Coinbase Details Internal AI Adversarial Testing Platform CAT
Coinbase published a blog describing CAT, an internal AI-driven security testing platform, its coverage areas, guardrails, and reported scan volumes. The post states CAT is internal only.
Source-checked briefing: prepared from the official notice cited below and checked for source, date, duplication, and risk language. No individual editor review is claimed. Methodology
Coinbase published a blog post on 2026-09-15 describing CAT (Continuous Adversarial Testing), an internal platform that uses autonomous AI security agents to test Coinbase assets, new services, product changes, and deployments. The source states CAT is currently internal only and that Coinbase is evaluating which components could be made available externally. The post does not establish any required action for Coinbase users, account holders, or the general public. It also does not announce a change to user-facing services, asset listings, fees, or account features.
- 01
Coinbase published the post on 2026-09-15, authored by Elias Abouzeid and Rick Roane.
- 02
CAT is described as an internal platform using autonomous AI security agents to test existing assets, newly discovered services, product changes, and deployments.
- 03
Coverage areas listed include web and mobile applications, backend services and infrastructure, Web2-to-smart-contract integrations, and internal AI tooling.
Key timeline
Coinbase publishes the Consumer Protection Tuesday blog post describing CAT.
The post states CAT has completed more than 150,000 scans against Coinbase's production estate, including over 128,000 pull request reviews.
The post states Coinbase pentesters began using AI tooling, after which the number of fixed pentest findings per month increased sharply.
Who may be affected
- Coinbase's internal offensive security team and engineering teams, based on the post's description of CAT's users and workflows.
- No external Coinbase user group is identified as directly affected by this announcement.
Impact analysis
The confirmed operational change described is internal to Coinbase: CAT is presented as an addition to Coinbase's offensive security program, with findings routed into a validation pipeline, triage queue, audit trail, and tracking system. The post states CAT is internal only, so it does not establish changes to customer accounts, asset support, trading, fees, or service availability. The reported scan volumes and the statement that engineering teams have fixed a large share of surfaced issues describe internal security activity, not user-facing outcomes. Because the source does not disclose external availability, any effect on non-Coinbase parties is not established.
What the announcement does not say
The source does not disclose whether or how CAT affects customer-facing services, whether any external release will occur, or what components might be considered for external availability. It also does not provide independent verification of the reported scan counts or fixed-finding figures.
Risk notes
- The post is a first-party description of an internal security platform; it does not provide independent verification of the reported scan volumes or outcomes.
- The source does not state that CAT eliminates security risk, guarantees asset safety, or changes any user-facing service.
- The post states CAT is internal only; no external availability, timeline, or eligibility is confirmed.
- This article is for verifying official exchange announcements only and does not constitute investment or trading advice.
This article is for information only and is not investment, legal, or tax advice. Digital assets are volatile and may result in loss of principal.
Frequently asked questions
Does this announcement require Coinbase users to take any action?
No. The source does not establish any required action for Coinbase users or the public. It describes an internal security platform and states CAT is currently internal only.
Does CAT change which assets Coinbase supports or how accounts work?
The source does not state any change to asset support, account features, fees, or service availability. It describes internal security testing coverage and does not announce user-facing product changes.
Will CAT be available to the public?
The source states CAT is currently internal only and that Coinbase is evaluating which components could be made available externally. No external release, timeline, or eligibility is confirmed.
Official sources
Collected material is used only for fact checking. If this page differs from the original announcement, the official page controls.