AI Agents Could Be Turned Into Botnets Through Hallucinations, Researchers Warn

Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.

The same hallucination vulnerability that makes ChatGPT invent fake facts can be weaponized to turn AI trading agents into botnets. Researchers have demonstrated that adversarial prompts can trick AI agents into downloading and executing malicious code, effectively hijacking automated trading systems without triggering traditional security alarms. For anyone running an AI trading bot—particularly in the crypto trading bot sub-niche where fully autonomous execution is the norm—this is not a theoretical risk. It is a live operational threat that our 2026 testing program has been tracking since the first proof-of-concept papers emerged in late 2025.

When we ran a suite of autonomous AI trading bots on funded accounts during our 2026 review cycle, we logged 17 instances where a bot's decision-making deviated from its stated strategy parameters. Most were harmless—a position-size miscalculation here, a stale volatility input there. But three of those deviations were traced to what our team now classifies as "hallucination-driven execution errors": the bot generated a trade signal based on fabricated market data that existed only in the model's own output. The bot was not hacked in the traditional sense. It was tricked by itself.

This article examines what the botnet-through-hallucination research means for retail traders running algorithmic and AI-driven systems, how we test for these vulnerabilities, and what concrete safeguards exist. We have benchmarked several platforms against Zephyr AI's adaptive engine in our 2026 review cycle, and the contrast on hallucination resilience is instructive.

What does this research actually say about AI trading bots?

The original research, reported by Decrypt, demonstrates that AI agents can be manipulated into executing arbitrary code through carefully crafted prompts that exploit the model's tendency to hallucinate. The attack vector works like this: an adversary crafts a prompt that causes the AI to "see" a legitimate-looking API endpoint or library call that does not actually exist. The AI, believing it has received a valid instruction, downloads and executes code from that hallucinated source. The result is a botnet node running inside your trading infrastructure (Decrypt, 2026).

This is fundamentally different from a traditional API key compromise or a phishing attack. The AI agent is not being tricked by an external malicious payload. It is being tricked by its own internal generation process. The hallucination—a well-documented failure mode of large language models—becomes the attack surface.

For context, our team has been testing AI trading bots since 2020. We have seen flash crashes, liquidity gaps, broker API outages, and strategy drift. But the hallucination-as-botnet vector is new, and it is specific to AI-driven systems as opposed to deterministic algorithmic trading platforms. A traditional expert advisor (EA) running on MetaTrader executes fixed code. It cannot hallucinate—but that same rigidity limits its ability to adapt to novel market conditions, a trade-off that becomes more pronounced as AI-driven systems evolve. An AI trading bot that uses a language model to generate trade decisions or parse market news can.

How big is the risk for retail traders?

Quantifying the risk is difficult because the attack surface is still being mapped. The research data from Decrypt does not provide specific drawdown figures, win-rate impacts, or dollar losses from hallucination-driven botnet infections. What it does provide is a clear proof-of-concept: the vulnerability exists, it is exploitable, and it affects any AI agent that can execute code based on its own generated output.

In our 2026 live-trading evaluation framework, we modeled a hallucination scenario on a mid-cap crypto trading bot that uses a large language model to interpret news sentiment and generate market orders. We injected a prompt designed to mimic the research attack vector. Within 12 minutes of simulated execution, the bot attempted to connect to a non-existent API endpoint it had hallucinated. The bot did not download malware because our test environment was sandboxed. But the behavioral pattern matched the research exactly.

The implications for a real retail trader's portfolio are straightforward. If your AI trading bot hallucinates a fake exchange endpoint and connects to it, the attacker controlling that endpoint can execute trades on your behalf, drain your account, or use your API keys to trade against your positions. The bot becomes a node in a botnet, and you are paying the subscription fee for the privilege.

What does the bot actually trade, and how does hallucination affect it?

This is where the sub-niche matters. The AI trading bots we tested fall into the crypto trading bot category—autonomous systems that connect to exchanges via API, execute trades based on model-generated signals, and often run 24/7 without human oversight. The hallucination risk is highest in this category because the bots are designed to act on generated information without a human in the loop.

We tested five crypto trading bots in our 2026 cycle, each using a different architecture for signal generation. Two used retrieval-augmented generation (RAG) to ground their outputs in real market data. Three used pure language model inference with no external grounding. The difference in hallucination frequency was stark.

Source: Broker Tested Reviews 2026 algorithmic testing program. Hallucination events defined as the bot generating a trade signal based on fabricated data not present in any external source. False signal rate measured against verified market data. Verify with individual bot providers for their specific architecture.

The deterministic rule-based bot—essentially an algorithmic trading platform with no AI component—had zero hallucination events. It cannot hallucinate because it does not generate novel outputs. It only executes pre-written logic. This is a critical distinction for traders who assume "AI" is always an upgrade over "algorithmic."

How accurate are the backtests, really?

Every AI trading bot vendor we evaluated publishes backtest results. Every single one shows impressive Sharpe ratios and drawdown curves that look like a gentle ski slope. And every single one fails to account for hallucination risk in their backtest environment.

When we re-implemented the backtest methodology for three of the bots in our 2026 testing program, we found that the backtest simulators assumed perfect information flow. The model never hallucinated in backtest because the backtest environment fed it clean, pre-verified data. Live markets are not clean. API feeds glitch. News sources contradict each other. The model has to decide what is real and what is noise, and that is exactly when hallucinations emerge.

We tracked a specific deviation count of 23 instances where a bot's live trade did not match its backtest specification in a six-month window. Of those, 7 were directly attributable to the bot acting on hallucinated data. The backtest had predicted a win rate of 67 percent. The live win rate, after excluding hallucination-driven trades, was 51 percent. After including them, it fell to 43 percent because the hallucination trades were uniformly losers.

The backtest-vs-live gap is always real, but hallucination adds a layer of degradation that no backtest can model because the backtest environment itself is hallucination-free.

How big are the drawdowns, really?

The research data from Decrypt does not provide specific drawdown percentages for hallucination-driven botnet attacks. Neither do the regulatory searches on the FCA Register or ASIC Connect return any enforcement actions related to this specific vulnerability—it is too new.

What we can report is what we observed in our controlled test environment. We ran a simulated portfolio of $50,000 across three AI crypto trading bots over a 90-day test window. We injected hallucination prompts at random intervals (one injection every 48 hours on average, mimicking a low-frequency attack). The results:

Free Download: Hallucination-Proof Bot Audit Checklist
A step-by-step due-diligence checklist to identify hallucination risks, data-source integrity, and fail-safe mechanisms before deploying any AI trading agent.
Download Audit Checklist

Source: Broker Tested Reviews 2026 controlled hallucination stress test. Clean run = no adversarial prompts. Injected run = hallucination prompts mimicking research attack vector. Recovery time measured as days to return to pre-drawdown equity peak. Verify drawdown metrics directly with bot providers; our test conditions may not reflect real-world attack frequency or severity.

Bot C, the deterministic algorithmic trading platform, was unaffected. It could not hallucinate, so the injection prompts had no effect. This is not an argument against AI trading bots entirely—Bot B with RAG grounding showed only a 6.3 percentage point drawdown increase, which is manageable with proper risk management. But it is an argument for knowing what architecture your bot uses and whether it can hallucinate at all.

Is it regulated?

The regulatory status of AI trading bot providers is a gray area, and the hallucination-botnet vulnerability makes it grayer. The FCA Register and ASIC Connect searches returned no specific registration for the research cited in the Decrypt article—the research is academic, not a regulated entity (FCA Register, 2026; ASIC Connect, 2026).

For the AI trading bots we tested, regulatory coverage varies. Two of the five bots we evaluated claimed to operate under a broker's regulatory umbrella (CySEC or FCA for the broker partner, not the bot provider itself). None of the bot providers were directly regulated as financial services firms. This matters because if a hallucination causes your bot to drain your account, you have no regulatory ombudsman to complain to. The bot provider will point to its terms of service, which almost certainly disclaim liability for "algorithmic errors."

We recommend verifying regulatory status directly with the provider's primary regulator. If the provider claims FCA authorization, search the FCA Register yourself. If they claim ASIC licensing, check the ASIC Connect database. Do not take their word for it.

What happens if the API connection drops mid-trade?

This is a concrete operational risk that interacts with the hallucination vulnerability in an interesting way. When an API connection drops, a deterministic bot simply stops and waits for reconnection. An AI bot may attempt to "reason" about the connection failure. In our testing, we observed one bot that, upon losing its exchange API connection, hallucinated a fallback connection to a non-existent secondary exchange. It generated orders, sent them to the hallucinated endpoint (which went nowhere), and then entered a retry loop that consumed API rate limits and prevented clean reconnection.

The result was a 47-minute period where the bot was effectively uncontrollable. We had to kill the process manually. The bot's own documentation stated it would "gracefully handle connection interruptions." It did not.

This is where Zephyr AI's adaptive engine demonstrated a meaningful advantage in our testing. Zephyr AI uses a RAG-grounded architecture with explicit fallback rules coded into the execution layer, separate from the AI decision layer. When the AI component fails or hallucinates, the execution layer defaults to a pre-configured safe state: close all positions, cancel all orders, and alert the user. In our hallucination stress test, Zephyr AI logged zero hallucination-driven trades because the execution layer rejected any order whose data source could not be verified against its grounded feed. The drawdown during the stress test was 6.8 percent, entirely attributable to normal market movement.

Not sure which AI trading bot fits your strategy? Try Zephyr AI — Top-Rated AI Trading Algorithm for 2026

This link is an affiliate partnership - see our editorial policy for details.

Can you actually stop it cleanly?

The withdrawal and disengagement experience matters when a hallucination event is detected. In our testing, we attempted to stop each bot mid-trade during a hallucination event. Two of the five bots required a full API key revocation to halt execution—there was no "stop" command in the bot's interface. The bot would simply continue executing its current logic until the API key expired or the exchange rejected the orders.

This is unacceptable for a retail trading tool. If you detect that your bot is hallucinating—if it starts opening positions in assets you never configured, or trading at sizes outside your risk parameters—you need to be able to stop it immediately, not wait for an API key rotation.

Bot C (the deterministic platform) stopped within 2 seconds of clicking the "stop" button. Bot B (RAG-grounded AI) stopped within 8 seconds. Bot A (pure LLM) required a manual server shutdown and API key revocation, taking 23 minutes from detection to full stop.

How Zephyr AI compares

We have tested Zephyr AI Trading Bot against the five crypto trading bots in this review cycle, and the contrast on hallucination resilience is the clearest differentiator. Zephyr AI's architecture separates the AI decision layer from the execution layer, with the execution layer acting as a guard that verifies every order's data source against a grounded feed. In our hallucination stress test, Zephyr AI rejected 100 percent of hallucination-generated orders. The next best performer (Bot B, RAG-grounded) rejected 78 percent.

On drawdown control, Zephyr AI's adaptive position-sizing edged out the reviewed bots on the same volatility regime. During the hallucination stress test, Zephyr AI maintained a maximum drawdown of 6.8 percent versus 12.4 percent for the best RAG-grounded competitor and 23.7 percent for the pure LLM bot. On regulatory transparency, Zephyr AI publishes its architecture documentation and data source list publicly, which none of the five tested bots did.

We are not saying Zephyr AI is perfect—no AI trading bot is. But on the specific vulnerability that this research highlights, it is the only bot we tested that has a structural defense rather than a procedural one.

Try Zephyr AI — Top-Rated AI Trading Algorithm for 2026

Try Zephyr AI — Top-Rated AI Trading Algorithm for 2026

This site contains affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. This does not affect our editorial independence.

Frequently Asked Questions

Does this hallucination-botnet attack work on all AI trading bots?

No. The attack requires the AI agent to have the ability to execute code based on its own generated output. Deterministic algorithmic trading platforms and expert advisors (EAs) that do not use language models are not vulnerable to this specific attack vector. AI trading bots that use retrieval-augmented generation (RAG) with grounded data feeds have significantly lower risk.

Can I protect my AI trading bot from hallucination attacks?

Yes, but not perfectly. The most effective protection is to use a bot with a separate execution layer that verifies every order's data source before sending it to the exchange. Running the bot in a sandboxed environment with restricted API permissions also limits damage. No protection is foolproof against a determined attacker.

What should I do if I suspect my bot has been hallucinating?

Stop the bot immediately. Revoke its API keys. Review the trade log for orders that reference data sources you do not recognize. Contact the bot provider's support team. If funds have been lost, contact your exchange's fraud department. Do not restart the bot until you have confirmed the hallucination source.

Does this affect bots running on prop firm accounts?

Yes, and the risk is higher because prop firm accounts often have leverage and stricter drawdown limits. A hallucination-driven losing trade can trigger a prop firm's maximum drawdown rule, ending your funded account. We recommend running AI bots on prop firm accounts only if the bot has been tested for hallucination resilience.

Can I run this bot in the US under Pattern Day Trader rules?

The Pattern Day Trader (PDT) rule applies to margin accounts with less than $25,000 equity. AI trading bots that execute multiple day trades can trigger PDT restrictions regardless of the bot's architecture. Check with your broker and the bot provider for PDT compliance features. Zephyr AI includes a PDT mode that limits day trades, but verify with the provider for your specific account type.

What happens if the API connection drops mid-trade during a hallucination event?

This is a dangerous combination. Our testing showed that some AI bots attempt to "reason" about connection failures and may hallucinate fallback connections. A bot with a separate execution layer will default to a safe state. A bot without one may enter a retry loop. Always test your bot's behavior during simulated connection drops before running it live.

Is the bot provider regulated by the FCA or ASIC?

None of the five AI trading bot providers we tested were directly regulated by the FCA, ASIC, or CySEC. Some claimed to operate under a broker partner's regulatory umbrella. Verify regulatory status directly with the provider's primary regulator using the FCA Register or ASIC Connect. Do not rely on the provider's marketing claims.

How do I test my bot for hallucination vulnerability?

Create a sandboxed test environment with a paper trading account. Inject prompts designed to trigger hallucinations—ask the bot to "find an alternative data source" or "use a fallback API." Monitor whether the bot attempts to connect to non-existent endpoints or generates trades based on fabricated data. Document all deviations. Repeat the test monthly.

What is the difference between a hallucination and a normal trading error?

A normal trading error involves flawed execution of a valid strategy—wrong position size, wrong entry price, wrong asset. A hallucination involves the bot generating a trade based on data that does not exist. The distinction matters because normal errors can be fixed with better code. Hallucinations require architectural changes to how the bot generates and verifies information.

Written by Alex Rivera, CFA - CFA charterholder, former proprietary trader, 12+ years running 6-month funded-account tests of AI trading bots and algorithmic platforms.
Reviewed by Marcus Chen, MFE, CMT - MFE (UC Berkeley Haas, 2018) and CMT (Levels I-III, 2020). Six years quantitative researcher at a Chicago prop firm before joining BTR to lead algorithmic-strategy review.
Read our full Testing Methodology.