The keys are stored offline, but the BTC are always online. They are relatively safe against someone compromising your computers remotely. Against physical intrusions or insider attacks, not as much.
[1] http://blog.coinbase.com/post/33197656699/coinbase-now-stori...