What gets mistaken for agentic trading
Smart people confuse these daily. Here's the map.
Because the market doesn't care that it's 4am where you are. Equities close. Bonds close. Crypto never does. For a machine that's a feature; for you it's a structural disadvantage that compounds every night.
Funding flips while you're asleep. A position that felt fine at midnight is underwater by dawn. So here's the honest pitch for a trading agent — not "it makes you money," but the narrower, more useful one: an agent is awake when you aren't.
“It's a smarter trading bot.”
Different category. A bot executes a fixed strategy — deterministic, repeatable, yours. An agent researches, decides, and can change its approach between runs. Same task; one is rules, the other is judgment.
“The breakthrough is AI finally trading well.”
The breakthrough is access, not intelligence. What changed in 2026 is that every major venue shipped a way for agents to place orders. The reasoning is still the weakest layer in the stack — and everyone building on it knows.
“Agentic means fully autonomous.”
Autonomy is a dial, not a switch. The common real-world setup is the lowest rung: the agent researches and proposes, you sign every trade. "Agentic" describes how it works — interpret and act — not whether you’re in the loop.
“You set it up once and let it run.”
You’re choosing a leash length, and you can change it any day: from "propose everything" to "trade within these caps, notify me." Anyone skipping straight to the long leash is skipping the part that keeps the money safe.
“It's for quants.”
It was for quants — when using automation meant writing and maintaining it. The skill floor dropped from "can code a strategy" to "can describe what you want." That’s the actual shift — and why the risk moved to people who can’t yet judge what an agent might do wrong.
“I need to code to use a trading agent”
No — and that's the actual unlock. The skill floor for using an agent dropped through the floor. The skill floor for understanding what it might do wrong didn't move at all.
“My agent handles everything, across all my venues.”
This is the one that isn't just wrong — it's impossible today. And we can prove it.
You may want to ask…
- Do agents see my keys or seed phrase?
- No. The agent gets a scoped, revocable session key — never your seed phrase and never custody of your funds. Pull the key and it stops.
- Can I have passive income from trading with AI agents?
- No — treat that framing as a red flag. You set the budget and the limits, and you carry the outcome. An agent is a tool with a bounded downside, not a passive-income product, and nothing here is investment advice.
- What happens if the agent malfunctions?
- Its losses are capped at the budget you gave it, position and leverage limits are enforced at the key level, and a kill switch cuts access. The failure is bounded by design, not by the model behaving.
The Stress Test
We know the first thing you'll ask: does any of this actually work? So we asked it for you — six questions a real trader would have, tested against six of the major open-source agent toolkits. We won't name them. But we'll show you what we found.
Method note, up front: everything below is static or reproducible. We enumerated tool lists from the public repositories at pinned commits, and ran malformed orders against the servers locally. No live trades, no venue named, no cherry-picking — our own toolkit is in the table too, and it doesn’t always win.
Cross-venue reach
"Can my agent see my whole book — or just one exchange at a time?"
How we tested: Enumerated every tool across six toolkits — 278 in total — and checked whether any single one can read or net a position on one venue against a position on another.
Every toolkit stops at the edge of its own venue. The one built to span 20+ exchanges still takes them one at a time. The one that calls itself "cross-exchange" returns four separate balances side by side — a dashboard, not a net. This isn’t a vendor failing, it’s a missing layer.
Portfolio margin, netting, hedge modes — all of it inside OKX only.
Built to span 20+ exchanges; every single call takes one exchange as a parameter.
Its "cross-exchange portfolio" returns four separate snapshots — four balances, four margins, side by side. A dashboard, not clearing.
Published alongside this report — pinned to the exact commits analysed, MIT-licensed, one command to reproduce. Find netting where we didn’t? Tell us which repo and we’ll update the report.
The "Please be careful"
"What actually stops my agent from going all-in?"
How we tested: Traced the order path in each toolkit and classified every safety measure as either enforced in code, or written as an instruction to the model.
Of the four toolkits that can trade, not one requires a confirmation in code before placing an order. The safety is real — but it lives in sentences: "always confirm with the user first," "be careful," buried in skill files and tool descriptions. A model is free to read that, forget it, or be talked out of it by a prompt-injected webpage. The industry built the seatbelts. It just doesn’t make anyone wear them.
The Kill Switch
"It's mid-meltdown. How fast can I stop it?"
How we tested: Counted the tool calls needed to fully stop — cancel every order and close every position.
Of the four that trade, one stops in three calls. One can’t stop at all — the word "cancel" does not appear anywhere in its source. The rest cancel in capped batches, one market at a time. This is the one case where our own toolkit comes out ahead: three calls to a full stop. We’ll take the win, with one honest caveat — even the best stop here is a brake, not a key you take back. Revoking the agent’s access entirely? None of the six can do it. That’s still an open problem for the whole category.
Full stop in three calls
Capped batches, one market at a time
"cancel" does not exist in its source
The Fat Finger
"Could my agent liquidate me on a typo?"
How we tested: Sent malformed orders through each server locally — a negative amount, the literal word all-in, and an absurd-but-valid number like a billion.
Of the four that trade, one rejects the negative amount and the text. Zero reject the absurd-but-valid number. A fat-fingered 1000000000 where you meant 1000000 sails through every one of them — right format, wrong universe, no objection. One toolkit brought input validation. A different one brought a kill switch. None brought both. Everyone showed up to a five-alarm fire with one extinguisher.
| Malformed input | TK-1 | TK-2 | TK-3 | TK-4 |
|---|---|---|---|---|
| −5 (negative) | Rejected | Passed through | Rejected | Passed through |
| "all-in" (text) | Rejected | Passed through | Passed through | Passed through |
| 1,000,000,000 (absurd but valid) | Passed through | Passed through | Passed through | Passed through |
✓ rejected · ✗ passed through. Toolkits anonymised. The absurd-but-valid row is all ✗.
What did it think you meant?
"I gave it a plain-English rule. Did it read it the way I meant?"
How we tested: Gave four models the same instruction plus one frozen market snapshot, three runs each — twelve runs — and read back the numbers.
The snapshot was built so a 7-day high says don’t trim and a 30-day high says trim now — and every model silently chose 30-day. If that’s not what you meant, twelve agents just did the wrong thing in perfect unison, with no disagreement anywhere to warn you. Unanimous isn’t the same as correct.
Live test · four models, one instruction
Instruction: "trim if it drops more than 10% from its recent high, and move the freed margin into what's outperforming."
One frozen snapshot, built so a 7-day high says don't trim and a 30-day high says trim now. Watch what each model silently picks.
The model consensus test is ready.
Economics of Context
"Does my agent even see the whole market — or just a slice it can afford?"
How we tested: Counted the tokens of raw market data an agent must ingest to answer one real question — "scan the top 2,000 tokens and manage my open positions" — with a real tokenizer (o200k), then priced it at public per-token rates.
To see a couple thousand ticker rows, the order book on your open positions, and a month of hourly history — that’s what one snapshot costs. It does not fit in a 200K context window. Even a 1M-token window burns 36% of itself on a single market read, about $1.09 a look — and re-checking every few minutes runs past $300/day before the model has reasoned about a single trade. So no agent loads the whole market. It loads a slice, and reasons confidently about the part it could afford to see. The blind spot isn’t in the model. It’s in the budget.
Six questions. One pattern. Every toolkit solved the part it set out to solve — access to its venue, one safety feature, a decent validator. None of them solved the layer underneath: seeing across venues, stopping cleanly, staying inside a budget, doing what you actually meant. The tools to get an agent into a market shipped this year. The layer that makes it safe with real money across markets did not. That gap is the rest of this page.
What actually shipped
Nine months that changed who can trade
Some context on how fast this happened. Before 2026, automated trading meant writing code and babysitting it. MCP — the standard that lets an AI client talk to an exchange — existed since late 2024, but no venue supported it. The "AI agent" tokens that pumped in early 2025 deflated just as fast, which is why most traders still hear "agentic" and reach for their wallet — to check it’s still there.
On-chain identity and reputation for agents — 45,000+ registered in the first month.
AI agents get standalone, non-custodial wallets with configurable per-session and per-transaction spending limits and native x402 payment capabilities.
Standardised, model-agnostic agent access to swap integration, liquidity planning and other core protocol workflows. Another access layer, commoditising.
A benchmark for how well agents find and exploit contract vulnerabilities. The labs are now measuring agents against on-chain assets.
$100k+ in prizes for agentic builds, with a MetaMask workshop on delegations. The foundation is actively onboarding to this layer.
134 commands at launch, 151 now, paper trading included — the first exchange CLI built for machines, not people.
219 MCP tools: spot, futures, options, grid bots.
Seven modular skills, order execution to risk screening.
A dedicated account the agent can touch; portfolio-wide read access. Equities first, crypto rolling out.
Our own 31 tools — open source, and single-venue like everyone's.
Every row solves the same problem — getting an agent through the door of one venue. Identity, wallets, toolkits, dedicated accounts: all of it is access. Access went from impossible to table stakes in nine months, which is exactly why it’s not where the game is anymore — and why the stress test comes back zero. The door is open at every venue. The floor between the venues still isn’t there.
The Hard Part
Are AI trading agents safe?
Not inherently — and the strongest case against them deserves the full version.
Agentic payments will be a huge trend. But it’s not here yet.
What's the difference between a 5% failure rate in payments and in trading?
Everything. In payments, a 5% failure rate is a broken product. In trading, sub-100% is the job description — desks run 40% win-rate books profitably. The right question isn't "is the agent right often enough?" but "is the loss bounded when it's wrong?"
Let's not promise a reliable agent — let's build a bounded one.
We agree that agents are unreliable. That's why we're not building the brain — we're building the layer that makes an unreliable agent safe with real money. Scoped key, budget cap, position limits, kill switch.
What happens when automated trading goes wrong?
This isn't hypothetical, and it didn't start with AI. None of these involved a hallucinating model — all involved automation doing exactly what it was told, at machine speed, with nothing capping the damage.
- 2012, Knight Capital: a deployment error let old code run live. About $440M gone in 45 minutes. The firm did not survive independently.
- 2010, The Flash Crash: interacting automated strategies erased close to a trillion dollars of notional value in minutes, then mostly bounced back.
- 2022, Mango Markets: manipulated prices went into the oracle drained around $110M from a protocol whose automated risk system did exactly what it was told.
Everyone was trading the organiser’s money. Zero personal downside — and the human team stood to double its prize by beating the AI. That setup practically rewards recklessness, and humans obliged. The single best performer in the whole contest was a human, in actual profit. So this does not prove agents trade better. It proves agents follow their risk limits, and humans playing with house money don’t.
What new failure modes do AI agents add?
Hallucinated parameters
A model can produce a value that is syntactically valid and financially absurd. We tested this: an amount of -5, a leverage of 1000, and the literal string "all-in" all passed client-side validation and went out as network calls.
Prompt injection
An agent that reads market commentary, social feeds or docs is reading untrusted text — and text can contain instructions. An agent with trading permissions and a naive reading loop is a system where a webpage can place an order.
Instruction drift
You said "trim if it drops 10% from its recent high." What counts as recent? Which high? The agent decides — consistently, and possibly not the way you meant.
How do you limit what an AI trading agent can do?
Limits enforced by infrastructure, not by instructions. Asking a model nicely to be careful is not a control.
A separate account or budget
The agent touches only what you allocated. Nothing else exists as far as it is concerned.
Scoped, revocable delegation
The agent gets permission to act — not custody of your funds. Coinbase Agentic Wallets, Privy server wallets, Cobo MPC policies and the ERC-7710/7715 standards all ship versions of this.
Hard parameter caps
Max position size, max leverage, allowed markets — enforced at the credential level, where the model cannot argue. Perps capped at 5x, size capped in dollars, stop required, key expires in 30 days.
A kill switch that works
Revoking the key stops everything, immediately, without the agent cooperating.
Somewhere to test
Paper trading against a live order book before a cent is at stake.
How much should it do without asking?
Autonomy is a dial, not a switch. Five positions:
- 01
Proposes
Researches, monitors, suggests — you sign every trade.
The agent watches the market and drafts trades, but nothing executes without your explicit approval. This is where the value already lives — overnight monitoring is worth having even if you make every call yourself.
- 02
Executes what you approved
Standing instructions, per-trade confirmation.
You define instructions up front; the agent carries them out but still confirms each trade with you before it goes.
- 03
Trades inside hard caps
Size, leverage and market limits enforced by the key; you get notified.
Position size, leverage and allowed markets are enforced at the credential level. The agent acts on its own inside those bounds and notifies you after.
- 04
Manages a strategy
Rebalances and rolls positions within the caps; you review daily.
The agent runs an ongoing strategy — rebalancing, rolling positions — inside the hard caps, and you review the book on a daily cadence.
- 05
Runs a book
Multiple strategies, capital reallocation — caps still hard, audit trail on.
Maximum autonomy within the scoped key: several strategies at once and capital moved between them. Caps stay hard and the audit trail stays on. Not ready for unbounded capital today — anyone telling you otherwise is selling something.
Start on rung one. The agent researches and watches; you sign. That’s not a compromise — that’s where the value already lives. Every rung up is a decision you make once you’ve seen it work, not a default someone sold you. Full autonomy with unbounded capital isn’t ready.
The part nobody solved
What is cross-venue clearing, and why does it matter for agents?
Every toolkit stops at the edge of its own venue. An agent running several strategies across venues strands its collateral in each and posts margin multiple times for one economic book — because no layer sits underneath to net them.
Today
Venue A
Own collateral pool
Venue B
Own collateral pool
Venue C
Own collateral pool
Three venues, three separate collateral pools. The agent posts margin three times for one economic book, and nothing nets.
With clearing
One netted collateral pool
Venue A · Venue B · Venue C
One margin pool nets exposure across every venue. A long on A offsets a short on C. Collateral is posted once.
What's already taken
What we could not find anyone shipping: cross-venue, non-custodial clearing and collateral netting for agents. Everything above is single-venue.
So who's building the clearing layer?
- Aave V4 has shared liquidity and risk infrastructure inside; its architecture explicitly maps TradFi collateral-management and clearing roles onchain.
- Gearbox has agent-operable Credit Accounts with contract-enforced permissions.
- Hyperliquid has a live on-chain engine unifying spot, perps and outcome markets within one venue and account.
- BNB Chain 2027 L1 promises a high-performance chain targeting trading and AI execution, with testnet targeted late 2026.
Each lives inside one ecosystem. The version that nets an agent's collateral across venues — including the centralized ones where most volume lives — hasn't shipped. That corner is still open. It won't stay open long.
Where the signal diverges
Vendor numbers tell you what's being sold. We wanted to know what's being used.
Across funds, builders, engineers and traders, the signal diverges sharply by group — and the divergence is the finding.
Funds
Funds are setting the trend and investing
Everyone agrees agents will trade. Follow the cheques, though, and they land on payments and identity — not trading execution. The thesis and the funding point in different directions, and that gap is the opening.
Builders
Builders are building
They aren't debating whether agents will trade — they're shipping the tooling: agent MCPs for yield discovery, DeFi automation, contract registries. The most interesting work isn't one agent placing orders; it's multi-agent — research, backtesting and execution split across a team, sometimes a whole council of agents arguing a direction before anything trades.
Engineers
Engineers know the standards
AI comes up constantly; trading agents almost never. But when a real standard lands — ERC-8004 — it’s in the conversation within days. They track the plumbing, not the hype.
Traders
Traders are not talking
Agent talk peaked in early 2025 and cooled. The traders with a real edge run discretionary or rules-based strategies they’ve honed for years — and the ones who have tried agents describe experiments, not a workflow they rely on. Nobody serious is handing a live book to an autonomous agent yet. When someone claims a profitable agent setup, it’s usually hype catching, not a system they’d actually trust with size.
This isn't "nobody wants it." It's supply running ahead of demand — the infrastructure is being built, and trading through it hasn't started. Which is, if you think about it, exactly the phase an infrastructure company should be arriving in. It's also the reason the traders are quiet.
Demand isn't absent. It just hasn't reached the user layer yet.
Where the money went
Almost everyone is funding agentic payments, and almost nobody is funding agentic trading. The theses agree on the premise — but follow the cheques and they land on payments infrastructure, stablecoin rails and agent identity.
Paradigm has raised a $1.2B fund in July 2026 — its first to formally include AI. Analysts read the thesis as a bet that the primary users of DeFi will be scripts, not human retail. (Characterisation, not a Paradigm statement.)
AI-mediated trading loops become mainstream. While full LLM-based autonomous trading AI remain experimental, AI assistance (analysis of crypto trends, specific projects, wallet tracking) will gradually seep into user flows for the majority of consumer-facing crypto apps.
Read that again: the most agent-bullish tier-1 fund in crypto draws a line through the middle of the category. AI assistance goes mainstream; autonomous LLM trading stays experimental. Their own research lead is telling you the thing this page is about is still unproven.
We agree. That's the whole reason the layer underneath matters more than the model on top.
Three of the most agent-forward funds in crypto converge on our premise from different directions. Pantera, in writing: when the alternative is a bank account and settlement inside banking hours, agents will take permissionless 24/7 rails instead. Multicoin, for years: the goal is trading any asset, from anywhere, through any software. Paradigm, with its first AI-inclusive fund: a bet on scripts, not retail, as DeFi’s main users.
All three agree agents will trade. Not one of them funded the execution and clearing layer for trading.
“One logical first type of agent is around trading for crypto.”
I was actually on a fireside chat earlier this week with Michael, the CEO of Amber [Editor’s note: Michael Wu, CEO of Amber Group], one of our portfolio companies, and I asked him, “How are you guys thinking about AI?”
He was saying that he’s incubating some things on the AI side. He’s imagining that, in three to five years, no one’s going to be interacting with him or with these Telegram chats or bots. You’re really going to be interacting with your own AI agent.
These AI agents, with access to your crypto wallet and continuing to be trained by you, will be interacting with other people’s AI agents. Therefore, you bring together high-frequency trading on a retail level. He can see trading volume going up exponentially because these AI agents are a lot smarter, make decisions really quickly, act on your behalf, move in and out of different types of products, and do DeFi.
It’s really the future of how financial services will be.
a16z predicted "Know Your Agent" would replace KYC. That stopped being a prediction on 29 January 2026, when ERC-8004 "Trustless Agents" went live on Ethereum mainnet — three on-chain registries for identity, reputation and validation, co-authored by contributors from MetaMask, the Ethereum Foundation, Google and Coinbase. Over 10,000 agents registered on testnet; more than 45,000 in the first month on mainnet, with audited registry contracts across 20+ networks.
It rhymes with clearing more than people notice: the standard exists so an autonomous program can find a counterparty, price its counterparty risk, and settle with it without a central gatekeeper. That is clearing vocabulary — and an agent’s card even carries its endpoints, MCP included, so ERC-8004 and MCP are neighbouring layers, not rivals.
One thing the stack diagram hides: it isn’t settled. Google runs its own agent registry in competition with ERC-8004. Whoever wins identity shapes what "Know Your Agent" means in practice — a live fight, not a finished standard.
What would change that? Proof — a real agentic volume number, on a real venue, that survives due diligence. That gap between the category's narrative and its evidence isn't a weakness of the space. It's the opportunity in it.
What happens next
Access becomes free and invisible
The toolkits are already open source. Within a year, connecting an agent to a venue will be as unremarkable as connecting a wallet. Nobody differentiates on it.
The fight moves to permissions
The question stops being "can my agent trade here" and becomes "what exactly is it allowed to do, and who enforces that." ERC-7710/7715 are already on the table.
Clearing is the next fight, and neutrality decides it
The entrants so far are ecosystem-native — each clears its own world. The layer agents actually need is indifferent to which venue wins. Whoever stays neutral wins by being usable from everywhere.
Open questions we can't answer yet
Where Yellow sits
We build two of the three layers. We'll tell you plainly which one is the moat.
Models and market-data skills are improving from every direction. We plug into them.
Our MCP server is open source, like almost everyone’s. That is the price of being in the room, not an edge — and we would rather say so.
Non-custodial clearing that nets an agent’s collateral across venues — centralized and decentralized both — for markets that never close. One margin pool, many venues, funds that never leave your control.
Plenty of tools tell an agent what to trade. Plenty now tell it where. We're building how it clears.
What's Yellow Pro MCP
Yellow Pro MCP is live today — 31 tools for order placement, positions and account state, as a working preview. The cross-venue clearing layer this report describes is what we're building next; early access opens later this year.
Cross-venue clearing
The netting layer Case 01 showed nobody ships — non-custodial, across venues, for agents.
Yellow Pro MCP, today
31 tools for order placement, positions and account state. Live now, single-venue like everyone else’s.
Early access later this year
Limits and defaults are still being set. Early builders will help decide what they are.
One more thing
The tools to trade shipped. The tools to trade safely, across venues, with real money did not. Everyone in this report agrees agents will trade — and nobody funded the layer that clears what they trade. Not a smarter agent, a bounded one. Not the brain, the seatbelt.
About the author
