In the span of about fifteen months, letting an AI agent trade a real account went from science fiction to a checkbox. Public.com branded itself an "agentic brokerage" in March 2026. Gemini switched on agentic crypto trading in April. Robinhood launched Agentic Trading in beta on May 27, 2026, letting users connect Claude, ChatGPT, or Grok to a dedicated brokerage account. Coinbase for Agents followed on June 11, wiring third-party AI agents into real Coinbase accounts for spot and derivatives trading. eToro's Agent Portfolios hand a sub-account to a custom agent for as little as $200.
Millions of people can now delegate live trading decisions to a large language model. The marketing leads with convenience — plain-English instructions, 24/7 monitoring, no code. The question almost nobody answers plainly: is any of this actually safe? The honest answer depends on what you delegate, to what kind of system, with what limits. Here is the full inventory — every incident dated and attributed.
The most direct evidence on how LLMs handle real money comes from Alpha Arena, the public experiment run by Nof1.ai. Six frontier models — including GPT-5, Gemini 2.5 Pro, Claude 4.5 Sonnet, and Qwen3 Max — were each given $10,000 of real money to trade crypto perpetuals with no human intervention. The results were not a rounding error apart. Qwen3 Max finished up roughly 22%. GPT-5 lost about 75% of its capital, running 17.2x leverage and failing to adapt. Gemini overtraded its way through 238 trades and paid roughly $1,331 — about 13% of its entire account — in fees. Claude went 100% long with no stops and was caught in the reversal.
What separated the winner from the losers was not prediction ability but risk control and execution discipline. The models that blew up did so in ways any competent human risk manager would have prevented — excessive leverage, no stop-losses, fee-burning churn. LLMs are trained to produce plausible output, not to respect drawdown limits. Risk discipline is not innate to them; it must be imposed from outside.
The academic evidence points the same direction. STOCKBENCH, a benchmark built specifically for LLM trading agents, found that most struggle to outperform a simple buy-and-hold. A 2026 study found that LLM portfolios built from simple conversational prompts produced average monthly excess returns of 0.35% — statistically indistinguishable from zero — and underperformed the S&P 500 on a risk-adjusted basis. Finance Research Letters documented high run-to-run variability in 2025: the same model, given the same task twice, can produce materially different portfolios. That variability is disqualifying in a discipline where consistency is the entire point. For a deeper treatment of why process beats prediction, see our guide to risk management in algorithmic trading.
Model risk is the agent making bad decisions. Security risk is someone else making them for it — and this is no longer theoretical.
In May 2026, an attacker drained roughly $150,000 in tokens from a Grok-linked agent wallet in the Bankr ecosystem using a prompt injection hidden in a Morse-code-encoded tweet. The agent read the tweet, decoded the instruction, and obeyed it. The incident was formally logged by OECD.AI, and it maps directly onto the top entries in OWASP's LLM risk list: prompt injection and excessive agency.
In January 2026, the Step Finance breach saw roughly $40 million drained — and AI trading agents amplified the damage. They were over-permissioned, ran with no isolation, and executed large SOL transfers on the attacker's behalf. In April 2026, researchers found 26 LLM-router services injecting malicious tool calls into agent traffic; one client's crypto wallet was drained of $500,000 through the supply chain alone.
Underneath the headline incidents sits a structural problem: one survey found that 45.6% of agent teams share API keys across agents. Shared keys mean no per-agent traceability and no kill switch — if one agent is compromised, you cannot isolate it, and you may not even know which one it was.
An agent with trading permissions is a new attack surface: it reads external data — tweets, news, prices — and external data can be weaponized. No traditional brokerage account was ever drainable by a tweet.
Read the disclosures instead of the launch pages and the platforms are candid about where the risk lands.
"You are ultimately responsible for the trades your AI agent places in your account." — Robinhood, Agentic Trading disclosures
Robinhood explicitly disclaims responsibility for agent-generated losses, AI errors and misinterpretation, and "unexpected agent behavior" — up to the total loss of deposited funds. This is not unique to Robinhood; it is the standard posture across the category.
The deeper problem is structural. Agentic trading creates a three-party triangle: you, the broker, and the AI provider — Anthropic, OpenAI, or xAI — whose model actually made the decision. Legal commentators have flagged this as an unresolved accountability gap: the broker disclaims the agent, the AI provider disclaims trading outcomes, and the user signs for everything. As Milo CEO Josip Rupena put it, people want a money-printing machine, and "if it works… amazing. But if it doesn't, who's to blame?" Right now there is no clear answer.
Regulators have noticed, even if the rulebook has not.
FINRA flagged autonomous AI agents acting without human validation as an emerging risk in its 2026 Annual Regulatory Oversight Report, calling for novel supervision frameworks — tracking agent actions, restricting system access. Congress moved in June 2026: House Democrats led by Reps. Bill Foster and Brad Sherman sent SEC Chair Paul Atkins a formal letter demanding details on agentic-trading oversight, with a response deadline of July 31, 2026.
The SEC has been enforcing against "AI washing" since the Delphia and Global Predictions cases in March 2024, and AI's influence on investor decisions is an explicit exam priority. The CFTC maintains a standing customer advisory titled, bluntly, "AI Won't Turn Trading Bots into Money Machines" — and its $1.7 billion penalty against Mirror Trading International, a fake "proprietary AI trading bot" scheme, remains the landmark case for what AI hype can conceal. In Europe, ESMA's 2026 risk analysis flags opacity, weak accountability, model drift, and a systemic concern: herding and procyclicality when many agents act on similar signals at the same time.
The common thread: no regulator has yet written rules specific to agentic trading, but every major one has put it on the watchlist. If you want the broader legal picture, we cover it in is algorithmic trading legal.
To the platforms' credit, a consistent guardrail pattern has emerged, and every piece is worth using:
These are real protections — and they have real limits. A cap contains the damage; it does not prevent it. Notifications tell you what already happened. Logs are an autopsy, not a seatbelt. And every one of these guardrails assumes the agent is merely wrong, not compromised: the Bankr and Step Finance incidents happened inside systems that had permissions and logs. Guardrails bound the blast radius. They do not make the agent trustworthy.
Strip away the branding and the safety question reduces to one distinction. A rule-based trading system is deterministic: the same inputs produce the same outputs, which means it can be backtested across decades of data, stress-tested against crashes, and audited line by line before it ever touches money. Its risk limits are code, not suggestions.
An improvising agent cannot be replayed. The run-to-run variability documented in the research means yesterday's behavior does not bind tomorrow's. You cannot backtest a system that will not do the same thing twice, and you cannot audit a decision process that even its creators cannot fully explain. That is not a flaw you configure away with a spending cap — it is the nature of the instrument.
"Safe" is the wrong shape of question. The right one is: which model of delegation are you choosing, and how much are you capping? Delegating to a tested, deterministic, rule-based system with defined risk parameters is one kind of decision — one that can be evaluated on evidence before capital is at risk. Delegating to an improvising LLM is a different kind of decision: the real-money evidence so far shows models blowing up on leverage, churning capital into fees, and getting robbed by a tweet, while the platform's own disclosures make clear the losses are yours.
If you experiment with an agent anyway, treat it as an experiment: segregated account, hard cap sized to what you can lose entirely, scoped permissions, notifications on, and a finger near the disconnect switch. That is not paranoia. It is exactly what the platforms' own risk disclosures — read closely — are telling you to do.
All of what you give it, yes. Robinhood's own disclosures acknowledge possible total loss of the funds deposited in the agentic account, and in the real-money Alpha Arena experiment GPT-5 lost about 75% of its capital on 17x leverage. The segregated-account design means the agent can only lose what you pre-load — which is exactly why the cap you choose is the single most important safety decision.
Yes, repeatedly. In May 2026, a prompt injection hidden in a Morse-code tweet drained roughly $150,000 from a Grok-linked agent wallet. The January 2026 Step Finance breach (~$40M) was amplified by over-permissioned AI agents, and April 2026 research found LLM-router supply-chain attacks that drained one wallet of $500,000. Prompt injection is the signature attack against trading agents.
Existing brokerage and commodities rules apply — the SEC, FINRA, and the CFTC in the US, ESMA in Europe — but no regulator has issued rules specific to AI trading agents yet. FINRA flagged autonomous agents in its 2026 oversight report, and House lawmakers set the SEC a July 31, 2026 deadline to explain its oversight plans. The framework is being written in real time.
No. Brokerage insurance like SIPC protects against broker failure, not trading losses — and platforms explicitly disclaim responsibility for agent-generated losses. Robinhood's disclosure states you are "ultimately responsible" for the trades your agent places. A bad trade by your AI agent is legally your bad trade.
Use every guardrail the platforms offer: a segregated account funded only with capital you can afford to lose entirely, scoped API keys, per-trade notifications, full trade logs, and the disconnect switch. Then remember the limits — caps contain damage rather than preventing it, and none of these guardrails protect against a compromised or manipulated agent.