# Is Coinbase Agentic Wallet safe to connect to an AI agent?

> Is Coinbase Agentic Wallet safe for an AI agent? Can trade unattended. Safety 55%. Safeguards and gaps, each from official sources, checked 2026-10-31.

Canonical: https://tradingagentstack.com/tool/coinbase-agentic-wallet/is-it-safe/

1. [Home](https://tradingagentstack.com/)

2. [AI agent payments](https://tradingagentstack.com/category/agent-payments/)

3. [Coinbase Agentic Wallet](https://tradingagentstack.com/tool/coinbase-agentic-wallet/)

# Is Coinbase Agentic Wallet safe to connect to an AI agent?

**Can trade unattended.** [Safety 55%](https://tradingagentstack.com/safety-score/) Can trade unattended. Built from our sourced listing, last checked 2026-10-31. Not financial advice.

## What an AI agent can do

- **Live vs paper:** live; the CLI also supports Base Sepolia and Solana Devnet [source](https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome)

- **Order approval:** private keys stay in Coinbase infrastructure (TEEs), never exposed to the agent's prompt or LLM; a max per call and a max per session are set in the wallet UI and agents can't change them; KYT and OFAC screening block high-risk or sanctioned transfers; no approval per transaction once limits are set; the send command takes any address or ENS name [source](https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome)

- **Markets:** USDC on Base, Polygon and Solana, ETH, POL and SOL sends, token swaps on Base and Polygon, x402 paid APIs

- **Pricing:** Agentic Wallet MCP, wallet creation and gas (sponsored) are free; x402 services set their own prices; Coinbase Onramp standard fees

## Safeguards that exist

- **Guardrails outside the agent:** Max per call and max per session are set in the wallet UI; agents respect these limits but can't change them (official docs) [source](https://docs.cdp.coinbase.com/agentic-wallet/mcp/faq)

- **Test before real money:** Paper, demo or testnet mode available [source](https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome)

- **Who holds the keys:** Private keys stay in Coinbase infrastructure in Trusted Execution Environments, never exposed to the agent's prompt or LLM (official docs) [source](https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets)

- **Open source or audited:** The agent skills are open source (MIT); no audit report found (official docs) [source](https://github.com/coinbase/agentic-wallet-skills)

- **Incident record (last 12 months):** No incident naming this tool in our incident tracker in the last 12 months [source](https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome)

## Safeguards that are missing

- **Human approval:** Once permissions and limits are set, the agent acts with no approval per transaction (official docs) [source](https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets)

- **Sending funds out:** The send command takes any address or ENS name (e.g. vitalik.eth); no recipient allowlist is documented (official docs) [source](https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome)

## Safety score

[Safety 55%](https://tradingagentstack.com/safety-score/) Can trade unattended. If this tool, or an AI agent using it, is wrong, hacked or prompt-injected, how much of your money is at risk? Higher is safer. Not a ranking; affiliate links never affect it. [How it's calculated](https://tradingagentstack.com/safety-score/) · [Incidents](https://tradingagentstack.com/incidents/)

| Input | From official docs or our listing | Points |
| --- | --- | --- |
| Human approval | Once permissions and limits are set, the agent acts with no approval per transaction (official docs) [source](https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets) | 0 / 25 |
| Guardrails outside the agent | Max per call and max per session are set in the wallet UI; agents respect these limits but can't change them (official docs) [source](https://docs.cdp.coinbase.com/agentic-wallet/mcp/faq) | 15 / 15 |
| Test before real money | Paper, demo or testnet mode available | 15 / 15 |
| Sending funds out | The send command takes any address or ENS name (e.g. vitalik.eth); no recipient allowlist is documented (official docs) [source](https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome) | 0 / 15 |
| Who holds the keys | Private keys stay in Coinbase infrastructure in Trusted Execution Environments, never exposed to the agent's prompt or LLM (official docs) [source](https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets) | 5 / 10 |
| Open source or audited | The agent skills are open source (MIT); no audit report found (official docs) [source](https://github.com/coinbase/agentic-wallet-skills) | 10 / 10 |
| Incident record (last 12 months) | No incident naming this tool in our incident tracker in the last 12 months ([incident tracker](https://tradingagentstack.com/incidents/)) | 10 / 10 |
| Total | 55% of the points we could check | **55 / 100** |

## Sources

- [https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome](https://docs.cdp.coinbase.com/agentic-wallet/cli/welcome)

- [https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets](https://www.coinbase.com/developer-platform/discover/launches/agentic-wallets)

- [https://docs.cdp.coinbase.com/agentic-wallet/mcp/faq](https://docs.cdp.coinbase.com/agentic-wallet/mcp/faq)

- [https://github.com/coinbase/agentic-wallet-skills](https://github.com/coinbase/agentic-wallet-skills)

Full listing: [Coinbase Agentic Wallet](https://tradingagentstack.com/tool/coinbase-agentic-wallet/) · How the score works: [Safety score method](https://tradingagentstack.com/safety-score/)

## For agents

- [When to use this site, and the page index](https://tradingagentstack.com/llms.txt)
- [Sitemap](https://tradingagentstack.com/sitemap.xml)
- [Contact](https://tradingagentstack.com/contact/)
- [MCP server](https://tradingagentstack.com/mcp/)
- [MCP discovery](https://tradingagentstack.com/.well-known/mcp)