Your AI agent can trade your account. Nothing checks what it read first.

Robinhood shipped autonomous agent trading on May 27, 2026. Over 100,000 funded agentic accounts. Agents from Claude, ChatGPT, Cursor and Grok connect through a public MCP endpoint. Confirmation is opt-in, liability is yours, and supervision is nobody’s.

We build the layer that is missing. Not another spending cap — the integrity check on what an agent read before it placed the order.

Three sentences that define the problem

All three are from Robinhood’s own documentation. We are quoting them, not characterising them.

The read/write asymmetry

Robinhood confines trades to a segregated agentic account. It does not confine reads. Per the same documentation, a connected agent has read access to all your Robinhood accounts including account numbers, all positions and balances, all transactions including full order history, and all watchlists and scans.

The blast radius for a bad trade is one sandboxed account. The blast radius for data exfiltration is the whole portfolio.

Why the guardrails miss the attack

Every broker in the autonomous camp assembles what Simon Willison named the lethal trifecta: private data, untrusted content, and an externally-effective action. A brokerage MCP server is a textbook instance — positions and balances on one side, market data and news on the other, an order tool in the middle.

The industry is split on what to do about it. Interactive Brokers shipped 80+ agent tools in July 2026 and deliberately kept execution outside the AI session. TradeStation requires explicit confirmation. Alpaca stages orders “instead of acting on its own.” Robinhood, Public.com, Webull, Coinbase and Binance execute autonomously. Same technology, opposite safety decision.

Here is the part that matters: MCP’s proven attack classes fire before or without tool invocation.

An approval prompt fires at invocation. These attacks land earlier. The guardrail everyone points to does not cover the attack class everyone is worried about.

And Anthropic measured where the durable path is: 88% of agent-to-agent propagation arrives through the file re-injected into the system prompt each session, against 12% for ordinary files. The vector is memory, not the prompt — we wrote that up in the mind-viruses case. And we measured the base rate for the published trading-injection payload across 1,606 real trading documents: zero found, and our own scanner missed it until we fixed it.

Measured, not hypothetical

AutoRedTrader (May 2026) red-teamed LLM trading agents using subtle financial misinformation rather than overt falsehood: 69% misinformation exposure, 26.67% attack success on Bitcoin data. A companion study broke twelve in-band defenses at over 90% success.

Real money has already moved on adjacent rails:

Nobody is holding this risk

This is the part most coverage misses, and it is the reason we are building.

SIPC does not reach it

SIPC is explicit that it “only protects the custody function of the broker dealer.” A trade that executes correctly and loses money destroys no asset. There is nothing to restore.

“Unauthorized trading” likely fails

Connecting the agent is plausibly the authorization under FINRA Rule 3260. And ratification is lethal here: a stream of unobjected-to agent trades is deemed accepted. Silence over a hundred trades ratifies the hundred-and-first.

Insurers already decided

Verisk/ISO released three generative-AI exclusions effective January 1, 2026(CG 40 47, CG 40 48, CG 35 08). W.R. Berkley’s PC 51380 is an absolute AI exclusion across D&O, E&O and fiduciary lines. The specialist market — Testudo, Armilla, Klaimee — covers third-party reliance loss. Your own trading loss in your own account is first-party pure economic loss: the classic uninsured category.

Insurers reached a verdict before regulators did, and their verdict was to decline the risk. Meanwhile the SEC has no rule, no proposal and no enforcement action on agentic trading. FINRA’s 2026 report expects “explicit human checkpoints before execution” for transacting agents — and creates no new requirements. Seven members of Congress wrote the SEC in June asking whether it had approved any of this. There was no public answer.

What we sell

Every control shipping today is a perimeter control: subaccounts, spending caps, kill switches. Binance conceded it “really cannot see the reasoning” behind agent decisions. That is the gap, and it is where we work.

The artifact nobody sells

Four attestation regimes now exist — AIUC-1 (authored by an underwriting company, with Schellman accredited), CSA STAR for AI Agentic, ISO/IEC 42001, and Attestix. Every one certifies security posture.

None certifies that an agent acted within mandate.

That is the artifact an arbitration panel, an underwriter and a compliance officer each need, and none can currently buy. B2C2 v Quoinegives the legal reason it matters: courts locate intent in “the person who was responsible for causing it to work in the way it did, in other words, the programmer.” So provable pre-execution constraint is the defensible record. FINRA has named the control it expects. Nobody sells proof it happened.