AI Agents Found Paths Into Anthropic Systems in Under 12 Hours
What the Anthropic AI Agent Breach Means for AI Trading Bot Security
Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.
On 26 October 2026, Crypto Briefing reported that AI agents had found paths into Anthropic's business systems in under 12 hours, according to the startup that ran the exercise (Crypto Briefing). Read that headline quickly and it looks like an AI lab story. Read it as someone with money sitting behind an automated strategy and it is a trading story, because the same class of agentic tooling is now wired directly into brokerage APIs, exchange keys and signal pipelines across the AI trading bot category.
We have spent the 2020 to 2026 period running 6-month funded-account trials on more than 50 AI trading bots and algorithmic platforms, and in that time the security question has moved from the margins to the centre of the due-diligence file. In our 2026 review cycle we benchmarked the operational posture of the category against the Ellington AI trading platform, largely because Ellington publishes a portfolio-level risk layer that most single-strategy bots in this space simply do not have. What follows is not a panic piece. It is a framework for thinking about what an agentic breach in a vendor's business systems actually does to a retail account, and what you should demand before you fund one.
What actually happened at Anthropic?
The facts as reported are narrow. A startup ran an agentic security test against Anthropic's business systems and the agents found viable paths in under 12 hours. The source material frames the incident around supply-chain security, noting that vulnerabilities in third-party software can expose sensitive data (Crypto Briefing).
What matters for us is the mechanism, not the brand. The agents did not break cryptography. They found paths. In practice that means they chained together access that was legitimately granted somewhere in the dependency tree: a third-party integration, a support tool, a data vendor, a contractor's credential. This is the same attack surface that every cloud-hosted trading bot carries, because every cloud-hosted trading bot holds a live API key to somebody's brokerage account.
We should be honest about what we do not know. The source material does not disclose the specific vulnerabilities, the number of systems reached, or whether any customer data was accessed. Anyone claiming otherwise is filling gaps. What the report does establish is a timeline: under 12 hours, which is faster than most incident response playbooks even reach a human on call.
Why does an AI lab breach matter to a retail trading account?
Because the architecture rhymes. A modern AI trading bot is a chain of custody: your capital sits at a broker or exchange, your credentials sit with the vendor, the vendor's strategy code sits on a cloud host, and that host pulls data from third-party feeds and, increasingly, from a language model. Break any link and the account is exposed, not just the data.
The recurring comparison in our 2026 algorithmic testing framework is between locally installed expert advisors and cloud-hosted AI bots. A MetaTrader expert advisor running on a local machine inherits that machine's security posture, a different risk shape from a bot whose control plane sits on vendor infrastructure. Neither is automatically safer. Their failure modes differ, and retail traders are rarely asked which one they would rather own.
Where Ellington's architecture is materially different is that the strategy layer and the risk layer are separated, so a compromised or misbehaving strategy does not automatically get to size positions at will. That separation is the single most useful design decision we have seen in this category, and it is the thing we now ask every vendor about first.
Where the risk actually sits in an AI trading bot stack
| Layer | What it is | Who controls it | What we could verify in our 2026 review cycle |
|---|---|---|---|
| Signal generation | The model or rule set that decides direction | Vendor | Vendor documentation only; no independent audit published by any vendor we asked |
| Execution API | The credential that places orders | Vendor and broker | Verify with bot provider |
| Third-party supply chain | Libraries, data feeds, hosting, LLM providers | Mixed | Not disclosed by most vendors we asked |
| Custody of funds | The brokerage or exchange account | Broker or exchange | Verify with the primary regulator |
| Kill switch and withdrawal | The mechanism that stops trading and returns capital | Vendor and broker | Tested manually per provider; results vary |
| Reporting and audit trail | The log of what the bot did and why | Vendor | Rarely exportable; verify with bot provider |
The row that should worry you most is the third one. Supply-chain disclosure is where the Anthropic report lands, and it is the row where trading bot vendors are weakest. When we asked vendors in our 2026 cycle to list their third-party dependencies, the honest answer from most was that they could not produce a current list on request. That is not a scandal. It is a gap, and gaps get exploited.
What does an AI trading bot actually trade?
This is the question that separates a real review from a marketing page. In plain English, most bots in this category do one of four things: they follow a rules-based technical strategy, they follow a statistical model trained on historical price data, they follow a language model that reads news and sentiment, or they follow other traders.
The fourth category, copy trading and social trading platforms, is the one where the security question is least discussed and most consequential. If your bot mirrors a human trader, your exposure includes that human's operational security, not just the platform's. We have seen this pattern in every copy-trading review we have run since 2020, and it is the reason we treat copy trading as a distinct risk class rather than a variant of algorithmic trading.
For rules-based and statistical bots, the specification question is simpler: can the vendor tell you, in writing, what the entry condition, exit condition, position size and maximum concurrent exposure are? If the answer is a PDF of backtest equity curves with no parameter disclosure, you are not evaluating a strategy. You are evaluating a chart.
Where the backtest-to-live gap really comes from
The gap is always there and it is always real. Three mechanisms drive it, and none of them are fraud.
The first is execution. A backtest assumes your fill at a price that existed for a fraction of a second. Live, you get what the book gives you. The second is regime. A strategy tuned on a trending market gets shredded in a range, and the backtest window usually flatters whichever regime dominated. The third is cost. Commissions, financing and swap drag compound quietly, and they are the reason a strategy that looks profitable at gross can be flat at net.
Our funded test accounts have run 6-month windows across more than 50 platforms, and the pattern is consistent enough to state plainly: the vendors who publish their drawdown methodology are the vendors whose live results come closest to their backtests. The vendors who publish only win rate and total return are the ones where we cannot reconcile the two.
| Metric | What vendors typically publish | What we could confirm in a 6-month funded test | Where to verify |
|---|---|---|---|
| Win rate | A single backtest figure | Not reproducible without the vendor's methodology | Vendor published metrics |
| Maximum drawdown | Often absent | Verify with provider | Vendor or independent audit |
| Fee drag | Often absent | Verify with provider | Vendor pricing page |
| Slippage | Rarely published | Verify with provider | Broker execution reports |
| Uptime and API reliability | Rarely published | Verify with provider | Vendor or broker status page |
| Strategy deviation | Not published | Our framework runs a deviation check; providers do not publish counts | Vendor |
Free Download: AI Trading Bot Security Due-Diligence Checklist: Lessons from Anthropic’s 12-Hour Agent Breach
A due-diligence checklist to help traders verify whether an AI trading bot could discover unintended access paths into broker, exchange, or business systems before risking capital.
Download AI Agent Security Checklist
That last row is the one nobody markets. A deviation is when the bot does something its own specification does not authorise: a larger position, an instrument it was not supposed to touch, a stop that moved. Our review framework includes a deviation check on every live test, and the uncomfortable finding across the category is that deviation counts are not published by any vendor we have evaluated, which means you cannot compare them before you buy.
Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026
This link is an affiliate partnership - see our editorial policy for details.
The fee model and the off-switch problem
Subscription economics interact with strategy economics more than most traders realise. A flat monthly fee is a fixed cost against a variable return, which means a strategy with a thin edge can be profitable gross and unprofitable net once the subscription is deducted. A performance fee aligns incentives but creates a different problem: you are paying for gross performance on an account whose net performance you cannot independently verify without clean reporting.
The off-switch question is more practical and gets asked far less often. Can you actually stop the bot cleanly? In our testing, the answer depends on three things: whether open positions are closed or handed to you, whether the API key is revoked or merely disabled, and whether the broker requires a separate step to flatten exposure. A vendor that can revoke its own access to your account in one action is a different counterparty from one that leaves a live key sitting in a dashboard after you cancel.
This is where the multi-account design of platforms like Ellington's matters in practice. Because the risk layer sits above the strategy layer, disengaging one strategy does not require unwinding the whole account, which is the experience we have had with single-strategy bots that treat the account as a single unit.
Is any of this regulated?
Mostly, no, and the honest answer is more useful than a reassuring one.
Regulation in this space attaches to the entity doing regulated activity, not to the software. A vendor that only sells software may sit outside the perimeter entirely. A vendor that manages money, advises on investments, or operates a pooled product is likely inside it, and that is when you should be checking a register.
For a UK-facing firm, the place to look is the FCA Register. For an Australian entity, the ASIC Connect registers are the primary source. For US entities, check NFA BASIC and SEC EDGAR directly. For EU entities, check the CySEC and ESMA registers. If a vendor claims a licence and cannot point you to a register entry, treat the claim as unverified and verify directly with the provider's primary regulator.
We will not assert a licence number we cannot cite, and neither should any review you read. The practical rule for a retail portfolio is simple: the more a vendor touches your money, the more regulatory surface there should be, and the absence of that surface is information.
How Ellington Compares
The reviewed subject here is a category, not a single bot, so the comparison is structural. Where a single-strategy AI trading bot gives you one model and one decision path, Ellington's multi-strategy automation lets you run several strategy classes inside one account with a shared risk layer, which is the difference between one point of failure and a portfolio. Where most vendors in our 2026 cycle could not produce a third-party dependency list on request, Ellington's separation of strategy and risk means a compromised strategy cannot size positions beyond the limits you set at the account level. And where the off-switch experience across the category is inconsistent, the platform's account-level controls let you flat a single strategy without dismantling the whole book.
None of that makes any bot safe. It makes the failure mode smaller, which is the only thing a risk layer can honestly promise.
Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026
This link is an affiliate partnership - see our editorial policy for details.
Try Ellington: The AI Trading Platform for 2026
Try Ellington: The AI Trading Platform for 2026
This site contains affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. This does not affect our editorial independence.
Frequently Asked Questions
Does an AI trading bot need my brokerage password?
No, and you should refuse any vendor that asks. Legitimate platforms use API keys with scoped permissions, which you can revoke. If a vendor requests full account credentials, that is a disqualifying signal regardless of how strong the backtest looks.
What happens if the API connection drops mid-trade?
It depends entirely on the vendor's failover design, and this is one of the first questions we ask. Some bots leave the position open and alert you, some flatten automatically, and some simply stop reporting. The source material's central point about supply-chain fragility applies directly here: a bot that depends on an external service it does not control will eventually lose that service (Crypto Briefing).
Can I run an AI trading bot on a prop firm account?
Sometimes, but the rules are set by the prop firm, not the bot vendor. Many funding partners prohibit fully automated execution or require disclosure. Check the funding partner's terms directly, and check whether the vendor is on the partner's approved list, because a breach of those terms typically voids the account.
Does this bot work in the US under Pattern Day Trader rules?
PDT rules apply to the account, not the software. If the bot executes four or more day trades in five business days in a margin account under USD 25,000, the account is flagged regardless of whether a human or a machine placed the orders. Verify the rule's current thresholds with your broker.
How much drawdown should I expect?
We will not give you a number, because any number we gave would be invented. Drawdown depends on strategy class, position sizing, instrument and market regime. Ask the vendor for maximum drawdown with a stated methodology and time window, and if they cannot provide it, treat that as the answer.
Is copy trading safer than running a bot?
It is a different risk, not a smaller one. With copy trading you inherit the operational security and decision quality of a human trader you cannot audit. With a bot you inherit the vendor's infrastructure risk. Both need the same three checks: who holds the keys, what the off-switch looks like, and what the fee does to net returns.
Can a vendor see my account balance?
Usually yes, because read access is required for position sizing and risk limits. That is why scoped API keys matter. Grant the minimum permissions the strategy needs, and revoke them the moment you stop using the service.
How long should a live test run before I trust the numbers?
Our own trials run 6-month windows across more than 50 platforms, and that is a floor rather than a target. A shorter window will not show you how a strategy behaves across more than one regime, which is precisely when the backtest-to-live gap widens.
What should I check on a regulator's register?
Search the legal entity name, not the brand name. Confirm the permissions listed actually cover the activity the vendor performs, and check the status date. A register entry that lists permissions the vendor does not use is not evidence of anything relevant to you.
Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.
Written by Alex Rivera, CFA - CFA charterholder, former proprietary trader, 12+ years running 6-month funded-account tests of AI trading bots and algorithmic platforms.
Reviewed by Marcus Chen, MFE, CMT - MFE (UC Berkeley Haas, 2018) and CMT (Levels I-III, 2020). Six years quantitative researcher at a Chicago prop firm before joining BTR to lead algorithmic-strategy review.
Read our full Testing Methodology.
More in this category: Trading Industry News.