Controlled Autonomy for AI Agents: Interview with Cobo Co-founder and CTO Changhao Jiang

Signup Write New Story Controlled Autonomy for AI Agents: Interview with Cobo Co-founder and CTO Changhao Jiang by Olayimika Oyebanji by Olayimika Oyebanji | @ penworth A seasoned blockchain journalist, a legal consultant and an AI researcher interested in DeFi and AI stories.

A seasoned blockchain journalist, a legal consultant and an AI researcher interested in DeFi and AI stories.

AI agents are getting closer to handling real financial transactions, and that raises questions that go well beyond what a model can do. Who authorizes an agent to move funds? How much freedom should it have? And what happens when it makes a mistake?

The Global Blockchain Business Council (GBBC) has highlighted the connection between agentic AI and blockchain in its Global Standards Mapping Initiative report. As agents begin to interact directly with on-chain systems, the security infrastructure behind those transactions becomes increasingly important.

In this conversation with Changhao Jiang, co-founder and CTO of Cobo, we discussed the challenges of building wallets for AI agents, why traditional custody principles still matter and what needs to happen before businesses can comfortably let autonomous software manage real capital.

Fish and I founded Cobo in 2017. Crypto was still a relatively small industry, but we believed digital assets would eventually become widely used. We wanted to build the infrastructure that could support that growth.

We started with a software wallet for individual users and later developed a hardware wallet. As more businesses entered crypto, we began focusing on institutional custody, Wallet-as-a-Service and MPC. Much of our work over the years has involved helping institutions manage digital assets securely.

AI has brought a new challenge to that work. Wallets have traditionally been designed for people or organizations managing their assets. Now we're looking at software that can initiate transactions on their behalf.

We're dealing with some familiar questions around access and security, although AI agents introduce additional risks. We're also using AI internally, particularly in development. That's the thinking behind our current direction-powered by AI, built for AI agents.

The biggest concern is control. An agent can prepare a transaction correctly, but what happens if it misunderstands an instruction or gets manipulated? You can't rely on prompts alone to protect real assets.

We must be able to eliminate the need for agents to hold a complete private key and users must be able to set limits on which assets an agent can access and what transactions it can make. Those rules are enforced by the wallet itself.

We're also using AI to review code and spot vulnerabilities, but attackers have access to similar tools. So security is something we have to keep working on.

Consider a company that allows an AI agent to manage part of its treasury operations. It needs to know who authorized the agent, which transactions it can make and who has the authority to change or revoke those permissions. If a transaction is disputed later, the company should be able to review the authorization that was in place at the time.

Blockchain gives you a transaction history, but that record doesn't necessarily tell you whether a transfer was authorized. You also need to know what the agent was permitted to do when it initiated the transaction.

Responsibility becomes more complicated if an agent makes a decision that results in a financial loss. There may be questions about the people who authorized it, the systems involved and the rules under which it was operating. I expect institutions and regulators will spend quite some time working through these issues.

Wallet infrastructure can provide enforceable permissions and records that make oversight easier but the legal and governance questions will need attention as well.

I'd start with the task the agent is supposed to perform. For routine payments, a company might let it handle transactions automatically, as long as they stay within an agreed limit.

There's no need to approve every small payment but if the agent tries to move a large amount or send money to an unknown address, someone should step in.

That's why it's important to set the rules beforehand. Users decide what an agent can and can't do, and the wallet makes sure it follows those rules. This gives businesses more confidence to use AI agents without giving up control of their funds.

There are different approaches to this problem, and I wouldn't argue that MPC is the right answer for every possible application. For us, the question was how to let an agent initiate transactions without giving it complete control over the assets.

We chose a non-custodial architecture using MPC, so the agent never possesses the full private key. We then combine that with Pact, which enforces the permissions defined by the human user.

Both parts are important. Protecting the key addresses one risk. Controlling what the agent can actually do addresses another. Of course, this introduces complexity. You have to design the permissions properly, think through approval processes and maintain the infrastructure that enforces them. MPC alone won't protect you from every mistake or every possible attack.

But we've been operating wallet infrastructure for institutional clients for years, so this isn't entirely new territory for us. When real money is involved, I'd much rather deal with the complexity of good security controls than give an autonomous system more authority than it needs.

We began with consumer wallets before moving into infrastructure for institutional clients. As the market grew, we started working with businesses that had more complicated requirements around asset management, transaction approvals and custody.

Our focus gradually shifted toward institutional wallet infrastructure, Wallet-as-a-Service and MPC. We raised US$13 million in our Series A in 2018, followed by a US$40 million Series B+ in 2021, when Cobo reached a US$1 billion valuation. In 2024, we brought our infrastructure offerings together through Cobo Portal. This year marks our ninth anniversary.

Frameworks like LangChain, the OpenAI Agents SDK and Claude MCP have made it easier for developers to build agents and connect them to external tools. The challenge comes when an agent can use those tools to initiate financial transactions. It may complete several steps correctly and then request a transaction that the user never intended to authorize.

A developer needs some way to prevent that from happening. We think the wallet infrastructure should handle the permissions, transaction limits and approval requirements rather than leaving each developer to implement those controls independently. There also needs to be a way to review what an agent has done. If you're responsible for the funds, you should be able to see which transactions were executed and what permissions applied.

Developers will continue experimenting with different AI frameworks. They should be able to change the tools they're using without having to rebuild their wallet security controls each time.

I expect we'll see more agents interacting with on-chain infrastructure over the next year. Blockchain is well suited to this kind of activity because transactions can be programmed, executed and recorded in a way that software can interact with directly.

But there's still quite a bit to figure out. Security is one area I'm watching closely. We're already seeing AI become more useful for identifying weaknesses in code, and the same capabilities can be used by attackers. That's going to put more pressure on the software and infrastructure the industry relies on.

Then there's the question of responsibility. Institutions are unlikely to give agents access to significant amounts of capital without knowing who authorized the transactions, what controls are in place and who is accountable if something goes wrong.

I also think we should be careful not to confuse the ability to build an AI product with demand for that product. AI has made development faster, and that's exciting. But you can build something technically impressive that nobody actually needs. For me, adoption will depend on whether agents can do useful work consistently and whether people trust the systems behind them.

I think we are still at the beginning of both journeys. Nine years ago, we believed blockchain would become important infrastructure long before that was obvious to most people.

Now AI is changing how that infrastructure may be used, and even who or what its users are. We are building trusted wallet and payment infrastructure for humans and AI agents, while also rethinking our own work around the principle that people set the direction and AI does the work. We will share more as each part of that work is ready. We would rather show what is useful than make announcements for their own sake. What has not changed is our focus on long-term value and on building things our customers can actually trust and use.

Privacy, Personalization and Precision Health: Interview with DEPH Labs CEO Lisa Loud