Does Your AI Trading Agent Still Remember Its Own Risk Limits by the Afternoon?

Brokers opened accounts to trading agents

Since June 1, Interactive Brokers has let clients drive their accounts through Claude across more than 170 global markets, with every order landing in a tab a human has to approve. Robinhood and eToro opened similar doors. By early June, as Finance Magnates reported on June 8, at least ten retail brokers had wired agents into live client accounts, and one model, Claude, was named in nine of the ten. The mainstream coverage has started to land on a useful line, captured by Bitsgap this week, that a smarter agent is not automatically a safer one. So the decision in front of us is narrower and stranger than “does it pick good trades.” By two in the afternoon, does the agent still hold the risk limits we gave it at nine thirty?

What an AI agent for stock trading actually keeps in memory

The brokers built their safety story around one gate: a person signs off on each order. IBKR brands it “Informed by Agentic Technology, Controlled by the Client.” Robinhood ring-fences a separate funded account and adds a one-tap kill switch, while stating plainly that it does not control, supervise, monitor, recommend, or audit these agents. eToro lets an outside agent trade a sandbox from a $200 budget through a scoped key. All of that caps the blast radius if something goes wrong. None of it tells us what the agent is still thinking. The approval screen shows one proposed trade. It does not show whether the agent still remembers the three rules we set before the session began, or why it wanted the trade in the first place.

How context-window eviction narrows the mandate

Here is the part the product pages skip. A language-model agent has a finite working memory, called its context window. The mandate we type at the open, something like “large caps only, no more than 5% in one name, stop adding after a 10% drawdown,” is not a saved setting. It is conversational text, sitting in that window next to streaming quotes, tool results, and the connector’s own instructions. The connector standard the brokers use to reach an account, formally called Model Context Protocol, is not free to hold in memory either, and that matters because it crowds out the mandate.

As the session runs, the window fills. Most systems handle the overflow the same way, by silently dropping the oldest text first, and the oldest text is often the mandate. As one engineering guide put it, important information can be dropped without errors, leading to incomplete or misleading outputs. No alarm fires, and the agent keeps answering with total confidence. Worse, the model degrades simply from length, well before anything is dropped.

Enforce limits at the broker, not in chat

1. Put the limits where the model cannot forget them

   A funded sub-account, a per-trade budget, and the kill switch are enforced by the broker, not by the agent's memory. Treat the chat instructions as a preference, not a guardrail.

2. Keep sessions short

   Restart the agent daily, or after a few hours, so the mandate stays near the top of a fresh window rather than buried under an afternoon of data.

3. Prefer setups that re-state the rules every turn

   A pinned system prompt or a short written rules file beats typing the mandate once and hoping it survives the session.

4. Treat each approval as a fresh decision

   Re-read the proposed trade against your own rules, because the agent may no longer be checking against them.

5. Ask the tool one question

   When the window fills, does it truncate or summarize, and does it log it? If no clear answer comes back, assume silent truncation.

The agent that forgets a rule does not warn us. It keeps trading, fluently, and the only check left is the person clicking approve.

Why FINRA's agent risks hide in context eviction

The brokerage industry’s self-regulator, FINRA, already named the risks that bite here: agents acting beyond the scope they were granted, and decisions that are hard to audit after the fact. Context eviction is both at once. It quietly narrows the scope the agent remembers, and it leaves no trace that the narrowing happened. The reassuring part is that the fix is dull and entirely in our hands: shorter sessions, account-level caps, and the habit of reading each order as if the agent had no memory at all. Which, by the afternoon, it half does.