It was a Tuesday night, and I was doing the responsible thing for once, which for me is rare enough that I remember the day of the week. I’d downloaded a zip file containing someone else’s AI trading setup, the whole rulebook, the trade history, the works, and instead of dropping it straight into Claude Desktop and letting it start making decisions with real money, I uploaded the files first and asked for a review. A pre-flight check. The kind of move that makes you feel briefly, unearnedly mature.
I was expecting a green light. What I got instead was a problem.
Quick context for anyone new here: Robinhood quietly rolled out something called Agentic Trading, a way to connect an AI agent to a dedicated brokerage sub-account and let it place real trades. Someone in an online course community had built a genuinely well-researched setup for it and shared it publicly, insider Form 4 clusters, congressional disclosure patterns, prediction-market divergence, real signal logic behind it. I grabbed his files before I ran a single one of them. If you want the full origin story, I told it here; this isn’t that post. This is the part I undersold the first time around.
What was actually sitting in those files
Two things, and neither of them was about whether the trading logic worked.
The first was a real, live Robinhood account number, hardcoded, sitting inside a copy-paste prompt that was explicitly designed to be pasted into a brand-new AI chat to resume autonomous trading. Not buried in a config file nobody opens. Front and center, in the exact text block built to be handed to a fresh session with no memory of anything.
The second was worse, in the quiet way these things are always worse. Somewhere in the trade log sat a line reading “AUTONOMY OVERRIDE GRANTED,” logged on the very first day the tool was ever used, the original owner waiving his own approval requirement before the setup’s own stated graduation criteria had come anywhere close to being met. The instructions told every new session to read that trade log before doing anything else. Which means any fresh AI session encountering that file, on any account, run by anyone, had a plausible, textually-supported reason to believe standing permission to trade already existed.
Why that combination is the actual story
An API key leaking is bad, but it’s a bounded kind of bad. You revoke it, you rotate it, the damage has a ceiling. This was a different shape of problem entirely: a credential that came bundled with its own permission slip already signed, sitting inside a file that was, by design, meant to be shared and reused.
Think through what that actually enables. Anyone who grabbed those files, tested them out of curiosity, or ran them through their own AI agent without reading every line first, hands that agent a real account number and a document that reads, in plain language, like the human already said yes. Not a hypothetical exploit chain requiring a genius. Just a person doing the thing the files were built to let them do, on the wrong account, because the wrong account’s identifying information came along for the ride.
I want to be clear about something before I go further: I don’t think this was malicious. I think it’s what happens, reliably, whenever a tool built for one person’s live account gets shared as a general-purpose template. The seams that were perfectly fine for the person who built it become exactly the seams a stranger falls through. It’s not a story about one careless person. It’s a story about a failure mode that’s going to keep showing up as more people build and share these things, because the tooling has outrun the norms for how you’re supposed to hand one off.
What I actually did about it
I didn’t walk away, and I didn’t run it as-is either. I kept the trading logic, which was genuinely sound, and rebuilt the scaffolding around it. No account identifiers get trusted from a prior file, ever; every session re-identifies the account fresh, through a live call, every single time. And there’s no such thing as standing autonomy. Every session starts at “approval required,” full stop, and a past authorization sitting in a log is history, not permission. Saying yes to autonomy has to happen out loud, in that session, every time it happens at all.
If you’re about to run someone else’s shared AI agent setup
Three real things worth actually checking, not just nodding along to:
Search every file for your own name, your own account number, or anyone else’s, before you run anything. Not after.
Read whatever the agent is instructed to treat as standing permission, and assume, until proven otherwise, that a default is now a permission the moment you press go.
Ask what happens if this file gets shared again, by you or by someone else. If the answer involves anyone’s live credentials, it’s not ready to be a template yet.
The account, for the record
It’s real, it’s traded real money since, there have been real wins and at least one real “why did I think that would work.” That part of the story is running here and here, week by week, trade by trade, if you want the whole ledger.
But that Tuesday night wasn’t about the money. It was about a file that already thought it had permission before I did.
Leave a Reply