10 August 2026

Five brokers now let an AI trade your money. The research says we skipped a step.

In 2026 the infrastructure to hand a brokerage account to a language model became ordinary. Five brokers now run first-party MCP servers. Four of them let an external agent place a live order. Connecting one takes a single URL pasted into a config file.

The research that would tell you whether this is a good idea has not kept pace. It is not that the findings are discouraging. It is that, by the field's own assessment, most of them cannot be checked.

This is not an argument against agentic trading. It is an argument that the practice step got skipped, and a description of what it would take to put it back.

What actually shipped

Robinhood opened agentic trading on 27 May 2026: a separate funded sub-account, an agent connected over MCP, support for Claude, ChatGPT, Grok and Cursor. Webull followed, permitting live placement with configurable dollar caps and symbol whitelists. Public.com went furthest — describe a strategy, confirm it once, and it executes from then on without alerting you before each transaction. TradeStation permits placement but enforces approval: no order reaches the market until you approve it. Interactive Brokers, on 28 July, declined to allow placement at all — its agent drafts an instruction and you submit it yourself from an IBKR platform.

Two of the five, then, built a human gate on purpose. Three did not.

Robinhood's own documentation is candid about what this means. AI strategies "may perform poorly under certain market conditions, move quickly, and may be difficult to monitor or stop in real time," and monitoring the account is the user's responsibility. They ship a kill switch, which tells you what they think the failure mode looks like.

That is a reasonable posture for a broker. It leaves an obvious question for everyone else: the rail exists, but where does anyone practise?

Three findings worth reading before you connect anything

1. Agents do not reliably mean what they say

In December 2025 a paper called TradeTrap asked whether LLM trading agents are reasoning or producing text that resembles reasoning. Its findings, in short:

The same information, formatted differently, produces different trading decisions.
Agents contradict their own stated analytical frameworks across comparable scenarios.
Justifications cite supporting evidence that is not present in the underlying data.

The authors call this unfaithfulness: output that appears analytically sound while resting on inconsistent or fabricated reasoning. The practical version is worse than it sounds. An agent does not necessarily reason toward a decision and then explain it. It can arrive at a decision and then generate an explanation that reads perfectly — which means the explanation you are monitoring may not be the reason anything happened.

Their recommendation was to improve transparency and consistency before deployment. That was eight months ago.

2. The field cannot yet check its own claims

A systematic review published in May 2026 screened 77 studies of LLM trading agents, of which 19 met its bar for empirical evidence. Among those 19:

2 disclose an extractable time-consistent data split
1 specifies a transaction-cost model
1 documents universe or survivorship handling
15 are coded at the lowest reproducibility tier, and none reaches the highest

Its conclusion is that architectural experimentation is expanding rapidly while "comparable evaluation protocols, execution semantics, and reproducible artifacts remain the field's immediate bottlenecks."

Read carefully, that is not a claim that agentic trading does not work. It is a claim that the discipline does not yet agree on what evidence would look like. Any confident number you encounter about how these systems perform is being produced inside that gap.

3. The risks are structural, not just individual

A March 2026 survey of AI agents in financial markets catalogues failure modes that do not depend on any single agent being badly built: brittleness when conditions move outside the training distribution, self-reinforcing feedback loops from rapid autonomous trading, susceptibility to adversarial inputs, and correlated behaviour among agents that share training data or objectives.

Its recommendations are circuit breakers, position limits and mandatory kill switches. Its closing position is the one to sit with: human oversight and robust testing frameworks are essential before deploying AI trading systems at scale.

The regulator has noticed

FINRA's 2026 Regulatory Oversight Report is the first to frame agentic AI directly. The risks it names as being of greatest concern begin with AI agents acting autonomously with no human in the loop, followed by agent permission and access scope, and agents misusing sensitive data.

Firms are expected to assess their compliance obligations before deploying, and to supervise usage afterwards. There is no formal rulemaking yet, and separate analysis notes that basic questions remain open — including whether a prompt or its output constitutes a business record.

Separately, the CFTC has issued warnings about AI trading bot scams promising extreme returns or perfect win rates. That is a different problem from the one described here, but it shapes the environment: a field where the loudest claims are the least reliable is a field where careful work is hard to distinguish.

What good design actually looks like

The useful response to all of this is not abstinence. It is design. Four things separate an agent you could reasonably run from one you could not.

Limits that live outside the model. A position cap written into a system prompt is a suggestion. Models are good at reasoning, and a model given a cap plus a sufficient reason to exceed it will find its way to the reason — not adversarially, but because that is what reasoning does. A limit that holds has to sit between the decision and execution, where argument does not reach it. An order that breaks it should never be formed, not rejected after the fact.

A human who can be in the loop. Note that two of the five brokers built this deliberately. Interactive Brokers keeps execution outside the AI session entirely — the agent drafts, you submit. TradeStation allows the agent to place orders but makes confirmation enforced rather than suggested: nothing reaches the market unapproved. Two firms with real compliance departments concluded independently that the friction was worth it, which is the same shape FINRA's stated concern points toward.

Simulation that does not flatter. If you are going to test before you fund, the test has to be honest. Fills priced against real market data, with slippage and commission applied. It is worth remembering that in the review above, exactly one of nineteen studies specified a transaction-cost model at all — which suggests how easy it is to skip.

A record you can actually read. Given what TradeTrap found about justification, a log of fills is not enough. You want the reasoning attached to each decision, and you want to read it back over enough decisions to learn the agent's habits rather than its best day. This is also the only practical defence against unfaithfulness: you cannot detect a fabricated rationale from a single instance, only from a pattern.

If you are going to connect one anyway

People will, and the advice to simply not is worth very little. So:

Fund the smallest amount that would teach you something. Every broker offering this ships a segregated account for a reason.
Find the kill switch before you need it, and confirm it works.
Watch it through a period of volatility before you trust a period of calm. Brittleness shows up outside the familiar, not inside it.
Read the reasoning, not the returns. You are trying to learn whether the agent's process is sound, and the account balance will not tell you that.
Assume the explanation may be post-hoc. Look for consistency across many decisions rather than plausibility in any one of them.

The missing step

The pattern in 2026 is straightforward. The industry built the live rail before it built the practice rail. Five brokers now let an agent reach a real account, four of them without a human on each order; nobody shipped anywhere to find out first whether a particular agent should be allowed near one.

That is the gap, and it is not a hypothetical one — it is the same gap the research names when it asks for testing frameworks before deployment, and the same one the regulator gestures at when it flags autonomy without a human in the loop.

It is a solvable problem. It just has not been solved yet, which is why we are building Tradr — somewhere an agent trades real markets with paper money from the day it is deployed, records why it did everything, and earns a real account or does not.

Sources

Nothing here is investment advice. Trading inside Tradr is simulated, and we never place a real order on anyone's behalf.