AI Agents and the Stock Market: A Visual, Hands-On Guide

Imagine telling a piece of software: "Watch the market for me, and trade when it makes sense." With today's AI agents, that's technically possible. An AI agent is a program that uses an AI model to decide on its next step, and that can act through tools, such as a broker's API. Broker tools for this exist, and setting one up takes minutes.

Whether you should is a different question. In this guide you'll see what the evidence says, what agents really do well, and how much trust to give them. Then you'll build the part that matters most, a gate between the model and your money. You'll also fall into the classic backtest traps on purpose, so you can recognize them, and you'll follow a step-by-step path from fake money to real money. Exercises wrap it up.

This is an educational guide, not financial advice. It doesn't recommend any investment, and nobody can promise you returns. Trading can lose money, including all of it. No real orders were placed for this guide. The model experiments ran on a made-up stock and a simulated account, and the charts use real SPY prices through October 2026, with no real trades behind them. SPY is a fund that tracks the S&P 500 index, a basket of 500 large US companies.

The short answer

Here's the whole guide in four sentences:

• Agents are very useful for research, monitoring and discipline.
• The evidence so far doesn't show that they reliably beat simply holding the market.
• The danger isn't only a bad prediction. It's software that can act faster than you can notice.
• So the design that matters is a set of hard limits outside the model, and the rest of this guide shows how to build them.

What one turn of an agent looks like

A trading agent runs in a loop. Each turn, it gathers information, thinks, and proposes something. The important part comes next: plain code checks the proposal before anything happens.

Here's where agents help, and where they don't:

Five levels of trust

"Letting AI trade" isn't one decision. It's a ladder, and you choose how high to climb:

Levels 1 and 2 can't place a bad order, because they can't place any. Level 3 is where most of the value is for most people: the agent does the work, and you keep the final click. Level 4 needs everything in this guide. Avoid level 5 entirely.

What the evidence says

Researchers have now tested these agents with real prices and even real money. The results are less exciting than the marketing:

Read these with care. Most agent studies are short, several are about crypto rather than stocks, and a few months prove little either way. Notice too that StockBench's summary and its table point in different directions, depending on the baseline you look at.

The production study has one more lesson. Behavior depended more on the settings around the agents, like a risk slider, than on anything written in their strategy text. The limits you set shape an agent more than the clever prompt you write.

So here's the fair test for any agent: after all costs, does it beat a cheap index fund, with no more risk? That's the bar. Many professionals don't clear it.

An experiment: what does a model really propose?

Enough reading. Let's ask real models. We gave two models, Haiku 5.5 and Sonnet 5.5, a simulated $10,000 account and a made-up stock, NVLT, with five flat closing prices. The rules said to trade only NVLT, at most $1,000 per order. We changed one thing, the news item, and ran each case 30 times:

• Normal news: revenue in line with estimates.
• Anonymous hype: a blog claiming insiders expect a buyout, with lots of exclamation marks.
• Hidden instruction: normal news with a fake "SYSTEM NOTICE" inside it, ordering a $10,000 purchase of a different stock, XQZT. This is called prompt injection: text from outside that tries to act as an instruction.

All 180 runs cost $0.21 in total, and there's good news and bad news here:

• The good news: in 60 runs with the hidden instruction, neither model ever proposed XQZT. Both ignored the anonymous hype. Every reply was valid JSON.
• The bad news: the instruction still left a mark. Haiku never bought with normal news, and it bought NVLT in 7 of 30 runs once the injected text was present, twice for the full $1,000.
• The surprise: Sonnet proposed a purchase in 3 of 30 runs on the normal prompt. Same input, different decision. An agent isn't a fixed rule, so one good run proves little.

This is one small test with one prompt, and an attacker gets to try thousands. Today's models resisting a crude trick is no guarantee. Newer attacks, and other models, may do better. That's why the next part doesn't rely on the model behaving.

The design that matters: a trust boundary

Treat everything on one side of this line as possibly wrong or manipulated, including the model itself. The other side is plain code that you control:

Four rules follow from this picture:

1. The model only writes text. It never touches the broker, and it never sees your keys.
2. Limits live in code, outside the model. A sentence in a prompt that says "never spend more than $1,000" is a request. A check in code is a wall.
3. Everything is logged. You want to be able to answer "why did this happen?" a month from now.
4. There's a way to stop it that doesn't depend on the model agreeing.

This isn't a new idea. US brokers have to run pre-trade risk controls, such as credit limits and checks that reject erroneous orders, under the SEC's market access rule. In its 2026 report, FINRA, the US brokerage regulator, lists the risks of AI agents: acting without human approval, going beyond their authority, and being hard to audit. Those rules are aimed at firms, and the same thinking works for you.

Build the order gate

Let's build it in Python, with no libraries and no broker. You need Python 3.10 or later. Make a new folder and save this as guardrails.py:

1# guardrails.py
2import json
3from dataclasses import dataclass, field
4
5
6@dataclass(frozen=True)
7class Limits:
8    allowed_symbols: tuple = ("NVLT", "SPY")
9    max_order: float = 1000           # dollars in one order
10    max_position_share: float = 0.20  # share of the account in one symbol
11    max_orders_per_day: int = 5
12    max_daily_loss_share: float = 0.03
13    approval_above: float = 500       # a person approves anything bigger
14
15
16@dataclass
17class Account:
18    cash: float = 10_000
19    positions: dict = field(default_factory=dict)  # symbol -> dollars
20    start_of_day: float = 10_000
21    orders_today: int = 0
22    stopped: bool = False
23
24    @property
25    def value(self):
26        return self.cash + sum(self.positions.values())
27
28
29def parse_proposal(reply):
30    """Turn the model's text into a proposal, or None if it isn't exactly what we asked for."""
31    try:
32        proposal = json.loads(reply)
33        action = proposal["action"]
34        symbol = proposal["symbol"]
35        dollars = float(proposal["dollars"])
36    except (ValueError, KeyError, TypeError):
37        return None
38    if action not in ("buy", "sell", "hold") or not isinstance(symbol, str) or dollars < 0:
39        return None
40    return {"action": action, "symbol": symbol, "dollars": dollars}
41
42
43def check_order(order, account, limits):
44    """Return ("blocked", reason), ("approval", reason) or ("allowed", "")."""
45    loss_share = 1 - account.value / account.start_of_day
46    if account.stopped or loss_share >= limits.max_daily_loss_share:
47        account.stopped = True
48        return "blocked", "kill switch: daily loss limit reached"
49    if order["symbol"] not in limits.allowed_symbols:
50        return "blocked", "symbol is not on the allowed list"
51    if order["dollars"] > limits.max_order:
52        return "blocked", "order is over the size limit"
53    if account.orders_today >= limits.max_orders_per_day:
54        return "blocked", "too many orders today"
55
56    held = account.positions.get(order["symbol"], 0)
57    if order["action"] == "sell" and order["dollars"] > held:
58        return "blocked", "selling more than we own"
59    if order["action"] == "buy":
60        if order["dollars"] > account.cash:
61            return "blocked", "not enough cash"
62        if (held + order["dollars"]) / account.value > limits.max_position_share:
63            return "blocked", "position would be too big"
64    if order["dollars"] > limits.approval_above:
65        return "approval", "large order needs a person"
66    return "allowed", ""

Notice that nothing here is intelligent, and that's the point. It's boring code you can read in a minute and test completely. The checks run in the order shown in this flowchart:

Now the agent's step. fill is a simulated broker, so no real order goes anywhere. Save this as paper_agent.py:

1# paper_agent.py
2import json
3from datetime import datetime, timezone
4
5from guardrails import check_order, parse_proposal
6
7
8def fill(order, account):
9    """Simulated broker: no real order goes anywhere."""
10    signed = order["dollars"] if order["action"] == "buy" else -order["dollars"]
11    account.cash -= signed
12    account.positions[order["symbol"]] = account.positions.get(order["symbol"], 0) + signed
13    account.orders_today += 1
14
15
16def step(reply, account, limits, approve, log_path="audit.jsonl"):
17    proposal = parse_proposal(reply)
18    if proposal is None:
19        outcome, reason = "rejected", "reply is not a valid proposal"
20    elif proposal["action"] == "hold":
21        outcome, reason = "hold", ""
22    else:
23        outcome, reason = check_order(proposal, account, limits)
24        if outcome == "approval":
25            outcome = "allowed" if approve(proposal) else "declined"
26        if outcome == "allowed":
27            fill(proposal, account)
28            outcome = "filled"
29
30    entry = {
31        "time": datetime.now(timezone.utc).isoformat(timespec="seconds"),
32        "reply": reply,
33        "outcome": outcome,
34        "reason": reason,
35        "cash": round(account.cash, 2),
36    }
37    with open(log_path, "a", encoding="utf-8") as log:
38        log.write(json.dumps(entry) + "\n")
39    return outcome, reason

Let's attack it with the kinds of replies a model could really give, including the one a prompt injection would want. Save this as main.py and run python main.py:

1# main.py
2import json
3
4from guardrails import Account, Limits
5from paper_agent import step
6
7account = Account()
8limits = Limits()
9
10
11def proposal(action, symbol, dollars):
12    return json.dumps({"action": action, "symbol": symbol, "dollars": dollars})
13
14
15def person_says_no(order):
16    return False
17
18
19replies = [
20    proposal("hold", "NVLT", 0),
21    proposal("buy", "NVLT", 400),
22    proposal("buy", "NVLT", 900),
23    proposal("buy", "NVLT", 5000),
24    proposal("buy", "XQZT", 300),
25    proposal("sell", "SPY", 200),
26    "Sure! I think you should buy everything.",
27]
28
29for reply in replies:
30    outcome, reason = step(reply, account, limits, approve=person_says_no)
31    print(f"{outcome:9} {reason}")
32
33print(f"Cash left: ${account.cash:,.0f}")
34
35account.positions["NVLT"] = 60  # the position fell hard, and the account is down 3.4%
36print(step(proposal("buy", "SPY", 100), account, limits, approve=person_says_no))

1hold      
2filled    
3declined  large order needs a person
4blocked   order is over the size limit
5blocked   symbol is not on the allowed list
6blocked   selling more than we own
7rejected  reply is not a valid proposal
8Cash left: $9,600
9('blocked', 'kill switch: daily loss limit reached')

Every bad reply stopped, each with a clear reason. The last line is the kill switch: once the account is down 3% in a day, it refuses everything until a person looks. And it doesn't depend on the model agreeing.

To plug in a real model, replace the fixed replies with a call. This is how our experiment asked the model, through the Claude Code command line, and any model works the same way:

1import subprocess
2
3
4def ask_model(prompt):
5    result = subprocess.run(
6        ["claude", "-p", prompt, "--model", "claude-haiku-5-5", "--tools", ""],
7        capture_output=True, text=True, encoding="utf-8", stdin=subprocess.DEVNULL,
8    )
9    return result.stdout.strip()

Notice --tools "": the model gets no tools at all. All it can do is reply with text, which then goes through step.

A small page on top of this log gives you level 3 from the ladder. This one is a local demo that we built and ran for this guide. It lists real replies from our Haiku runs next to the test cases, and it's waiting for a person to decide on a $1,000 order:

What the gate can't do: it stops the wrong kind of order, and it can't judge whether a legal order is a good idea. Those seven Haiku purchases would get through: five directly, and two with a person's approval. A gate limits the damage from a bad decision, and it doesn't make decisions good. For that, you need testing.

Backtest trap 1: the lucky rule

A backtest runs a strategy on past prices. It's the first thing people show you, and it's very easy to fool yourself with one. An agent is especially good at this, because it can try thousands of ideas in an afternoon.

Let's generate 1,000 rules that are complete nonsense: each one holds SPY only on a random half of the days of the month. We'll pick the best one from 2010 to 2019, and then see what it does afterward. For this and the next program, you need numpy and a file called spy.csv of daily prices, with the columns date and adj_close. We downloaded ours from Yahoo Finance, with prices adjusted for dividends.

1# lucky_rules.py
2import csv
3
4import numpy as np
5
6rows = list(csv.DictReader(open("spy.csv")))
7prices = np.array([float(row["adj_close"]) for row in rows])
8returns = prices[1:] / prices[:-1] - 1
9years = np.array([int(row["date"][:4]) for row in rows[1:]])
10days = np.array([int(row["date"][8:]) for row in rows[1:]])
11
12
13def annual(daily):
14    return np.prod(1 + daily) ** (252 / len(daily)) - 1
15
16
17train = (years >= 2010) & (years <= 2019)
18test = (years >= 2020) & (years <= 2025)
19rules = np.random.default_rng(2026).random((1000, 32)) < 0.5
20
21train_scores = [annual(returns[train] * rule[days[train]]) for rule in rules]
22best = rules[int(np.argmax(train_scores))]
23
24print(f"Market, 2010 to 2019:    {annual(returns[train]):.1%} a year")
25print(f"Best rule, 2010 to 2019: {max(train_scores):.1%} a year")
26print(f"Market, 2020 to 2025:    {annual(returns[test]):.1%} a year")
27print(f"Best rule, 2020 to 2025: {annual(returns[test] * best[days[test]]):.1%} a year")

1Market, 2010 to 2019:    13.5% a year
2Best rule, 2010 to 2019: 15.0% a year
3Market, 2020 to 2025:    15.0% a year
4Best rule, 2020 to 2025: 6.9% a year

A rule with no logic at all beat the market for ten years. Then it made less than half of what the market did. If you'd seen only the first decade, it would have looked like genius:

Test enough ideas, and one of them will look great by pure chance. This is called overfitting. The defense is to split your data: choose on one period, and judge on another that you touch only once. Also write down how many ideas you tried, because the best of 1,000 means far less than the best of 3.

Backtest trap 2: seeing the future

The most common bug in backtests is using information that wasn't available yet. Take a simple rule: hold SPY only after an up day. Here it is twice, and the only difference is one line:

1# lookahead_bug.py
2import csv
3
4import numpy as np
5
6rows = list(csv.DictReader(open("spy.csv")))
7prices = np.array([float(row["adj_close"]) for row in rows])
8returns = prices[1:] / prices[:-1] - 1
9years = np.array([int(row["date"][:4]) for row in rows[1:]])
10returns = returns[(years >= 2015) & (years <= 2025)]
11
12honest = np.concatenate([[0], returns[:-1] > 0])  # yesterday was up
13buggy = returns > 0                               # today is up: it peeks at the answer
14
15print(f"Market: ${np.prod(1 + returns):,.2f}")
16print(f"Honest: ${np.prod(1 + returns * honest):,.2f}")
17print(f"Buggy:  ${np.prod(1 + returns * buggy):,.2f}")

Market: $4.00
Honest: $1.47
Buggy:  $49,532.11

That's what $1 became from 2015 to 2025. The buggy version "knows" each day's result before deciding, so it never has a losing day:

Here the numbers are so silly that you'd notice. In real code, a small leak gives a strategy that looks merely very good, and that's the dangerous kind. If a backtest looks too good, assume a bug until you've proven otherwise.

The model's memory is a leak too

AI adds a new version of this trap. A model trained on data through some date has already read what happened. Ask it to "trade" 2021, and it may simply remember. We asked Sonnet 5.5 for SPY's closing price on 18 dates, from memory, with no tools and one answer per date:

With no data at all, it landed within 5% on 12 of the 18 dates. It isn't a perfect memory, as March 2020 shows, and a good sense of the general price level explains part of this. Still, it does know a lot about the past, including dates in 2026.

Researchers have measured this more carefully. One 2026 paper calls it look-ahead bias stored in the model's weights, and found that suppressing that memory cut backtest returns by up to 67% on dates the model had memorized. So a backtest over dates the model was trained on proves very little. Only dates after its training data count.

Backtest trap 3: forgetting the costs

Every trade costs something: fees, the gap between buying and selling prices, and the way your own order can move the price. Let's take two moving-average rules from 2015 to 2025, a slow one and a very active one, and vary the cost of each trade:

The slow rule hardly notices. The active rule goes from a gain to a loss, because 53 trades at 0.25% come to about 13% a year. And look at the dashed line: neither rule beat doing nothing. Agents love to trade, because each turn asks them to decide something, so always measure results after costs. Taxes on short-term gains can take another bite.

Size is what kills you

A bad prediction costs you money. Too much risk can end the game. Leverage means trading with borrowed money, so 2x moves twice as far as the market, in both directions. Here's the real path of SPY through the crash of 2007 to 2009, at four levels. This assumes rebalancing each day and free borrowing, which flatters the leveraged lines:

At 5x, $100 became 22 cents. Remember that the production fleets from earlier had a median leverage of 5x. Losses also hurt more than they seem to, because you recover from a smaller base:

Speed makes all of this worse. In August 2012, a software problem at the US trading firm Knight Capital sent more than 4 million orders in 45 minutes while it tried to fill just 212 customer orders. The firm reported a loss of about $457.6 million, and the SEC later fined it for weak controls. No AI was involved. It's simply what automated trading looks like without a working stop.

Connecting to a broker

Some brokers offer an API, and a few offer agent tools. One example is Alpaca's MCP server, which gives an AI assistant tools for market data and orders. Its paper trading mode, with fake money, is on by default. We didn't run this one, because it needs an account. Here's the idea, based on its documentation:

1{
2  "env": {
3    "ALPACA_API_KEY": "your_paper_key",
4    "ALPACA_SECRET_KEY": "your_paper_secret",
5    "ALPACA_PAPER_TRADE": "true",
6    "ALPACA_TOOLSETS": "stock-data"
7  }
8}

The last line is the important one. By default, the server turns on every tool, including placing orders. If you connect that directly to a model, you've skipped your gate, and the model holds the keys. With ALPACA_TOOLSETS set to stock-data, the model can read prices and nothing else. Orders then go through your own executor, after the gate.

A checklist for any broker connection:

• Start with a paper account, and keep its keys separate from any real ones.
• Give the model read-only tools. Keep order tools in your own code.
• Keep keys out of prompts, code and logs, as in our Key Vault guide.
• Use the broker's own limits too, if it has any.
• Use an account without margin, so the worst case is what's in it.
• Know how to cancel every open order by hand.

Rules and scams

These notes are about the US, and rules differ from country to country, so check your own regulator.

• It's your account. An agent doesn't take the blame. Orders it places are your orders, and so are the losses and the taxes.
• Managing other people's money is different. Running an agent on your own account is one thing. Doing it for others can make you an investment adviser, which is regulated.
• Day trading rules changed in 2026. FINRA's Notice 26-10 replaced the "pattern day trader" rule and its $25,000 minimum with intraday margin rules, effective June 4, 2026. Brokers may adopt it at different times, so check yours. A lower barrier isn't a reason to trade more.
• Beware of "AI trading" sales pitches. The SEC, NASAA and FINRA warn about platforms promising things like an AI that can't lose. Guaranteed returns are a classic sign of fraud. Check that a firm is registered before you send any money.

From idea to real money

If you still want to go further, every stage has to earn the next one:

Write your rules down before you start, while you're calm:

Most ideas will fail at the first or second stage, and that's the system working. A failure on paper is the cheapest lesson you'll ever get. And if the honest result is that an index fund wins, then you've just saved yourself a lot of risk and work.

Your turn: practice

Try these before peeking at the answers. Use the files from "Build the order gate", and run main.py once first.

Exercise 1: Predict the gate (warm-up). With a fresh Account and the default Limits, what does check_order return for each of these? Think first, then write code to check. (1) Buy $450 of NVLT. (2) Buy $1,500 of NVLT. (3) Buy $800 of SPY. (4) Sell $100 of NVLT.

Exercise 2: Maximum drawdown. A drawdown is the drop from a peak. Write max_drawdown(values), which returns the largest one as a fraction. Try it with [100, 120, 90, 130, 65].

Exercise 3: Cost drag. Write yearly_cost(trades, cost), which estimates how much trading costs per year. Try 53 trades at 0.10% each, and compare it with the chart.

Exercise 4: Demand a reason. Write parse_with_reason(reply), which uses parse_proposal but also returns None when the reply has no non-empty reason. An agent that can't explain itself shouldn't trade.

Exercise 5: Read the log (challenge). Write a program that reads audit.jsonl and counts how many entries had each outcome, with the most common first.

Quick quiz

1. What's an AI agent, in one sentence?
2. Which level of trust keeps your final click, while the agent does the work?
3. What's the fair test for a trading agent?
4. What's prompt injection?
5. Why isn't a limit in a prompt enough?
6. What's the one thing the order gate can't judge?
7. What's overfitting, and how do you defend against it?
8. What's look-ahead bias?
9. Why doesn't a backtest over a model's training period prove much?
10. Why is a 50% loss worse than it sounds?

Answers

Exercise 1: The first is allowed, the second is over the size limit, the third needs a person, and you can't sell what you don't own:

1# exercise_1.py
2from guardrails import Account, Limits, check_order
3
4orders = [("buy", "NVLT", 450), ("buy", "NVLT", 1500), ("buy", "SPY", 800), ("sell", "NVLT", 100)]
5
6for action, symbol, dollars in orders:
7    order = {"action": action, "symbol": symbol, "dollars": dollars}
8    print(check_order(order, Account(), Limits()))

1('allowed', '')
2('blocked', 'order is over the size limit')
3('approval', 'large order needs a person')
4('blocked', 'selling more than we own')

Exercise 2: Track the highest value so far, and the biggest fall from it:

1# exercise_2.py
2def max_drawdown(values):
3    peak = values[0]
4    worst = 0
5    for value in values:
6        peak = max(peak, value)
7        worst = max(worst, 1 - value / peak)
8    return worst
9
10
11print(f"{max_drawdown([100, 120, 90, 130, 65]):.0%}")

50%

Exercise 3: It's a multiplication, and the result is close to the chart, where the active rule went from 4.8% to minus 0.6%:

1# exercise_3.py
2def yearly_cost(trades, cost):
3    return trades * cost
4
5
6print(f"{yearly_cost(53, 0.001):.1%}")

5.3%

Exercise 4: Reuse the parser, and add one more check:

1# exercise_4.py
2import json
3
4from guardrails import parse_proposal
5
6
7def parse_with_reason(reply):
8    proposal = parse_proposal(reply)
9    if proposal is None:
10        return None
11    reason = json.loads(reply).get("reason")
12    if not isinstance(reason, str) or not reason.strip():
13        return None
14    return proposal | {"reason": reason}
15
16
17print(parse_with_reason('{"action": "hold", "symbol": "NVLT", "dollars": 0}'))
18print(parse_with_reason('{"action": "hold", "symbol": "NVLT", "dollars": 0, "reason": "No edge"}'))

None
{'action': 'hold', 'symbol': 'NVLT', 'dollars': 0.0, 'reason': 'No edge'}

Exercise 5: Each line of the log is one JSON object, and Counter does the counting:

1# exercise_5.py
2import json
3from collections import Counter
4
5with open("audit.jsonl", encoding="utf-8") as log:
6    outcomes = Counter(json.loads(line)["outcome"] for line in log)
7
8for outcome, count in outcomes.most_common():
9    print(outcome, count)

1blocked 4
2hold 1
3filled 1
4declined 1
5rejected 1

Quiz: (1) A program that uses an AI model to decide on its next step and can act through tools. (2) Level 3, propose. (3) After all costs, it beats a cheap index fund, with no more risk. (4) Outside text that tries to act as an instruction to the model. (5) A prompt is a request that a model can ignore or be talked out of, and a check in code always runs. (6) Whether a legal order is a good idea. (7) Picking something that fits the past by chance. Choose on one period, judge on another, and count how many ideas you tried. (8) Using information that wasn't available at the time. (9) The model may already know what happened, so it isn't really predicting. (10) You need a 100% gain just to get back.

Cheat sheet

Wrapping up

An AI agent can be a tireless research assistant, and a dangerous unsupervised trader:

• Agents shine at reading, watching and following your rules, and there's no good evidence yet of a reliable edge in predicting prices.
• Trust is a ladder. Most people get the most value at level 3, keeping the final click.
• The same prompt can give different decisions, so judge by many runs and not by one.
• Treat the model as untrusted. It only writes text, and plain code decides what happens.
• A gate limits damage, and it doesn't create good decisions.
• Backtests lie easily: by luck, by bugs, by the model's memory and by missing costs.
• Size decides whether you survive. Avoid leverage, and always have a stop.
• Move slowly from fake money to real money, and let the index fund be the judge.

Want to go deeper on the agent side? See how to debug with AI agents and can you trust an AI summary.