"Allowing AI agents to trade stocks raises serious questions about responsibility and trust," Justin Fier, Senior Vice President of Offensive Security at Darktrace, said.
Robinhood's Agentic Trading and Agentic Credit Card
Earlier this week, Robinhood launched two features — Agentic Trading and Agentic Credit Card — that allow customers to deploy AI agents to make trades and credit card purchases. Robinhood said it is approaching the deployment with a "safety-always mindset," and described a set of controls it will offer: limited account access, spending controls, and the ability to disable agents. The company also said it will provide fraud detection, manual approvals (if a user opts in for them), and the ability to preview trades "when appropriate."
Justin Fier on accountability: platform, model provider, agent, or end user?
Fier framed the central concern as one of accountability. He noted that money managers and licensed traders operate under certification and oversight because people entrust them with money, and asked who is responsible when an AI agent errs. "If an AI agent gives bad advice, hallucinates, misunderstands market conditions, or makes a trade that causes someone to lose money, who is responsible? Is it the platform, the model provider, the agent, or the end user? And is that responsibility clearly defined?" he said.
Fier's point is explicit: the shift from human-managed accounts to agentic decision-making changes the locus of responsibility in ways that are not yet resolved in Robinhood's public description of the product.
Data sensitivity: financial accounts, health data, email and corporate applications
Fier warned that the issue goes beyond trading performance to the sensitivity of the accounts and data agents may touch. He said the broader concern is the precedent set by giving AI agents access to sensitive systems "including financial accounts, health data, email, and corporate applications," and noted that actions by agents on those systems "can have real-world consequences if the agent makes the wrong decision, is manipulated, or is compromised."
Robinhood said users can bring in their agents "from anywhere" and connect them to the company's AI-native Model Context Protocol (MCP) servers, a detail that connects user-supplied agents to Robinhood's internal infrastructure.
Security mechanics: access that looks like the user, manipulation, and detection
From a security standpoint, Fier emphasized the operational danger that agent activity often runs through permissions the user has already granted. "That means malicious, unexpected, or manipulated activity may look like normal user activity," he said. If an agent is compromised or steered into taking the wrong action, defenders may not immediately know "whether it was the person, the agent acting on that person’s behalf, or an attacker abusing the agent’s permissions," he added.
Fier urged clarity on three practical points: knowing when an agent is acting, knowing what it can access, and knowing what actions it can take — and having the ability to stop it before consequences become real. He cautioned against a model in which broad authority is handed to AI agents and shortcomings in guardrails or security controls are discovered only after harm has occurred.
What this means for end users, technologists, and regulators
- End users: The choices Robinhood advertises — limited access, spending controls, disablement, fraud detection, and manual approvals — are the controls the company says it will offer. Fier's warnings suggest users will need clarity about who bears responsibility for losses and how quickly they can detect and stop an agent's actions.
- Technologists and security teams: Because agent activity can appear as normal user behavior, detection and attribution challenges will be central. Fier called for visibility into agent actions and effective stop‑gaps so defenders can tell whether an action originates from a person, an agent, or an attacker abusing agent permissions.
- Regulators and oversight bodies: The question Fier posed — whether responsibility lies with the platform, the model provider, the agent, or the end user — is a regulatory and legal problem as much as a technical one. Robinhood's statements about safety controls outline technical mitigations; critics like Fier frame the issue as one of clear, enforceable accountability.
Fier's closing warning was stark and specific to the financial context: "In a financial setting, consequences can be serious," he said. "By the time someone realizes the agent was wrong, compromised, or manipulated, the damage may already be done with money already lost." Robinhood has announced controls and a pathway for external agents to connect to its MCP servers; Fier's questions underscore that the announced safeguards leave open who will be held accountable when those controls are tested by error, manipulation, or attack.
Original story: https://www.securitymagazine.com/articles/102330-risks-of-robinhood-using-ai-agents-to-trade-make-purchases
