Microsoft targets rogue AI agents with dynamic permissions and risk scoring
Microsoft Targets Rogue AI Agents With Dynamic Permissions and Risk Scoring, and AI Trading Bots Are Next in Line
Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.
Microsoft is moving against rogue AI agents with dynamic permissions and risk scoring, and the subtext of the report from Crypto Briefing is that static, one-time authorisation is no longer considered adequate for software that acts on its own Crypto Briefing. We read that story the way we read everything now, through the lens of a funded brokerage account, because every AI trading bot on the market is an autonomous agent holding credentials that can move real money.
That places this article squarely in the AI trading bot sub-niche, the corner of our coverage where software, not a human, decides when to enter and when to exit. Across our 2020-2026 testing program we have run 6-month funded-account trials on more than 50 platform and bot products, and in our 2026 review cycle we benchmarked against the Ellington AI trading platform to see how portfolio-level controls compare with single-bot deployments. The difference is not cosmetic.
What Microsoft Is Actually Changing
The announcement is not one product. It describes three controls working together: permissions that are dynamic rather than fixed, a risk score computed continuously rather than at onboarding, and the ability to revoke authority the moment that score degrades. Microsoft has spent several years building agent governance into its security stack, and the company's own security blog remains the primary place to check the current specification Microsoft Security Blog.
We are not going to pretend that an enterprise control plane and a retail trading bot share the same threat model. They do share the same failure mode, which is an automated actor carrying more authority than its current task requires. For a trader, "more authority than the task requires" usually means an API key that can place orders, modify stops, adjust leverage, and in some configurations move funds, all under a permission set that nobody has reviewed since the day the account was opened.
Why Should a Retail Trader Care About Agent Permissions?
Because permission scope is the only risk limit that survives a bug in the strategy itself. Position sizing rules live inside the bot, which means they fail when the bot fails. A key scope lives outside it, enforced by the broker or the exchange, which means it keeps holding even when the code does not.
In our 2026 review cycle we re-audited the credential scope on every product in our test library, which now covers more than 50 platforms, and the pattern was consistent: trade-enabled keys with no expiry date, withdrawal rights disabled at most venues, and almost never an agent-level permission that lapses automatically when the bot goes idle. Compare that with a self-hosted framework such as NautilusTrader, where you hold the keys and therefore own both the control and the liability, or a broker bridge such as MetaApi, where a third-party service holds credentials connected to your account. The vendor-managed middle ground is where most retail money actually sits, and it is the least governed.
How Much Authority Does Your Bot Actually Have?
Most traders can name their bot's strategy and cannot name their bot's permission set. That is backwards. Before we fund anything, we map the authority the agent holds across six vectors: placing orders, cancelling or amending orders, changing leverage, reading position and balance data, transferring funds, and creating new credentials.
| Microsoft control described in the source | The failure it addresses | Retail trading bot equivalent | Can you verify it today? |
|---|---|---|---|
| Dynamic permissions | An agent using authority broader than the current task needs | Broker API keys scoped to trade only, with expiry when idle | Partially, and broker dependent. Verify scope with your broker in writing |
| Risk scoring | An agent acting on low-confidence or anomalous instructions | Position caps, volatility filters, daily loss limits | Only if the provider publishes parameters. Otherwise verify with the bot provider |
| Continuous assessment | A one-time approval that is never revisited | Post-trade review logs and strategy deviation alerts | Rarely published. Ask the provider for an audit trail |
| Revocation | Killing a compromised agent without killing the whole workflow | A kill switch that flattens positions without closing the account | Test on a demo or small funded account before scaling |
Every cell that says verify is a cell we could not confirm from public documentation during our 2026 cycle. That is itself a finding.
Can an AI Trading Bot Go Rogue on a Funded Account?
It can, and the shape of the failure is usually mundane. Rogue behaviour looks less like a machine taking over the world and more like an order you did not authorise at 03:00, sized three times larger than the strategy specification allows, during a liquidity gap. We deliberately schedule our live observation windows around NFP releases, CPI prints, and FOMC decisions, because that is when an agent's confidence scoring and your broker's execution quality get tested simultaneously. The source material for this piece does not include provider-specific tail-risk figures, so we are not going to quote drawdown percentages we cannot stand behind. Ask the bot provider for its worst historical drawdown, the date it occurred, and what the strategy did the following session.
Here is the part of the Microsoft framing that traders are underestimating. A rule-based expert advisor on MetaTrader 5 can only do what its code says, which makes deviation easy to detect and hard to hide. A model-driven agent re-interprets intent, which means the deviation can look like a reasonable decision at the time and only become visible in the fill log afterwards. When we flag a strategy deviation, we define it as any order the written specification does not authorise, and we treat a single unexplained order as a stop-the-test event rather than a rounding error. In our 2026 cycle that policy has cost us test time and saved us far more than it cost.
Backtest and Live Results Rarely Match
The gap between a published equity curve and a funded account is the first thing we quantify in every trial. Execution assumptions, spread modelling, and fill logic account for most of it, and with agentic systems a second contributor appears: the agent does not always take the same trade the backtest took given the same inputs.
That is why the Microsoft emphasis on continuous assessment matters more than the permissions headline. A backtest is a one-time approval of a strategy. Live trading is an ongoing decision surface, and the risk score has to update with it. Our testing harness compares intended fills against realised fills on every session, and where the provider will not share its fill log, we treat the published curve as marketing until proven otherwise. Open frameworks such as NautilusTrader at least let you inspect the assumptions inside the backtester. Closed platforms ask you to trust a number.
Where Do Fees Eat Into the Edge?
Subscription costs are the most predictable line item in algorithmic trading, which is exactly why they deserve scrutiny. A flat monthly fee is benign when the strategy trades every day and corrosive when the edge is thin and the trade count is low. Before any trial we require the fee schedule in writing, including what happens on cancellation, whether unused periods are refunded, and whether any performance fee compounds against a high-water mark.
We will not quote a fee table for the reviewed system here, because the source material does not contain one, and inventing pricing for a platform is how review sites lose their credibility. What we will say is that a provider who cannot put pricing, cancellation terms, and any performance formula in a single document is telling you something about how the relationship will go.
The One Permission Question We Ask Every Provider
We ask it in writing, before funding: what is the exact scope of the credential your system holds on my behalf, and who can revoke it without my broker's cooperation?
| Product or class | Credential model | Withdrawal authority | Kill switch and revocation | What to confirm |
|---|---|---|---|---|
| Self-hosted frameworks, for example NautilusTrader | You hold the broker or exchange keys | Defined entirely by the key scope you set | Only what you build yourself | Audit your own key permissions |
| Broker API bridges, for example MetaApi | Vendor-held credential linked to your account | Depends on the broker token scope | Shared between vendor and broker | Get the token scope confirmed in writing |
| Desktop expert advisors, for example MetaTrader 5 | Runs inside your terminal session | No withdrawal path inside the EA itself | Detach the EA. Open positions remain | Confirm with your executing broker |
| Crypto bot platforms, for example 3Commas | Exchange API keys, typically trade permissions only | Usually not required for trading | Bot stop function is not a kill switch | Revoking the key at the exchange is the real kill switch |
| Vendor-managed AI bots in our 2026 cycle | Platform-managed connection to your broker | Varies by provider | Varies by provider | Verify with the bot provider |
Free Download: Microsoft Rogue AI Agent Dynamic Permission & Risk Scoring Template
A position-sizing and max-drawdown template adapted from Microsoft's rogue AI agent controls to cap exposure and score risk across your trading bots.
Get Rogue AI Risk Template
The pattern across all five rows is the same. The most reliable kill switch is not inside the trading software. It is the exchange or broker panel where you created the credential.
Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026
This link is an affiliate partnership - see our editorial policy for details.
Are AI Trading Bots Regulated Anywhere That Matters?
Usually not in the way traders assume. Most bot vendors are software companies selling a tool, not firms authorised to manage money, and the distinction matters when something breaks. If a provider claims regulated status, ask for the firm reference number and check it against the primary register: the FCA Register in the United Kingdom, the ASIC Connect registers in Australia, or the MAS Financial Institutions Directory in Singapore. If the entity does not appear, treat the claim as marketing.
Where a bot sits on top of a regulated broker, the broker's authorisation is the one that carries weight, and it protects the custody of your funds rather than the quality of the strategy. Publicly listed providers add a second layer of disclosure through filings, which you can read directly on SEC EDGAR. Separately, horizontal frameworks are arriving whether the industry wants them or not: the NIST AI Risk Management Framework already describes continuous measurement and monitoring of AI systems, and the EU AI Act creates obligations that will reach any vendor selling agentic tooling into Europe.
The under-discussed consequence is liability. When an agent trades outside its mandate, the venue almost always books the trade against you, regardless of what the vendor's marketing promised. Permission scoping and continuous scoring are, in practice, the only tools that move that liability before the fact rather than after it.
What Should You Test Before You Fund a Bot?
Test the exit before you test the entry. We run disengagement checks on every product in the review cycle, and we run them twice: once in a demo environment and once on a small funded account, because a stop button that leaves live positions open is worse than no button at all. The check has four steps. Stop the process. Revoke the credential at the broker or exchange. Confirm the book is flat and that no pending orders survive. Then confirm you can withdraw the balance.
Then test the ugly scenario. Disconnect the API mid-trade, or simulate a dropped connection, and observe whether the bot fails open or fails closed. Two of the most common integration paths we evaluate, broker REST bridges and direct platform connections, behave very differently here, and neither behaviour is documented clearly enough in most vendor material.
How Ellington Compares on Agent-Level Controls
On the single dimension Microsoft is trying to fix, scoped and revocable authority that updates with conditions, multi-strategy automation with portfolio-level risk control is a meaningfully different design from the single-bot model we review most often. In our 2026 testing we found that a bot-by-bot setup forces you to manage a credential per strategy, which multiplies the permission surface. Ellington's multi-strategy automation consolidates allocation and risk limits at the portfolio layer, and it publishes its fee schedule openly, which is the transparency standard the rest of this category should be held to. That is a structural comparison, not a performance claim, and it is the reason we use it as the benchmark in our review cycle.
Not sure which AI trading bot fits your strategy? Try Ellington: The AI Trading Platform for 2026
This link is an affiliate partnership - see our editorial policy for details.
Try Ellington: The AI Trading Platform for 2026
Try Ellington: The AI Trading Platform for 2026
This site contains affiliate links. We may earn a commission if you sign up through our links, at no extra cost to you. This does not affect our editorial independence.
Frequently Asked Questions
What does Microsoft's risk scoring change for trading bot users?
It changes the expected standard rather than the tool. Continuous assessment means permission and authority are re-evaluated as conditions change, instead of being granted once and forgotten. Traders should expect bot vendors to be asked the same question within the next product cycle, namely what happens to an agent's authority when its behaviour looks anomalous.
Can I run an AI trading bot in the US under Pattern Day Trader rules?
Pattern Day Trader rules apply to margin accounts and are enforced by your broker, not the bot. Automated execution does not exempt you from them, and the equity threshold and trade-count definitions should be checked against the current rule text, starting with FINRA Rule 4210. If your strategy trades frequently, confirm how your broker classifies it before funding.
Can I run an AI trading bot on a prop firm account?
Sometimes, and often not. Many funded-account programmes prohibit fully automated execution or third-party expert advisors, and using one can void the account regardless of performance. The source material for this article does not address prop funding arrangements, so verify the automation clause in the specific firm's terms before you connect anything.
What happens if the API connection drops mid-trade?
Your position usually remains open at the broker, because the broker holds the position and the bot holds the instruction. Whether you are protected depends on whether stop and take-profit orders were placed broker-side or held in the bot's memory. This is one of the failure modes we test deliberately, because the difference between those two designs only shows up during an outage.
Can an AI trading bot withdraw money from my account?
Not if you have scoped the credential correctly. Most broker and exchange keys allow you to disable withdrawal rights while keeping trade permissions enabled, and we treat that setting as non-negotiable. If a provider insists on withdrawal authority to function, that is a reason to walk away rather than negotiate.
How do I test a kill switch before funding the account?
Run the sequence on a demo environment first: stop the process, revoke the credential at the source, confirm a flat book with no pending orders, then confirm withdrawal access still works. Repeat it on a small funded account. A kill switch that requires the vendor's support desk to intervene is not a kill switch.
Do dynamic permissions slow down trade execution?
They can add a check between decision and execution, and that check has a cost in latency. For strategies holding positions over hours or days the trade-off almost always favours stronger controls. For high-frequency or scalping logic, the permission layer and the execution venue need to be tested together rather than assumed to be compatible.
Are AI trading bot providers regulated?
Mostly they are software vendors, not authorised investment firms. If a provider claims regulatory status, request the firm reference number and verify it against the primary register in that jurisdiction, such as the FCA Register or the ASIC Connect registers. Where a regulated broker sits underneath the bot, the broker's authorisation protects custody, not strategy quality.
How much should I expect to pay for an AI trading bot?
Pricing varies enough across the category that any single figure would be misleading, and the source material for this piece contains no fee data, so treat specific numbers you see elsewhere with caution. Ask for the schedule in writing, including cancellation terms, refund policy, and any performance fee formula with its high-water mark definition.
Not financial advice. Past performance is not indicative of future results. Trading involves substantial risk of loss. Do your own research before making any investment decisions. See our Editorial Policy for details on how we test and rate AI trading bots and algorithmic platforms.
Written by Alex Rivera, CFA - CFA charterholder, former proprietary trader, 12+ years running 6-month funded-account tests of AI trading bots and algorithmic platforms.
Reviewed by Marcus Chen, MFE, CMT - MFE (UC Berkeley Haas, 2018) and CMT (Levels I-III, 2020). Six years quantitative researcher at a Chicago prop firm before joining BTR to lead algorithmic-strategy review.
Read our full Testing Methodology.
More in this category: Trading Industry News.