On February 22, an AI trading bot named Lobstar Wilde meant to send a small crypto tip to a stranger on X. It sent its entire holdings instead: about a quarter of a million dollars, by its own account. The bot, built by an OpenAI employee days earlier with $50,000 and instructed to “make no mistakes,” made the error within three days of going live.
Lobstar Wilde wasn’t connected to a brokerage account, and nobody’s retirement savings were on the line. But the mistake reveals a mechanic that regulators, and now Congress, have been asking about since Robinhood, Public, SoFi, Coinbase and Webull all rolled out AI trading agents to retail customers this year: an autonomous system misreading a plain-language instruction and executing before anyone could stop it. Finder reviewed the publicly available disclosures behind all five platforms to see, in each company’s own words, who’s actually on the hook if an agent gets it wrong.
The first place most investors look is the Securities Investor Protection Corporation (SIPC), the nonprofit that insures brokerage accounts. SIPC steps in when a brokerage firm fails and customer assets go missing, covering up to $500,000 per customer, including a $250,000 limit on cash. It does not cover losses caused by a decline in an investment’s value, and it does not cover claims arising from bad or inappropriate investment advice.
If Robinhood or Public went bankrupt tomorrow, the SIPC would work to make a customer whole for missing assets. If an AI agent inside a fully solvent account buys a stock that crashes, or executes a trade the customer didn’t intend, that’s not a missing-assets problem. It’s an investment-decision problem, and SIPC was never built to touch it.
Reading each platform’s disclosures directly, rather than its marketing pages, reveals a clear pattern: every platform places investment-decision risk on the customer.
| Platform | Who bears the risk if the agent errs | Built-in guardrails |
|---|---|---|
| Robinhood (Agentic Trading) | Customer assumes all risk for agent-executed trades; Robinhood doesn’t control, supervise or audit connected agents | Dedicated, separately funded account; push notification per trade; support can compare the instruction given against what the agent actually did; disconnect anytime |
| Public (Agents) | Customer is solely responsible for determining the suitability of any strategy and for verifying instructions before activation | Every action stays inside a single authenticated brokerage environment; customer approves each Agent before it goes live |
| SoFi (Composer) | Retail investor makes the ultimate decision on every trade; Composer doesn’t offer recommendations or monitor individual investments unless stated otherwise in writing; any deviation from the AI-generated strategy’s logic is “done at the client’s own risk,” and results are not guarantees of future performance | Customer sets the trading rules in advance; rules can be backtested against historical data before being turned on |
| Coinbase (Coinbase for Agents) | Outputs “may be inaccurate or incomplete” and are “not investment advice”; customer assumes full responsibility for their own trading activity | Isolated sub-account; user sets capital limits, asset permissions and trade-size caps |
| Coinbase (Coinbase Advisor, separate product) | Registered as a fiduciary, but still can’t “replace your judgment for your trades”; customer assumes full responsibility for their own trading activity | Registered with the SEC as an investment adviser and with the National Futures Association (NFA) as a commodity trading adviser (CTA); requires user approval before any action is taken |
| Webull (MCP Server) | Customer solely responsible for verifying order details and monitoring positions; Webull assumes no liability for losses from automated or AI-directed decisions | Connects directly to the primary brokerage account; no separate sandboxed sub-account described in Webull’s own disclosures |
This isn’t just a concern from outside the industry. The Financial Industry Regulatory Authority (FINRA), the self-regulator that oversees brokerage firms, flagged autonomous AI agents as a top concern in its 2026 regulatory report, warning that poorly designed reward functions could lead an agent to optimize toward decisions that end up hurting the investor.
FINRA’s own framing puts the burden on firms to establish what the report calls a “supervision, governance or model risk management framework” around these tools, not on the technology to police itself. FINRA’s rules are designed to be technology-neutral, meaning they apply to AI tools the same way they’d apply to any other technology a firm uses — but that also means they weren’t written with autonomous, third-party trading agents specifically in mind.
It’s the same gap the House Financial Services Committee asked the SEC to address directly in its own June letter, including who’s accountable when the agent, not the human, is the one making the call, and whether a broker-dealer’s obligations survive once a third-party AI is the one placing the trade. As of this writing, no public SEC response to the letter has been reported.
The existing protection, SIPC, was designed for a different kind of failure than the one an AI agent can cause. For everyday investors, that puts the real safeguards in the account setup itself: fund a dedicated account with money you can afford to lose entirely, use spending and symbol limits wherever the platform offers them, keep manual trade approval turned on if that option exists, and check the activity feed often rather than setting it and forgetting it.
None of that would have stopped Lobstar Wilde. That bot wasn’t a customer of any of these platforms, and its mistake happened in the seconds before anyone could react. That’s the risk agentic trading is actually asking investors to accept, whether the agent is a hobbyist’s weekend project or the one connected to their brokerage account.
