Coinbase introduced CAT, or Continuous Adversarial Testing, on September 15 as an internal platform that continuously runs specialized AI security agents against its own systems.

The concept is different from an annual penetration test or a SAST scanner executed immediately before release.

CAT watches code changes, product launches, newly exposed services and shifts in the attack surface as they happen. Existing assets can also be reassessed when needed.

Coinbase says coverage includes web and mobile applications, backend services, infrastructure, Web2-to-smart-contract boundaries and the company's own internal AI tooling.

Every pull request can now become a security target

The first CAT layer operates before software reaches production.

Coinbase says agents review commits as they land, perform another pass when changes are merged, and then incorporate that information into a broader product-level review at launch.

All three stages use frontier AI models at different levels of depth and breadth.

The goal is to move vulnerability discovery earlier in the software lifecycle.

A flaw caught in a pull request can be fixed by its developer before it becomes a production vulnerability at all.

The system is doing more than pattern matching on source code

CAT includes static analysis, but Coinbase also gives agents enough system context to reason across data flows and attack paths spanning multiple components.

An agent can start with a repository, follow backend code toward a smart contract and analyze the boundaries where Web2 and Web3 assumptions meet.

It can also begin with a contract address and map the applications and services calling it.

That matters particularly for a crypto company.

A severe vulnerability does not necessarily exist inside Solidity or backend code in isolation. It may exist in the assumptions each layer makes about the other.

SHADE turns penetration testing into a horizontally scalable workload

Coinbase also runs a component called SHADE, short for Swarm Harness for Adversarial Discovery and Exploitation.

The concept distributes offensive work across multiple agents. Each can claim a repository or target, hunt for exploitable vulnerabilities and feed results into the central platform.

Security coverage can therefore scale horizontally in much the same way as other compute workloads.

Adding agents lets more repositories and services be examined in parallel, subject to model cost and the safety boundaries placed around testing.

Coinbase has not published enough independent accuracy data to claim that this makes AI generally superior to expert human pentesters.

The measurable advantage for now is breadth and cadence.

CAT also attacks Coinbase's own AI supply chain

The platform evaluates the systems Coinbase is increasingly using to build its internal agents.

A dedicated scanner checks adopted MCP servers against an MCP-specific threat model and searches for unregistered “shadow” servers.

Those systems are rescanned when they change.

Agents also inspect code modifications for prompt-injection paths involving system instructions, tool definitions and untrusted content reaching a model.

The capabilities granted to internal agents are reviewed before adoption and rescanned when they change.

That follows directly from agentic system design: every new tool granted to a model is effectively an expansion of its attack surface.

Mobile releases are continuously assessed too

CAT includes a mobile layer called MAST for iOS and Android releases.

Coinbase says it evaluates the OWASP Mobile Top 10, MASVS conformance, permissions, third-party data flows and resilience against hostile man-in-the-middle network conditions.

Some MASVS controls still receive manual verification.

That coexistence matters because not every security property can be reliably inferred by an agent from source code and telemetry alone.

CAT can also use an application like a real attacker

The dynamic-testing layer includes an agentic DAST system that can authenticate as an actual user, crawl an application and chain multiple observations together.

Coinbase says it looks for injection, access-control issues and business-logic flaws that conventional scanners structurally struggle to discover.

Business logic is one reason large language models are attractive to offensive teams.

A dangerous workflow does not always resemble a line of obviously vulnerable code.

Sometimes an attacker combines several individually legitimate features in an unexpected order to produce a result the product designer never intended.

Production does not mean the agent is allowed to try everything

This is arguably CAT's most important design decision.

Coinbase says Rules of Engagement are not entrusted to the model's prompt.

They are enforced server-side outside the agent and then checked independently again inside the scanner before any network action leaves the system.

Deny lists override all allowed scope.

Testing windows restrict when activity can occur, while blast-radius caps bound how many systems can be touched.

Fragile services can be excluded from active probing entirely.

A fleet-wide kill switch can stop the whole system.

The system prompt is therefore not the actual security boundary

Coinbase describes the principle directly: the policy the model sees is not the policy that is enforced.

A separate guard examines what each proposed command would actually do before execution.

Read-only actions can proceed within scope.

Anything capable of changing data or state is blocked unless the target was explicitly declared a non-production environment during scoping.

This check happens at the tool-execution layer rather than inside the model's instructions.

A confused agent, a prompt-injected one or simply an overenthusiastic model cannot negotiate its way around the boundary by generating more persuasive text.

That may be CAT's most broadly reusable architecture: AI proposes actions, but deterministic software outside the AI retains actual authority.

Finding a hundred times more alerts would be useless if most were wrong

Automated offensive security has another obvious problem: noise.

Coinbase therefore built a validation chain before a finding reaches a human.

A preflight step first confirms that all required tools are actually available, including code search, the LLM, ticketing, live infrastructure and telemetry.

That prevents a degraded dependency from being mistaken for an absence of evidence.

An AI agent then reviews the finding against real source code and system context.

If it still looks plausible, an independent code-level trace verifies the exact path from the entry point to vulnerable code and checks which controls exist along that path.

A second agent is explicitly paid to disagree with the first

The result then goes through an independent second AI pass.

This model can see the first pass's reasoning and trace evidence, but its task is to challenge every claim and override the earlier verdict when necessary.

If a negative conclusion was not investigated deeply enough, CAT can trigger a third, more thorough pass.

Coinbase caps the escalation at three rounds rather than allowing an open-ended reasoning loop.

Only confirmed findings move onward.

Exploitability is compared against real production behavior

Technical confirmation is followed by additional contextual checks.

CAT attempts to ground exploitation likelihood in real production traffic.

Separate privacy and operational reviews re-check data sensitivity and business impact against classifications, service-level objectives and incident history.

For internet-reachable vulnerabilities, CAT also examines production logs and WAF telemetry for evidence that somebody may already be probing the flaw.

The eventual output is intended to be more useful than a simple statement that a piece of code “looks vulnerable.”

It should include a reproducible attack path, contextual impact and an auditable evidence trail.

Coinbase even replaced CVSS with its own severity model

The company says CVSS does not fully represent the risks of its environment.

CAT therefore uses an internal six-factor scoring model.

Likelihood factors include exploitation frequency, attack complexity and required access.

Impact is then assessed directly across customer funds, data and operations.

The intent is to avoid flattening a vulnerability that puts customer assets at risk into a generic severity category that ignores the financial context.

This remains Coinbase's internal model rather than a new industry standard.

More than 150,000 scans since mid-2026

Coinbase publishes several figures about CAT's current scale.

Since mid-2026, the platform has completed more than 150,000 scans against its production estate.

More than 128,000 of those were pull-request reviews.

Coinbase also says the number of penetration-test findings fixed each month increased sharply after its offensive security staff began adopting AI tooling in late 2025.

The announcement does not provide enough false-positive, false-negative or severity-distribution data to turn that increase into a scientific comparison with traditional pentesting.

What the figures demonstrate more clearly is the difference in testing frequency.

Model cost becomes part of the security architecture

Running the most expensive reasoning models against every commit and repository could quickly become economically impractical.

Coinbase says CAT controls this with per-scan budget enforcement, aggressive prompt caching and model selection tuned to each workload.

A routine review therefore does not necessarily receive the same compute budget as a deep investigation of a complex exploit chain.

This is an increasingly important property of agent deployments: the limiting factor may become less about whether a model can perform a task and more about whether it is affordable to run that model everywhere.

Humans still keep the hardest investigations

Coinbase explicitly says CAT is not intended to replace its offensive security engineers.

The platform automates broad and repetitive coverage so human researchers can spend more time on novel attack research, threat modeling and complex multi-step investigations.

For those cases, CAT includes a mode called Live Operative.

An engineer and an AI operative work the same engagement together. The agent can propose adversarial scenarios while the engineer approves, modifies or redirects them.

The same external Rules of Engagement continue to bound what actions can actually execute.

Coinbase now has to test the agents that test everything else

The next problem is almost recursive.

If CAT relies on probabilistic models, changing a model or prompt can change detection quality.

Coinbase is therefore building an evaluation pipeline that compares agent output with known-good datasets.

The objective is to establish whether a model or prompt update genuinely improves detection instead of assuming that a newer model is automatically better.

As SHADE expands coverage, Coinbase is also developing prioritization logic to decide which code and assets deserve the most testing effort.

Penetration testing becomes less of an appointment and more of a permanent state

The most interesting idea in CAT is ultimately not that AI can discover an injection flaw or broken access control.

Security teams already use models for those tasks.

The real shift is cadence.

A traditional penetration test creates a relatively deep snapshot of one scope at one moment.

A continuous platform attempts to treat every new change as a reason to refresh some portion of that snapshot immediately.

The weakness of that approach is equally clear: more automation gives more power to tools that can themselves make mistakes.

Coinbase's answer is to keep intelligence and authority deliberately separate.

The agent can think like an attacker, trace a path, propose a command and challenge another model's conclusion.

But when it is time to actually touch production, deterministic software outside the model still decides how far it is allowed to go.