We Gave Claude $500 and a Brokerage Login.

It followed every rule we gave it, and I still can’t explain a single thing it bought.

On Tuesday last week, I moved $500 into a Robinhood Agentic Account, pasted one URL into an MCP config, and watched Claude place its first live stock order about four minutes later.

The account is a real brokerage account, the order was a real order, and the only thing standing between a language model and the market was a config file I edited in a text editor. By Friday it held four positions, and I couldn’t reconstruct the reasoning behind a single one of them.

Taking a step back, this only exists now because every retail broker decided, roughly at once, that language models should be allowed to trade:

• Robinhood opened Agentic Trading on May 27 and extended it to crypto in July

  • Apparently, more than 50,000 customers connected an agent within weeks of launch, with daily volume in the millions.

• Coinbase shipped an MCP server for agent trading back in June

• eToro says its Tori assistant has crossed 500,000 trades across everything from equities to FX.

With so many attention-grabbing headlines, it naturally begged the question of whether this wave brings a genuinely useful research tool or just a slow-motion margin call.

So, I spent the week finding out.

MCP This, MCP That

Put simply, an MCP server is just a menu.

It tells the model, in a machine-readable format, which tools it may call: fetch a quote, list positions, check buying power, place an order, cancel one.

The model reads the menu, reasons about what it wants, and emits a tool call, and the broker’s server executes it against your account like any other API request. That’s the entire integration, which is why setup takes four minutes and why 50,000 people did it.

The guardrails, in every one of these launches, are variations on the same three ideas:

• A dedicated account holding only the money you’ve reserved for the agent

• A push notification on each trade

• A disconnect button in the app.

Robinhood’s own terms are admirably direct about where their responsibility ends, stating that the company “does not control, supervise, monitor, recommend, or audit” the agents you connect. You pick the model and write the prompt, so you own the outcome.

The budget cap constrains how much the agent can lose, but nothing anywhere constrains how it loses it: there’s no order-type restrictions, no position limits, no drawdown stop, and no rule about turning the whole account over eleven times a day (chart below).

Where It Actually Breaks

I’ve been running variations of this harness privately for a while, well before brokers made it a product, and the failure modes are consistent enough that I can rank them.

Surprisingly, the model’s stock-picking ability barely makes the list.