Binance's Agent OS, announced 20 August 2026, gives an AI agent its own Agentic sub-account that you fund yourself and the agent can't top up from your main account. The announcement names no spending cap anywhere. TechCrunch reported the same day that Binance imposes no separate cap on how much an AI agent can trade or lose, so the amount you transfer in is the limit.
That's containment, and containment is worth having. It also answers a narrower question than most buyers hear when a vendor says the account is scoped. Here's what the boundary covers and what it leaves open inside.
What does a scoped subaccount give you?
Containment. The agent works inside a balance you funded and can't reach the rest of your money. Binance's scopes cover reading market data, checking balances in the Agentic sub-account, trading Spot, Margin, Convert, USDⓈ-M Futures and COIN-M Futures, and moving funds between wallets inside the sub-account. The [announcement](https://www.binance.com/en/support/announcement/detail/07d45cdd3831498f8a4ff339031a8480) is direct about the edge: "The Binance MCP Server does not provide a withdrawal scope, and agents are not authorized through this integration to withdraw funds to external addresses."
One nuance before you treat the sub-account as a sealed box: the balance scope can include an optional read-only view of your main account. The isolation covers movement of funds, not visibility. The scopes themselves are revocable at any time, which keeps an incident bounded rather than open-ended.
So how much can the agent spend?
Whatever you funded. Binance's own announcement names no spending cap, no budget and no preset limit inside the Agentic sub-account. TechCrunch reported on 20 August 2026 that Binance imposes no separate cap on how much an AI agent can trade or lose. Finance Magnates put it the same way that day: "the funded sub-account becomes the boundary of the agent's trading discretion."
So the transfer is the decision, and you make it once. Move $5,000 in and you've set a $5,000 limit for every position the agent opens afterwards.
You can require the agent to seek approval for every order, or let it trade autonomously once its permissions are set. What you can't do is pick a number. Nothing inside the container says a single trade shouldn't take more than a fraction of the balance, or routes only the large ones to a person. That's a constraint, and a blunt one: it bounds your worst case at the figure you last transferred and says nothing about how you get there.
Is containment the same thing as a budget?
No. Containment bounds the total at the amount you pre-funded. A budget governs behaviour inside that total: how large one purchase may be, which merchants or categories are in bounds, and when a person should see a request before it goes through. A container with no budget in it lets one decision consume everything you put in.
The two do different jobs, and the difference shows up on a bad day.
| | A funded container | Policy enforced at the authorization moment |
|---|---|---|
| What bounds the worst case | The amount you transferred in | The rule applied to each purchase before it clears |
| Coverage | Only where the agent's money sits in the container | Every merchant that accepts the instrument |
| Size of one purchase | Not addressed. One decision can take the whole balance | A ceiling on any single purchase |
| Merchant and category | Not addressed | Which merchants and categories are in bounds |
| Bringing in a person | Every order or none, with no threshold | Above your threshold, blocked or escalated for approval |
| Changing the limit | Move funds in or pull funds out | Change the policy |
Both columns bound something. Only the right-hand one bounds the individual purchase.
Why did Coinbase build it differently?
Because it went after the other question. Coinbase launched Agentic Wallets on 11 February 2026 with session caps. PYMNTS reported that users determine the maximum an agent can spend per session as well as controls on individual transaction sizes. That's a ceiling on a whole agent run plus a ceiling on any one transaction, both operating inside the wallet.
Two exchanges picked opposite defaults. Binance drew a hard edge around the money and left discretion inside it wide open. Coinbase left the wallet where it was and constrained the run.
Ask which failure you're more exposed to: an agent reaching money it was never meant to touch, or an agent spending money it may legitimately reach in a way you'd never have approved. The second is the more common story, and a container alone doesn't answer it.
Where does a container stop working?
At its own edge. A funded sub-account governs the money sitting inside it and governs nothing about a purchase your agent makes anywhere else. The moment an agent renews a SaaS seat, books a flight or pays a data vendor that takes cards, the boundary you drew on an exchange isn't part of that transaction.
Most agents that spend money aren't trading. They're buying inputs: SaaS seats, tickets, subscriptions, data. Most of that runs on cards, and the metered per-call spend does not, which is exactly where [card and crypto rails each reach](/blog/card-vs-crypto-rails-ai-agents) splits. [The mechanisms agents use to authorize payments](/blog/five-ways-ai-agents-authorize-payments) stack and combine, and a funded container is not one of them.
Shatale issues agent-scoped virtual cards with your policy enforced at the authorization moment, human approval workflows above the thresholds you set, and an immutable per-agent record of every decision. A purchase outside policy is blocked or escalated to a person for approval while the merchant is still waiting on the answer. The card is the container and the policy is the budget, on the rails most of your agents' purchases already use.
What to ask
- If our agent's money sits in a scoped account, what stops one decision from taking the whole balance?
- Is there a ceiling on a single purchase, separate from the total we funded?
- Which merchants or categories can this agent reach, and where is that list stored?
- Above what amount does a purchase wait for a person, and what happens to it while they decide?
- Does this control cover the purchases our agents make off this platform, on cards?
FAQ
Do scoped subaccounts limit AI agent spending?
They limit total exposure to the amount you funded, and they don't necessarily limit any individual purchase. Binance's Agentic sub-account, announced 20 August 2026, carries no withdrawal scope and, per TechCrunch the same day, no separate cap on how much an agent can trade or lose. The transfer is the limit, and nothing inside it governs the size of one trade or whether a person should approve it.
What is Binance's Agentic sub-account?
A dedicated account you create for an AI agent under Binance Agent OS, announced 20 August 2026. You fund it yourself. The agent can't move funds from your main account into it. Scopes cover reading market data, checking balances in the sub-account, and trading Spot, Margin, Convert, USDⓈ-M Futures and COIN-M Futures, and you can revoke them at any time.
Can a Binance agent withdraw my funds?
Not through this integration. Binance states that the Binance MCP Server does not provide a withdrawal scope and that agents are not authorized through this integration to withdraw funds to external addresses. Agents can read balance and portfolio information for the main account, so the isolation covers movement of funds rather than visibility. Trading losses inside the funded sub-account are still possible.
How do Coinbase's agent spending controls compare?
Coinbase launched Agentic Wallets on 11 February 2026 with session caps, a ceiling on total spend across an agent run, alongside controls on individual transaction sizes. That constrains behaviour inside the wallet. Binance drew a boundary around a funded balance and left discretion inside it open. One bounds the run, the other bounds the pot, and a buyer needs an answer to both.
---
[Cutting an agent off in one move](/blog/revoke-agent-spending-kill-switch) covers what to do when the container turns out to hold more than you meant it to. Early access is free for publishers.
Shatale is the control layer for AI-agent payments. Its authorization architecture is the subject of European patent application EP26194994.5 (filed; priority 28 July 2026).