers the question that gets harder as agents transact with parties nobody at either company has met: who is the counterparty, and did a human on the other side agree to any of this.

What Coinbase for Agents actually authorizes

The product connects a general-purpose assistant to a real brokerage-style account and lets it act without a person approving each step: rebalancing against target allocations, placing limit orders during dips, running recurring purchase schedules, all executed by the agent rather than proposed to the user.² At launch the tradable universe was crypto spot markets and derivatives.⁶ It is wider now, and the next section takes that up.

The containment model is doing most of the safety work, which makes its edges worth reading. An agent runs inside an isolated portfolio with no visibility into or access over the rest of a user’s holdings.² Launch reporting put the finer controls in the future tense: the sandbox was live, while custom limits covering maximum trade size, which services the agent may reach, and how much it may spend were described as coming.⁷ Read “guardrails” as a category under development rather than as one finished feature.

The edge that matters most is in Coinbase’s own documentation, and it is easy to miss. Isolated portfolios cover spot crypto only. US futures are available only in the default portfolio, and the equities support added at the end of August is described as trading on Coinbase Advanced Trade rather than as something the isolated portfolio holds.⁸ So the container and the tradable universe have been moving in opposite directions. The universe got wider. The box stayed the same size.

Then there is the payments half, which is easy to skim past, is arguably the more novel piece, and has not actually arrived. Launch coverage described an agent paying for paywalled research, data APIs and on-demand compute over x402 with no human in the loop, and then trading on the strength of what it just bought.⁷ Coinbase’s current documentation puts that in the future tense: x402 payments for agent-consumed services are listed as coming soon to Coinbase for Agents, and an agent that wants to pay for x402 services today is directed to Agentic Wallet, a separate product.⁸ The loop is designed and half-built rather than closed. We have written before about what it takes to accept agent payments at all; this is the other side of it. An agent that buys its own inputs and acts on them inside one authorization is a different thing from an agent that drafts an order for a human to confirm.

So what has actually been authorized? A scope expressed entirely in facts one provider owns: which account, which portfolio, which asset classes, and, as the limits ship, what size and how much per day. That is a good authorization boundary, and by construction it is a statement about a customer’s own agent, made to that customer’s own provider.

The equities question, read precisely

At the June launch, equities were a destination rather than a feature. Agents could trade crypto spot and derivatives, with stocks and prediction markets listed as future additions.⁶ Independent coverage of the same launch said the same thing in the same tense.⁹

That is no longer the status. Coinbase’s own developer documentation, read on September 5, 2026, lists equities under what is supported today: S&P 500 US stocks on Coinbase Advanced Trade, exposed to the agent as ordinary order tickets, with pre-market, after-hours and overnight sessions available.⁸ Brian Armstrong announced the change in the last days of August, under the banner of agentic finance. Prediction markets are still listed as coming soon, so half the June roadmap has moved and half has not.

This piece was drafted on August 28 saying equities were planned rather than shipped. They shipped three days later. The correction is left visible rather than quietly overwritten, because it is a working example of the thing the next paragraph is about.

The reason it matters is that Coinbase has been moving into equities on several surfaces at once and the surfaces are easy to blur. Conventional stock and ETF trading in the main app for US customers. Tokenized equities on Base for eligible non-US users. S&P 500 equities inside the agent platform. Three products, three eligibility regimes, and one of them changed state inside a single week. “Coinbase supports stock trading” and “your agent can trade stocks in your Coinbase account” are still not the same sentence, and the distance between them is where a reader gets misled.

The reading discipline this calls for is boring and load-bearing: check the tense, check the surface, then check the date on whatever told you. Announcements in this category are routinely phrased as staged rollouts, and a staged rollout is not general availability, and neither is it permanent. The useful follow-up questions are which product, in which jurisdiction, for which eligibility tier, and whether the capability is live for the account in front of you or merely scheduled for it. Those four questions separate a real capability from a roadmap item almost every time. They are worth asking here in particular, because equity execution carries a supervisory regime that has opinions about who is instructing a trade and on whose behalf, which is a constraint no API design gets to route around.

Tokenized stocks arrived through a different door

The August 24 launch put equity exposure within reach of agents without touching the Agents platform at all. The tokens are NVDAc, AAPLc, METAc and GOOGLc, each a direct claim on a share held with the regulated custodian Alpaca.³ Chainlink supplies the price data, so applications across Base can quote them without building a feed.¹⁰ Holders keep them in self-custody wallets, trade them around the clock on venues such as Aerodrome, or post them into decentralized finance as collateral.⁵

The lineup has since grown. On September 4, 2026, Coinbase added six more tokens, covering Amazon, Microsoft, Strategy, SanDisk, SpaceX and Tesla, taking the set to ten after the first four recorded roughly $228M in decentralized-exchange volume over their first month on Base.¹¹ The eligibility rules did not change: still Regulation S, still closed to US persons.

On the properties that matter for an agent, the two routes are close to inverses of each other.

Coinbase for Agents binds authority tightly to a known human. There is an account behind it, a customer identified when that account opened, and a provider who can cap, log, freeze, and answer for what the agent did. What it does not do is travel. The authority is meaningful only inside that account and evaporates the moment the interaction crosses into somebody else’s system.

A tokenized share on Base is the mirror image. It travels perfectly, composes with venues nobody at Coinbase operates, and does not stop trading at four in the afternoon. What travels with it is a balance at an address. Not a person, not a mandate, not a record of who authorized the position. An agent holding NVDAc and posting it as collateral at three in the morning is, to every counterparty in that transaction, an address rather than a name.

The eligibility gate complicates the neat version of this story and deserves an honest mention. These tokens were issued under Abu Dhabi Global Market rules to eligible investors outside the United States, so the perimeter is real and someone was checked at the door.⁴ The point is where that check sits: once, at issuance and onboarding. Afterwards the token moves under wallet rules, and the identity established at the door does not ride along into the next transaction. That is not a criticism of the design. It is the design, and it is the tradeoff every bearer instrument has ever made.

Both control surfaces stop at the account boundary

One property is common to both designs: every control they offer evaluates on facts a single party already holds. A maximum trade size is checked by the provider against its own account records, a daily limit is the same fact counted over time, and portfolio isolation is a boundary drawn inside one company’s database. A token balance is the strongest of the four, because anyone can verify it without permission, and also the emptiest, because what it verifies is an amount at an address. None of them require asking a second party anything, which is exactly why they work so well and exactly what they cannot reach.

Three questions survive all of it. Who is the party on the other side, expressed as an organization or a person rather than an address or an API key? Is that party actually the one it presents itself as? And did a human on the receiving end agree to be approached at all, before an agent showed up with funds and a mandate? A spending cap answers none of the three. It was never built to.

This is not a Coinbase-specific gap, and naming it is not a criticism of either launch. It is the recurring shape of the category. Cloudflare spent this year making OAuth grants narrower and revocable. Self-hosted runtimes moved policy and audit rows into the core of the architecture, which governs what an agent may do inside one deployment and says nothing about who it deals with outside one. Aggregated service catalogues reach the same wall from the commercial side, where the aggregator becomes the counterparty of record for every provider behind it. Different companies, same boundary: authorization keeps getting sharper and keeps stopping at the edge of the system that issued it.

The identity half has its own standards, and they are improving too. A2A Agent Cards give an agent a machine-readable description at a well-known path, W3C DIDs give it a resolvable identifier, and the ERC-8004 registries put identity, reputation and validation onchain. These are complementary layers rather than competitors, and a serious agent will carry several at once. What none supply is the human-facing half: a readable name a person recognizes, and a consent step before contact details cross.

How this connects to Tobira

Tobira works on the half that no spending cap reaches. It is the trust layer for the agentic web: a human-readable @handle tied to the person or company an agent represents, a Site Agent that makes a company website addressable rather than only readable so other agents can talk to it instead of parsing it, and a mutual-reveal step where identities are exchanged only after both sides agree. It is LLM-agnostic and it stays out of the way of everything described above. An agent can hold a bounded Coinbase portfolio, settle over x402, publish an A2A Agent Card, carry an onchain reputation record, and still arrive at a stranger with no name a person would recognize and no way for that person to decline in advance. Per Tobira’s founder update, June 2026, the network carried 648 agents, including 102 business agents. That is a beta-stage number and a dated one, and it counts something different from trade volume: counterparties an agent can find and ask permission to reach. Which is the piece still missing at three in the morning, when the collateral moves and nobody on either side has a name.

FAQ

Can AI agents trade stocks through Coinbase for Agents?

Yes, as of the end of August 2026. Coinbase’s developer documentation lists equities under what is supported today, specifically S&P 500 US stocks traded on Coinbase Advanced Trade, with pre-market, after-hours and overnight sessions. This changed after the June 11, 2026 launch, at which point the tradable universe was crypto spot markets and derivatives and equities were a roadmap item. Prediction markets are still listed as coming soon. Two cautions travel with the answer. Coinbase reaches equities on several surfaces with different eligibility rules, including conventional stock and ETF trading in its main app and tokenized equities issued on Base for non-US investors, so check which product a claim refers to. And the isolated portfolio that contains an agent is documented as covering spot crypto only, so equities and futures are not inside that container.

What controls does Coinbase for Agents give a user over an agent?

Two layers, and they shipped at different times. The container came first: an agent operates inside an isolated portfolio with no visibility into or access over the rest of a user’s holdings, so the blast radius of a mistake is bounded by what was placed in that portfolio. On top of it sit guardrails such as maximum trade sizes and daily limits. Launch coverage distinguished the isolated portfolio structure, which was live, from more granular rulesets covering permitted assets and absolute spending ceilings, which were described as arriving in later updates. Treat guardrails as a category under active development rather than as one finished feature.

Are Coinbase’s tokenized stocks on Base available to everyone?

No. The tokens that went live on August 24, 2026, covering Apple, Nvidia, Meta and Alphabet, were issued under Abu Dhabi Global Market rules and are open only to eligible investors outside the United States. Each token is backed one to one by a real share held with the custodian Alpaca in a bankruptcy-remote structure, issued on Base under Coinbase’s B20 standard, with Chainlink supplying price data. The eligibility check happens once, at issuance and onboarding. After that the token moves under ordinary wallet rules, which is what makes it composable with onchain venues and also what means the identity established at the door does not travel with it.

What is the difference between authorizing an agent and identifying one?

Authorization decides whether an action may proceed. Identity establishes who a party is. A maximum trade size, a daily limit, and a portfolio boundary all answer the first question, and they answer it using facts a single provider already holds about its own customer, which is why they are cheap to check and reliable. Identity answers the second question across organizational boundaries, and it requires a claim a stranger can verify without holding an account in your system. A2A Agent Cards, W3C DIDs, and the ERC-8004 registries each supply a version of that claim. A platform can be excellent at authorization and completely silent on identity.

Does a spending limit protect the party an agent contacts?

It protects the account holder, not the recipient. A cap constrains how much your agent can spend and what it can touch, and every variable in it is evaluated on your side of the interaction. Whether the person on the receiving end wanted to be approached is a fact held by that person, and it can only be expressed on a surface both sides can see. This is why consent ends up as a separate layer in the agent stack rather than as a setting inside a payments product, and why better spending controls do not shrink the gap.

Sources

• Coinbase, “Coinbase for Agents: Your AI Agent Can Now Trade and Pay with Coinbase.” https://www.coinbase.com/blog/coinbase-for-agents
• Coinbase Developer Documentation, Coinbase for Agents. https://docs.cdp.coinbase.com/x402/agentic-accounts/coinbase-for-agents
• CNBC, “Coinbase launches tool to let AI agents manage trading and payments,” June 11, 2026. https://www.cnbc.com/2026/06/11/coinbase-launches-tool-to-let-ai-agents-manage-trading-and-payments.html
• TechCrunch, “Coinbase’s new tool can help agents trade and pay for premium research,” June 11, 2026. https://techcrunch.com/2026/06/11/coinbase-debuts-mcp-for-agent-trading/
• CoinDesk, “Coinbase debuts tokenized stocks on Base with Apple, Nvidia among first shares,” August 24, 2026. https://www.coindesk.com/business/2026/08/24/coinbase-debuts-tokenized-stocks-on-base-network-joining-race-to-bring-equities-on-blockchain
• Cointelegraph, “Coinbase taps Chainlink for tokenized stock data on Base.” https://cointelegraph.com/news/coinbase-taps-chainlink-for-tokenized-stock-data-on-base
• Crypto Briefing, “Coinbase-issued tokenized stocks go live on Base as onchain equities expand.” https://cryptobriefing.com/coinbase-issued-tokenized-stocks-go-live-on-base-as-onchain-equities-expand/

A note on sourcing. This piece was drafted on August 28, 2026 and re-sourced on September 5. At drafting, primary pages at coinbase.com, docs.cdp.coinbase.com, techcrunch.com and coindesk.com were not reachable from the environment, so the claims rested on trade coverage with every load-bearing fact carried by at least two outlets. On the second pass, docs.cdp.coinbase.com and techcrunch.com were reachable and are now cited directly; coinbase.com still returns a bot challenge and coindesk.com rate-limited every attempt, so those two remain listed for the reader rather than verified here. The original note also declined to assert that equity trading had begun rolling out inside Coinbase for Agents, on the grounds that no second source confirmed it. That claim is now confirmed by Coinbase’s own documentation and the article states it.