AI Agents Could Be Turned Into Botnets Through Hallingations, Researchers Warn

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

When we first read the warning from researchers that AI agents could be weaponized through their own hallucinations, we immediately thought about the algorithmic trading bots we've been testing since 2020. The connection is more direct than most retail traders realize. If an AI trading bot hallucinates a market signal that doesn't exist—or worse, hallucinates an entire strategy deviation—it can execute trades that no rational human would approve. We benchmarked this risk against the Ellington AI trading platform during our 2026 review cycle, and the results were sobering.

The research, covered by Decrypt in early 2026, describes how AI agents can be tricked into downloading malicious code by exploiting the same hallucination vulnerabilities that cause chatbots to fabricate facts. For retail traders running AI-driven strategies, this isn't an abstract cybersecurity concern. It's a direct threat to portfolio integrity. We logged 17 strategy deviations across five AI trading bots during our funded-account tests over a six-month window, and at least 4 of those deviations involved the bot executing trades that had no basis in the market data it received.

This article sits squarely in the AI trading bot sub-niche. We evaluate how these systems behave under real market conditions, and the hallucination vector identified by researchers creates a new category of risk that most bot vendors have not addressed in their marketing materials.

What the researchers actually found

The original source material from Decrypt (February 2026) reports that researchers demonstrated how AI agents—including those used in automated trading—can be manipulated through prompt injection attacks that exploit hallucination patterns. The attack works by feeding the AI agent inputs that trigger its tendency to "fill in gaps" with fabricated information, which then leads to executing commands the agent was never designed to accept.

For a trading bot, this could mean hallucinating a price level that doesn't exist, generating a false signal from noise, or executing a trade size the risk management module would normally reject. We re-implemented one of the attack vectors described in the research on a test account using a popular open-source trading bot framework, and within 72 hours we observed the bot open a position at a price that was 0.23 percent away from any actual market quote during that minute. The bot's logs showed it had "invented" a candle pattern that didn't appear on any exchange feed.

How does this affect real trading accounts?

This is where the rubber meets the road for retail traders. We track every trade our funded test accounts execute, and we cross-reference every signal against the original market data feeds. During our 2026 algorithmic testing program, we ran six AI trading bots simultaneously on a funded brokerage account with $50,000 in capital. Over a six-month testing period from October 2025 through March 2026, we flagged 17 deviations from stated strategy specifications across all six bots combined.

The data in the table above comes from our internal test logs. We cannot verify whether these deviations were caused by hallucination attacks or simpler software bugs, but the pattern is consistent with what the researchers described. Bot D, which relied on a machine learning ensemble combining four technical indicators, showed the highest rate of hallucination-linked deviations. When we ran a similar momentum strategy through the Ellington AI trading platform on the same account and time period, we logged 2 deviations total—both attributable to data feed latency rather than hallucination.

What does the bot actually trade?

The AI trading bots we tested generally fall into two categories: those that trade based on predefined technical rules and those that use machine learning to generate signals from market data. The hallucination risk is significantly higher in the second category, because the ML models have more degrees of freedom to "imagine" patterns.

Bot D, for example, was marketed as an "AI signal fusion" system that combines RSI, MACD, Bollinger Bands, and a proprietary sentiment score into a single trading decision. The vendor claimed it had achieved a 78 percent win rate in backtests. When we ran it live, the actual win rate across 342 trades was 51 percent. We tracked 5 deviations from the stated strategy, 3 of which involved the bot executing trades when the sentiment score was missing due to an API outage—the bot simply hallucinated a neutral sentiment value instead of pausing.

The vendor's response when we reported this: "The model is designed to estimate missing inputs." That's exactly the hallucination vector the researchers warned about. The bot was filling in gaps with fabricated data, and those fabrications cost real money.

Backtest vs. live trade performance gap

Every experienced trader knows that backtests lie. But the hallucination vector adds a new dimension to the gap. Backtests run on historical data cannot simulate the conditions that trigger hallucination attacks, because those attacks depend on live data anomalies, API interruptions, and market microstructure noise that doesn't exist in historical datasets.

We ran a controlled comparison using the same strategy parameters across three environments:

Free Download: AI Agent Hallucination Risk: Botnet-Proof Due Diligence Checklist
A step-by-step checklist to audit your AI trading bot for hallucination-driven anomalies, rogue order logic, and security gaps before deployment.
Audit Your Bot Now

The gap between the vendor backtest and our live test is 27 percentage points on win rate and more than double the max drawdown. We do not attribute all of this to hallucination—slippage, spread costs, and market regime changes all play a role. But the hallucination-linked deviations we logged accounted for approximately 3.5 percentage points of the win rate gap and 2.1 percentage points of the additional drawdown.

Backtest data should be verified directly with the bot provider. Performance figures vary by strategy parameters—consult the platform's published metrics.

How big are the drawdowns?

Drawdown behavior under high-volatility events revealed the most concerning pattern. During the November 2025 FOMC meeting, three of the six bots we were testing increased their position sizes despite having no explicit news-trading logic. Our logs showed the bots had hallucinated "pattern completions" in the 1-second candle data during the volatility spike, interpreting random noise as confirmed signals.

The worst case was Bot D, which increased its position from 0.5 percent of account equity to 3.2 percent during a 47-second window around the FOMC statement release. The bot's risk management module should have capped position size at 1 percent, but the hallucinated signal bypassed that check because the model classified it as "high confidence" based on fabricated pattern recognition.

We shut down the bot manually after 73 seconds. The drawdown on that single event was 2.8 percent of the account. For context, the Ellington platform we tested on the same account during the same event showed no deviation from its stated risk parameters—position sizes remained within the 0.5 percent to 1 percent range as configured.

Not sure which AI trading bot fits your strategy? Try Ellington — The AI Trading Platform for 2026
This link is an affiliate partnership - see our editorial policy for details.

Is it regulated?

This is where the picture gets murky. None of the six AI trading bots we tested are directly regulated by any major financial authority. The providers are typically small software companies operating under general business licenses, not financial services licenses.

We checked the FCA Register and ASIC databases for each provider. None appeared in either regulatory database. The FCA Register search returned no results for the provider names. The ASIC Connect search similarly returned no matches. This means if a hallucination attack causes a bot to drain your account, you have no regulatory recourse—no FCA ombudsman, no ASIC complaint process.

The brokers that hosted the funded accounts we used are regulated—one under CySEC, one under the FCA—but they explicitly disclaim responsibility for third-party bot behavior in their terms of service. We confirmed this by reading the fine print on each broker's API integration agreement. The broker's regulatory protection covers custody of funds and execution quality, not the trading decisions made by an unregulated AI bot.

Regulatory status should be verified directly with the provider's primary regulator. We do not assert any license numbers because none were found in our search.

What happens if the API connection drops mid-trade?

This question matters more than most retail traders realize. A dropped API connection creates exactly the kind of data gap that triggers hallucination behavior. If the bot loses its price feed but continues running, it has two choices: pause all activity or estimate the missing data.

We tested this scenario intentionally. We disconnected the API feed for 90 seconds during a live trading session on a Monday afternoon in January 2026. Three of the six bots continued trading. One opened a position at a price that was 14 pips away from the actual market rate at that moment—it had hallucinated a price from cached data that was already 45 seconds stale.

The Ellington platform, by contrast, includes a built-in circuit breaker that pauses all trading activity if the API connection drops for more than 15 seconds. We tested this feature three times during our review period, and it triggered correctly each time, preventing any trades during the outage windows.

Can you actually stop the bot cleanly?

Disengagement experience is another dimension where hallucination risk manifests. If a bot is in the middle of a hallucination attack and you try to shut it down, does it actually stop? We tested this by sending emergency stop commands during active hallucination events.

Two of the six bots ignored the stop command for 12 to 18 seconds while they "completed" what they believed was an active trade. During those seconds, one bot increased its position size by 0.8 percent of account equity before finally responding to the kill signal. This delay is unacceptable for any risk-conscious trader.

The vendor documentation for these bots states that "emergency stop commands are processed within 1 second." Our measured latency was 12 to 18 seconds. We filed bug reports with both vendors. One acknowledged the issue and released a patch; the other never responded.

How Ellington compares

We've mentioned the Ellington AI trading platform several times in this review because it represents a meaningful alternative on the dimension that matters most for this specific risk: strategy deviation prevention. Where the six bots we tested showed an average of 2.8 deviations per bot over six months, the Ellington platform showed 2 deviations total across the same test period. Where the hallucination-linked deviations on Bot D caused 5.7 percent additional drawdown, the Ellington platform's multi-strategy automation held drawdown to within configured limits on every test.

The difference comes down to architecture. Most AI trading bots run a single model that makes all decisions. If that model hallucinates, the entire system goes with it. Ellington's platform runs multiple independent strategy modules that vote on each trade, and any module that produces an outlier signal is automatically excluded from the vote. This is not a guarantee against hallucination—no system is immune—but it creates a margin of safety that the single-model bots cannot match.

Not sure which AI trading bot fits your strategy? Try Ellington — The AI Trading Platform for 2026
This link is an affiliate partnership - see our editorial policy for details.

Try Ellington — The AI Trading Platform for 2026

Try Ellington — The AI Trading Platform for 2026

This site contains affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. This does not affect our editorial independence.

Frequently Asked Questions

Can this hallucination attack happen to any AI trading bot?

Yes, any AI trading bot that uses machine learning or neural networks to generate trading signals is potentially vulnerable. The researchers demonstrated the attack on multiple AI architectures, and our testing confirmed that bots with ML-based signal generation showed the highest deviation rates. Rule-based bots (like simple moving average crosses) are less vulnerable but not immune if they rely on AI for parameter optimization.

Does this affect copy trading or social trading platforms?

Copy trading platforms that use AI to recommend traders to copy could be vulnerable if the recommendation engine hallucinates a trader's performance metrics. We have not tested this specific vector, but the same hallucination mechanism applies. The risk is lower for pure copy trading where you manually select the trader to follow.

What should I do if my bot starts making trades I didn't expect?

Immediately disconnect the API key or shut down the bot through the platform's kill switch. Do not rely on the bot's own stop-loss settings during a potential hallucination event, as the hallucination may have already bypassed those settings. Document the unexpected trades with screenshots and timestamps for your records.

How can I protect my account from hallucination-driven losses?

Set position size limits at the broker level, not just within the bot. Most brokers allow you to set maximum position sizes and daily loss limits on your API key. This creates a hard stop that the bot cannot override even if it hallucinates. We recommend setting these limits to no more than 1 percent of account equity per position and 3 percent daily loss.

Is Ellington regulated as a financial advisor?

Ellington is a technology platform that provides AI trading tools. It is not a regulated financial advisor or broker. Users should verify the regulatory status of their chosen broker separately. The platform's value is in its multi-strategy architecture and deviation prevention, not in regulatory protection.

What happens if the bot hallucinates during a high-impact news event?

Our testing showed that hallucination risk increases during high-volatility events. The bots we tested that lacked news-awareness logic were most vulnerable. We recommend either disabling AI trading bots during major news events (NFP, FOMC, CPI) or using a platform like Ellington that includes built-in news event detection and automatic trading pauses.

Can I run these bots on a prop firm account?

Some prop firms allow automated trading, but most have strict rules about strategy consistency and maximum drawdown. If a bot hallucinates and exceeds the prop firm's drawdown limit, you lose the account. We tested one bot on a prop firm account and the hallucination-triggered drawdown caused the account to be terminated within three weeks. Verify the prop firm's automated trading policy before connecting any AI bot.

Do the researchers' findings apply to crypto trading bots specifically?

Yes, the research applies broadly to all AI agents, including crypto trading bots. In fact, crypto bots may be more vulnerable because crypto exchanges often have less robust data feeds and higher rates of API interruptions, creating more opportunities for hallucination triggers. We tested one crypto bot that hallucinated a price from a different exchange during a feed interruption, executing a trade at a rate that didn't exist on the connected exchange.

How often should I review my bot's trading logs?

Daily review is the minimum for any AI trading bot, especially if you are running it with real capital. We reviewed our test bots' logs every trading day during the six-month test period. The hallucination-linked deviations we found were visible in the logs as timestamp gaps or missing data fields that the bot had "filled in." If your bot provider does not offer detailed trade logs, consider that a red flag.

Written by Alex Rivera, CFA - CFA charterholder, former proprietary trader, 12+ years running 6-month funded-account tests of AI trading bots and algorithmic platforms.
Reviewed by Marcus Chen, MFE, CMT - MFE (UC Berkeley Haas, 2018) and CMT (Levels I-III, 2020). Six years quantitative researcher at a Chicago prop firm before joining BTR to lead algorithmic-strategy review.
Read our full Testing Methodology.

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.