AI trading agents are moving closer to your brokerage account, raising a critical question: what happens when artificial intelligence can execute trades without asking for your approval?

AI Agents Are Coming for Your Trading Account

AI AI Tools by Julian Vane

An investor opens an AI assistant and types a familiar question: “Should I reduce my exposure to Nvidia?”

Until recently, the answer would have been a piece of text. The assistant might summarize Nvidia’s valuation, examine the semiconductor market, compare the company’s earnings with its competitors and suggest several possibilities. The investor would then have to open a brokerage account and decide what to do.

Now imagine a slightly different exchange.

“Reduce my Nvidia exposure to 10% of my portfolio.”

The assistant checks the account, calculates the position, prepares a sell order and asks for confirmation. Once approved, the order travels through a brokerage API and enters the market.

A further step removes the confirmation from individual trades. The investor authorizes an agent to maintain certain portfolio limits, and the software buys or sells assets whenever its rules are triggered.

At that point, artificial intelligence has crossed an important boundary: it is no longer merely discussing financial decisions. It has been given permission to make transactions.

This is not an entirely hypothetical future. On October 8, 2026, eToro announced connectors for ChatGPT, Claude, Grok and Grok Bot, allowing eligible customers to bring information from their brokerage accounts into compatible AI assistants. The company also offers Agent Portfolios, introduced earlier in 2026, through which authorized agents can trade within dedicated investment accounts.

The announcement comes during TOKEN2049 week in Singapore, where eToro CEO Yoni Assia has been associated with discussions about agentic finance, AI connectivity and blockchain infrastructure. The original conference recording identified in an October newsletter could not be independently verified for this article. But eToro’s published product documentation and Assia’s earlier investor statements establish something more consequential than a conference prediction: some forms of AI-controlled brokerage execution already exist.

The question is whether the financial industry can make them safe enough for ordinary investors.

Table of contents

What eToro has actually launched

The October 8 announcement is significant partly because it connects several products eToro had already been developing.

In March 2026, the company began gradually introducing Agent Portfolios, dedicated sub-portfolios that investors can fund and connect to external software agents. The user determines how much capital to allocate and grants access through credentials restricted to that portfolio.

Unlike a conventional chatbot, an agent connected through the appropriate API can interact with brokerage functions. Depending on its permissions, it may retrieve positions, inspect balances, place orders and close trades.

In April, eToro launched its App Store and developer ecosystem, giving third parties access to tools for creating trading applications, analytics services and automated workflows.

The company’s August earnings-call transcript provides unusually explicit confirmation of its ambitions. Asked whether its AI integrations required human approval for each trade, Assia described an existing arrangement in which authorized agents could trade autonomously, with users choosing whether to provide read-only access or restrict activity to a specific portfolio.

He also described MCP connectivity, referring to the Model Context Protocol, which provides a standardized way for AI applications to interact with external tools and services.

The October announcement extends that strategy by introducing connectors designed to make account access simpler for users of popular AI assistants.

There is, however, an important distinction between these products.

The new consumer connectors and the dedicated autonomous Agent Portfolios do not necessarily operate under identical authorization rules.

According to eToro’s October 8 announcement, the connectors can provide read-only access or read-and-act capabilities where supported, with proposed actions submitted for review and approval. Funding and withdrawals remain inside eToro rather than being performed through the chat interface.

Agent Portfolios, by contrast, are designed to support automated trading inside a separately funded portfolio, subject to the permissions and operating boundaries selected by the user.

Availability also varies. eToro says its new connectors are not currently available to customers in the United States, Australia or Singapore, and capabilities depend on the assistant and regulatory jurisdiction.

Those qualifications matter. A connector that can display an account balance is not automatically authorized to trade. A connector that can propose an order is not necessarily allowed to execute it without approval. And a separately authorized autonomous agent represents a more consequential delegation of control.

The difference between an AI assistant and a trading agent

The distinction is not primarily about how intelligent the software appears.

It is about what the software is permitted to do.

An AI assistant with no brokerage connection can answer questions using information supplied by the user or retrieved from public sources. It may discuss a company’s earnings, calculate portfolio weights from pasted figures or explain how a limit order works.

An assistant with read-only account access can provide much more personalized analysis. It can inspect actual holdings, calculate unrealized gains, identify concentration risk and compare portfolio performance with market benchmarks.

Neither arrangement requires the AI to possess authority over the account’s assets.

An agent with trading permissions operates differently.

It can translate an instruction into an action involving real money. If the connected system allows it, the agent may select an instrument, calculate an order size, choose an order type and submit that order through the broker’s execution infrastructure.

This introduces a new distinction between intelligence and authority.

A model might be highly capable at financial analysis but poorly suited to interpreting ambiguous instructions. Another might follow explicit trading rules reliably while offering little genuine investment insight.

The ability to execute an order does not demonstrate that an agent has superior market judgment.

Indeed, traditional algorithmic trading has operated for decades without requiring large language models. A deterministic program can buy or sell when a specified condition is met.

What generative AI changes is the interface and potentially the decision process. Natural-language instructions, external research, portfolio analysis and execution can be assembled into a single workflow.

That convenience is also what creates new risks.

What happens when an AI prepares a real trade

Consider an investor who owns $25,000 worth of technology stocks and wants to reduce the portfolio’s concentration in Nvidia.

The investor tells an AI assistant:

“Bring Nvidia down to 15% of my portfolio, but don’t sell anything else.”

A properly designed system would need to perform several distinct operations before sending an order.

First, it must establish the investor’s identity and obtain permission to access the relevant brokerage account. That connection should use a recognized authorization mechanism rather than requiring the investor to reveal their password directly to the AI model.

Second, it must retrieve current portfolio information, including holdings, available balances, existing open orders and the value of the Nvidia position.

Third, it must interpret the instruction.

Does 15% refer to the entire brokerage account or only the technology allocation? Should the calculation include cash? Does the investor hold Nvidia through multiple instruments? Are there pending orders that could change the position?

A reliable agent should not silently guess when those distinctions could materially affect the transaction.

Fourth, it must calculate the proposed trade using appropriate prices and account values. Market data needs timestamps, because a portfolio calculation based on yesterday’s closing prices may no longer describe the account accurately.

Fifth, it must construct an order that the brokerage system can understand.

That means selecting the correct instrument identifier, transaction direction, quantity, order type and any applicable price limits.

Finally, in a human-approved workflow, the investor receives a clear description of the proposed transaction before execution.

For example:

Proposed action: Sell 12 shares of Nvidia using a limit order. Estimated proceeds: $2,100. Expected Nvidia allocation after execution: approximately 15%. This estimate may change with market prices and other account activity.

The numbers here are illustrative, not a live quote or a recommendation.

Only after the investor confirms should the system submit the order.

And even then, the workflow is not finished.

The brokerage API may acknowledge receipt of an order without confirming that it has been filled. The order may execute partially, remain pending, be rejected or fill at a price different from the initial estimate.

The agent must check the actual execution status rather than assuming that a successful API response means the trade is complete.

This distinction is mundane in conventional brokerage software. In an AI system that communicates through natural language, it becomes essential.

An assistant that confidently announces “I’ve sold your shares” when it has merely submitted an unfilled order could mislead the investor about their actual exposure.

When the agent no longer asks for permission

Human confirmation creates a relatively clear boundary between analysis and execution.

Autonomous trading moves that boundary.

Imagine an investor creating a dedicated $2,000 portfolio and instructing an agent to keep any individual stock below 20% of the account’s value.

The agent checks the portfolio every morning. If a position grows beyond the specified limit, it calculates an adjustment and places an order automatically.

The investor has approved the general strategy and authorized the agent to operate within a restricted pool of capital, but no longer confirms every transaction.

This is close to the model supported by eToro’s Agent Portfolios, which allow users to assign capital to a dedicated sub-portfolio and connect software through scoped credentials.

The company’s documentation describes applications ranging from scheduled rebalancing to strategies responding to market data and external signals.

There is a substantial difference, however, between a system executing a precise numerical rule and one interpreting a broad instruction such as “protect my portfolio if the market becomes dangerous.”

What counts as dangerous?

A 3% decline? A volatility spike? An earnings warning? A social-media rumor? A sudden change in Treasury yields?

A language model can produce a plausible interpretation of that instruction. Plausibility is not the same thing as authorization.

The more discretion an investor delegates, the more important it becomes to define the agent’s permitted actions independently of the language model’s own interpretation.

The danger of malicious instructions hidden in financial data

One of the most unusual risks in agentic trading comes from the way large language models process information.

An AI agent researching a company may read financial news, regulatory filings, social-media posts, analyst commentary or data returned by external tools.

Some of that information is untrusted.

A malicious actor could place instructions inside material the agent is expected to read. This technique, known as prompt injection, attempts to make the AI treat external content as operational instructions rather than as data.

Imagine an agent monitoring news about a semiconductor company.

It retrieves a webpage containing an apparently ordinary market report. Hidden inside the page is an instruction telling the agent to ignore its portfolio rules and submit a large purchase order.

A secure system should treat that text as untrusted source content. It should have no authority to change trading permissions or override the investor’s instructions.

But AI agents do not always maintain that boundary reliably.

The problem becomes especially serious when the same model can both read untrusted information and call tools capable of moving money.

A compromised webpage should never be able to authorize a trade.

Neither should a forged tool response, an email containing malicious instructions or a manipulated social-media post.

Preventing this requires more than telling the model to ignore suspicious text.

The execution system must enforce permissions and transaction limits independently of the model’s generated reasoning.

If an agent is authorized to trade only within a $2,000 portfolio, a malicious instruction should be unable to make the brokerage API access another account, regardless of how convincingly the instruction is written.

Why a correct trading idea can still become a bad transaction

Prompt injection is only one failure mode.

An AI agent can misunderstand a perfectly legitimate instruction without encountering any malicious content.

Consider an investor who writes:

“Sell half my Tesla position if it falls below $300.”

A poorly designed agent could confuse selling half the shares with selling shares worth half the current position value. It might misunderstand whether the condition refers to the latest trade price, a closing price or a particular market session.

It could also act on stale data.

If the market briefly moves below the threshold, recovers and then becomes highly volatile, an order prepared using an outdated price may execute under conditions the investor did not anticipate.

More subtle problems arise from repeated actions.

An agent submits a sell order, but the API request times out before the confirmation reaches the model. Unsure whether the transaction succeeded, it sends the same order again.

If the first order was accepted, the account may now contain two sell orders.

This is a classic distributed-systems problem, made more dangerous when the software deciding whether to retry is probabilistic.

A robust implementation needs unique order identifiers, duplicate-request protection, execution-status checks and reconciliation against the broker’s authoritative records.

It also needs to distinguish a submitted order from a filled order and recognize that partial fills can change the remaining quantity.

Other risks include selecting the wrong financial instrument, confusing currencies, misunderstanding leverage, placing a market order in an illiquid security or failing to account for fees and spreads.

None requires an AI model to behave maliciously.

Ordinary mistakes become financially consequential when software is authorized to execute them.

The security architecture an AI trading agent needs

The safest architecture for agentic trading begins by assuming that the language model can make mistakes.

That assumption should shape the entire system.

Permissions must be narrow. An assistant used for portfolio research should receive read-only access. An agent authorized to trade a dedicated sub-portfolio should not automatically gain permission to move money, change account credentials or access unrelated holdings.

Capital exposure must be limited. Investors should be able to specify the maximum funds available to an agent, maximum order size, permitted instruments and restrictions on leverage. These controls should be enforced by the brokerage or a trusted execution layer, not merely described in the agent’s prompt.

Human approval should be explicit when required. The user should see the instrument, direction, quantity, order type and material risks before authorizing a trade. Approval must apply to the specific transaction displayed, rather than to an order the agent can silently modify afterward.

Every action needs an audit trail. The system should record the original instruction, relevant account state, data timestamps, proposed order, authorization decision, API request, brokerage response and final execution status.

Access must be revocable. Users need a reliable way to disconnect an agent, invalidate credentials and prevent new orders. Revoking access should also trigger a clear explanation of what happens to orders already submitted.

Testing should precede live trading. A demo environment can reveal mistakes in instrument selection, order construction and portfolio calculations without immediately risking capital. It cannot, however, reproduce every condition encountered in live markets.

eToro’s developer documentation already describes separate real and demo trading APIs and dedicated credentials for Agent Portfolios.

The broader engineering principle is straightforward: the AI model may propose an action, but trusted software should determine whether that action is permitted.

An agent’s confidence in its own reasoning is not a security control.

Who is responsible when an AI agent loses money?

The technical problems are difficult. The legal questions may prove even harder.

Suppose an investor authorizes an AI agent to rebalance a portfolio. The agent misinterprets the instructions, executes several trades and creates a substantial loss.

Who is responsible?

The investor who granted permission? The developer who created the agent? The provider of the language model? The brokerage that accepted the order?

There is no universal answer.

Responsibility depends on the contractual relationship, the applicable jurisdiction, the nature of the service, whether the provider is carrying out regulated investment activity and whether a technical or operational failure contributed to the loss.

The distinction between providing software and providing investment advice becomes particularly important.

A company offering an AI tool that merely displays financial information may face different obligations from one exercising discretion over customer assets.

In some jurisdictions, managing investments on behalf of clients or providing personalized recommendations can trigger licensing, conduct, disclosure and supervision requirements. Describing a service as an AI agent does not automatically remove those obligations.

eToro’s own risk disclosures illustrate the contractual approach platforms are taking.

The company’s documentation states that users are responsible for the activity of third-party automated tools connected to their accounts and warns that AI-generated trading logic can produce unexpected behavior or losses.

That does not settle every potential dispute. Contractual disclaimers operate within applicable law and do not necessarily eliminate regulatory duties or liability for a provider’s own failures.

But they demonstrate how significant the responsibility question has become.

An investor may believe they are delegating a task to intelligent software. Legally, they may also be accepting responsibility for the actions that software takes.

The interface can make delegation feel effortless while the underlying liability remains complicated.

Where blockchain fits into agentic finance

Agentic trading is also being discussed alongside blockchain because programmable financial infrastructure offers another environment in which software can initiate transactions.

On a blockchain, an agent may interact with wallets, smart contracts, decentralized exchanges and tokenized assets through software interfaces.

That can enable automated settlement, transfers and interactions between services without relying on the same operational architecture as a traditional brokerage account.

It also introduces additional risks.

If an agent controls a wallet’s signing credentials, it may be able to authorize transactions that are difficult or impossible to reverse. A mistaken token transfer or malicious smart-contract interaction can have consequences different from those of a brokerage order that has not yet been filled.

Private-key management, transaction simulation, spending limits and contract permissions become essential.

This helps explain why AI agents and blockchain are increasingly appearing in the same financial-industry conversations.

Both technologies make financial activity more programmable.

But programmability should not be confused with safety.

A blockchain can establish that a transaction was authorized by a particular cryptographic key. It cannot establish that the human owner intended the transaction, that the AI interpreted the instruction correctly or that the investment decision was sensible.

The same distinction applies to conventional brokerage APIs.

Technical authorization proves that a system possessed permission to act. It does not necessarily prove that the action reflected the user’s wishes.

The brokerage account is becoming a programmable interface

For years, retail investing platforms competed on execution costs, asset selection, interface design, educational content and social features.

AI introduces a different possibility.

The brokerage account becomes a service that external software can query and, with appropriate authorization, control.

Investors may increasingly interact with their portfolios through general-purpose assistants rather than spending every session inside a brokerage application.

Developers may build specialized agents for monitoring exposure, comparing account activity with investment policies, preparing rebalancing instructions or managing narrowly defined automated strategies.

That could make sophisticated portfolio tools more accessible to people who cannot program their own trading systems.

It could also encourage a dangerous misunderstanding.

Natural-language interaction makes complex software feel familiar. A conversation with an assistant may resemble asking a knowledgeable person for help, even when the underlying system is making probabilistic judgments and executing deterministic financial transactions.

The apparent simplicity of the interface can conceal the complexity of the permissions behind it.

eToro’s October announcement is important because it moves account connectivity closer to the assistants people already use. Its earlier Agent Portfolios demonstrate that, under a different authorization model, AI agents can already place real trades.

The remaining challenge is not merely connecting more models to more brokerage accounts.

It is defining exactly where human judgment ends, where software authority begins and what happens when the software gets something wrong.

An AI assistant that misreads an earnings report can produce a misleading paragraph.

An AI trading agent that misreads the same report may produce an order.

That is the difference the financial industry now has to engineer around.

AI trading agents: frequently asked questions

Can AI agents already execute real stock trades?

Yes, in supported environments. Brokerages and trading APIs can permit authorized software agents to submit orders. eToro’s Agent Portfolios are one example, allowing agents to trade within dedicated portfolios subject to user-defined permissions and applicable availability restrictions.

Can ChatGPT directly trade through eToro?

eToro announced connectors for ChatGPT and other assistants on October 8, 2026. Supported capabilities vary by platform and jurisdiction. Its consumer connector announcement describes proposed actions being reviewed and approved, while separate Agent Portfolios support autonomous execution. Connecting an account does not automatically mean every ChatGPT session has trading permission.

What is the difference between an AI trading assistant and an autonomous trading agent?

An assistant can analyze information and propose actions. An autonomous agent can also use authorized tools to perform tasks, potentially including placing orders without individual approval when that level of access has been explicitly granted.

What is MCP in AI trading?

The Model Context Protocol is a standard for connecting AI applications to external tools and information sources. In a brokerage setting, an MCP integration may expose account information or trading functions, depending on the connector and permissions. MCP itself does not guarantee that a transaction is safe or appropriate.

What is an Agent Portfolio?

An Agent Portfolio is eToro’s dedicated sub-portfolio structure for AI-driven trading. Users allocate funds and authorize an agent to operate within the portfolio’s permitted scope.

Can an AI agent accidentally place the wrong order?

Yes. An agent may misunderstand instructions, select the wrong instrument, use outdated information, miscalculate an order size or retry a transaction incorrectly. Execution controls and confirmation procedures are intended to reduce these risks.

Can malicious content manipulate an AI trading agent?

Potentially. Prompt injection can attempt to turn untrusted webpages, documents or tool responses into instructions. Trading permissions and risk limits should therefore be enforced outside the language model.

Who is liable for losses caused by AI trading?

Responsibility depends on applicable law, platform terms, the provider’s role and the circumstances of the loss. Investors should not assume that connecting an AI agent creates a regulated advisory relationship or guarantees reimbursement for unwanted trades.

Is blockchain necessary for AI trading agents?

No. AI agents can interact with traditional brokerage systems through APIs. Blockchain offers alternative infrastructure for programmable transactions and settlement but introduces its own custody, security and authorization risks.

Do AI trading agents outperform human investors?

There is no reliable basis for assuming that AI agents consistently outperform human investors or conventional automated strategies. The ability to execute trades autonomously is separate from the ability to generate superior risk-adjusted returns.

Sources: