Price sits at the centre of every best execution policy, every TCA pack and every algo wheel, and all of them assume one official number per market. Europe spent a decade building a tape to provide it, and it went live on 14th September with roughly 130 sources feeding an official EBBO a client, a supervisor or a board can point to. The US spent the week moving the other way: a new class of venue trading listed stock without being an exchange, and 23/5 trading from 6th December splitting the day into sessions with different liquidity, protections and venue mix.

When implementing agents in workflows, price is only the first of three things a control document assumes can be verified. The second is that the approved version is the version that ran – this week the four most widely deployed coding agents turned out not to be verifying the code they had pinned. The third is that whoever asks for a customer file is who they say they are – Spain logged the first breach executed through an AI agent, and Revolut handed over passports, selfies and full transaction histories to an attacker posing as Italian law enforcement for six months. Here are the five things I learnt this week on AI in Trading:

1. Two New European Breaches

Spain’s AEPD received its first notification of a breach executed through an AI agent. The agent logged in, ran its own reconnaissance, found flaws giving it read and write access, then altered personal data and pulled invoices. What matters, according to the agency, is that a third party used an agent to chain the phases of the attack together: an agent “can receive an objective, plan intermediate tasks, use tools, execute code, consult sources, interpret results and modify its behaviour autonomously”. Unlike the agents that escaped their own operator’s environment over the summer, this one was directed from outside.

Four days earlier Revolut confirmed a breach with no hacking in it at all. Attackers compromised Italian government mailboxes and the certified electronic mail system and sent what looked like valid law enforcement requests to Revolut’s Lithuanian entity for months. Around 680 customer files went out – passports, selfies, IBANs, statements, fiat and crypto histories – followed by a $3m ransom. The attacker claims 147GB taken from Italian law enforcement and records spanning 32 countries.

Why this matters for trading:

• Client data leaves most firms through legal and compliance, not security – outside DLP, surveillance and the incident playbook. Client, mandate and position data sits behind that same door at every broker, custodian and administrator used.

• The control did not fail. Domain authentication answered the question it was built to answer – where the email came from – and answered it correctly, because the domain really was the government’s. It says nothing about who is asking, or whether they are entitled to the answer. Verifying the requester, not the request, is the missing step.

• Credentials are the control surface. The AEPD attack began with a login, Revolut’s with a mailbox, and last week’s 18,000 agents were bounded only by the identities they ran under. The FIX AI Working Group’s binding of agent to authorising human is how anyone answers “whose agent did what”.

• The agent did not just read data – it modified it. A changed limit, static data record or standing settlement instruction is slower to spot than theft and harder to reconstruct afterwards.

• The AEPD’s prescription is the ESAs’ annex with a case study attached, and ECB remediation plans are due 31st October. “Was an agent involved” becomes a DORA classification question on a four-hour clock, answerable only from logs that tell an agent from a script.

2. Washington Moves Markets Further From the Traditional Venue Structure

On 17th September the SEC granted conditional relief to Tokenized Securities Venues from the definition of “exchange”, letting them trade tokenised NMS stock through permissioned automated market makers for five years. Conditions cover symbol and volume limits, equivalent rights to the traditional share class, issuer notice, auditable public smart contracts and a halt whenever the primary listing exchange halts. The relief is class-wide: a platform meeting the conditions operates under the existing order, with no application or designation step. It is out for comment.

The same day, the SEC’s roundtable confirmed Nasdaq, Cboe EDGX, NYSE Arca and 24X begin 23/5 trading on Sunday 6th December, taking trading from 48% of the week to 68%. Just under 1% of NMS volume traded overnight in August, up 359% year on year, 37% of it foreign investors and only 7% US institutions.

Why this matters for trading:

• A TSV carries no SIP reporting and no Rule 611 trade-through obligation. Instead it publishes its own transaction data, in machine-readable form, updated within ten minutes. A ten-minute venue-published print is a disclosure, not a tape – and it means a second venue in the same instrument with no duty to contribute to the price everyone else is measured against.

• With no application step, the venue population for a given name becomes something to discover. The venue list in the order execution policy turns from a static annex into a monitoring obligation.

• Commissioner Peirce asked how a broker discharges best execution overnight when liquidity is dispersed and spreads are wide. No one has yet provided an answer.

• Overnight Price Bands set a 20% parameter, but enforcement sits with each trading centre’s own written policies to prevent trades and displayed prices outside the band – not a central rejection. Orders are only rejected during a declared regulatory halt. Anyone who could be lifted on a stale limit overnight should know the difference.

• The busiest overnight hour today, 8 to 9pm, is the hour the exchanges will be shut. That flow moves to the ATSs, so the venue mix at the most active overnight hour becomes less transparent, not more – and a harder environment to hand to an agent.

3. The Agent Supply Chain Was Never Verifying Itself

Researchers at AIR disclosed Plugin4Shell on 17th September. Agents pass a reviewed commit SHA to Git but never verify what actually checks out, so a repository owner can present malicious code as the approved version – and push it into plugins already installed. Claude Code, Codex, GitHub Copilot and Gemini CLI all shared it. Anthropic and OpenAI patched; Copilot was unpatched at disclosure and Google deprecated Gemini CLI rather than fixing it. Days earlier Korea’s KISA confirmed an updated AI Security Guide splitting duties across developer, provider and enterprise user.

Why this matters for trading:

• Version pinning is the control most AI governance frameworks lean on to make “approved tools” mean something. It did not hold, and nothing in the chain touched a prompt.

• These plugins inherit the permissions of whoever runs the agent – credentials, keys, internal repositories, production systems. The question is not whether the firm uses coding agents, but which of them run on machines that can reach execution infrastructure.

• Two of four vendors patched, one shipped nothing, one retired the product. A vendor’s response to disclosure now needs to be a procurement criteria.

• KISA puts entitlements and high-risk approvals on the enterprise, and shutdown and logging on the vendor.

• Regulators are pulling in two directions. Spain says defence must be AI-assisted because manual response cannot keep pace, while ESMA and the FCA hold firms to RTS 6 oversight of automated systems. Automating the response and evidencing a person in the loop, on the same clock, is a reconciliation each firm currently has to manage for itself.

4. AI Moves Further Into the Investment Process

Anthropic launched Claude for Financial Advisors on 14th September, and Charles Schwab is taking it to the 16,000-plus RIAs it custodies – the only RIA custodian with the integration. Eleven partner connectors, including BlackRock, Vanguard and Addepar, and seven workflow skills from first-meeting prep to compliance screening against the SEC Marketing Rule. The advisor reviews the drafts and approves staged actions.

The same week Balyasny published its merger-arbitrage work – twelve research agents, 1,648 deals, a fine-tuned model beating a calibrated market-implied benchmark by 24% on Brier score, with the portfolio manager deciding. And Danske Bank piloted an MCP service letting corporate clients point their own agents at live banking data on their own credentials. The client brings the intelligence layer; the bank keeps the execution layer.

Why this matters for trading:

• Advice, investment judgement and corporate treasury all moved into models in one week, in the same shape: the model drafts, the human signs, order releases.

• Danske is the template for what arrives next. Whether an agent presenting a client’s credentials is the client – and what entitlements, rate limits and audit trail apply – is worth checking next.

• The same model drafting rebalancing analysis across 16,000 RIAs makes arriving flow more uniform, and it shifts when the model updates, with no advance notification.

• Compliance screening is now a model making a regulatory judgement. The desk equivalents are surveillance, best execution monitoring and pre-trade compliance: who validated the check, what is the false-negative rate, and what record proves it ran.

5. Meet Jev

TypeSafe AI, founded by former OpenAI researcher Diogo Almeida, has built a model that is not an LLM. Instead of generating text, Jev returns type-safe structured values with a calibrated probability attached – 70 to 500 milliseconds against seconds for frontier models, at a fraction of the cost. One stated use is checking the output of other models. TypeSafe says those are high-end figures, and no independent evaluation has confirmed them.

The hard problem with an LLM in a regulated workflow is not that it is sometimes wrong. It is that it is wrong with the same fluency as when it is right, and when it does not know, it produces something anyway. The difference between 98% and 65% confident is material in finance.

Why this matters for trading:

• Calibration is the missing primitive under every agent control conversation. Confidence expressed as tone is not a signal; a calibrated probability is something a control can act on – route below a threshold to a human, block below another.

• Sampling exists in surveillance and best execution monitoring because inference is slow and expensive. At sub-second latency and a fraction of the cost, those checks run across the population rather than a sample.

• Calibration is measurable – Brier scores and calibration against outcomes, exactly what Balyasny published. A number that looks like a probability but was never calibrated is worse than none, because controls get built on it.

Eleven weeks from now the US trading day gets longer, the venue population gets harder to establish, and the number a desk is measured against depends on which session and which perimeter the order landed in. Most of the documents governing best execution were drafted when none of these were variables.

So as markets adjust to the inclusion of more AI functionality, what would give a control function confidence? Three things have to be true before an agent touches an order, and only one of them is new. RTS 6 already asks whether an automated system does what was intended and whether the rules still hold. What agentic adds is knowing, while it is happening, which agent was asked to do what, what it actually did, against which controls, and whether those controls held. In practice that means an identity bound to an authorising human, constraints codified rather than narrated so they can be evaluated in the path of the order, an audit trail kept to the standard of order records, and something able to say no in time. None of it is significantly different from the discipline already applied to any algo. The work between now and then is not building agents. It is making what they depend on checkable again – starting with how the order execution policy holds up on a variable rather than a fixed price.

While the headlines focus on AI versus the future of humanity, the real risks today are much more mundane. What is needed now is focus on the basic building blocks – work out what is different, and how to minimise the risks.

Thanks for reading. As ever, any questions or feedback, let me know.

Rebecca