Binance gave AI agents the crypto keys. Loss caps: none.

Binance's Agent OS went live 20 Aug with an MCP server that plugs Claude, Claude Code, ChatGPT, Codex, Cursor and VS Code straight into live prices, order books, balances and order placement across Spot, Margin, Convert and futures. Agents get a dedicated subaccount with user-set permissions, and the MCP connection carries no withdrawal scope — an agent can't move funds to an outside address. The wallet side has hard rails too: $50k/day on swaps, $100k/day on DeFi, $20/day on x402 payments.

What has no rail is losing money. There's no exchange-imposed cap on trading losses, and you choose whether each trade needs your approval or the agent just runs. Binance VP Jeff Li was blunt about the visibility gap: "We really cannot see the reasoning of what the user's action is." If an agent gets fed bad data or prompt-injected, the subaccount sandbox is the entire defense — across a base of 300M+ registered users.

Two days earlier, nonprofit GuideLight (founded by ex-OpenAI staffers Steven Adler and Page Hedley) published its first control assessment of frontier labs: Anthropic and OpenAI tied at C+ (2.50/5), Google D+ (1.50), xAI D− (0.83), Meta F (0.67). The weakest categories were prevention and containment — gated actions and circuit breakers. Only Anthropic cleared "limited partial implementation" on either.

Why it matters: agent permissions are reaching real money faster than anyone's proven ability to stop an agent mid-action.