Just tell the agent your financial goals and it automatically grows your portfolio by watching the markets and making the optimal moves. “Agentic finance” is being sold as the future of financial technology, with McKinsey projecting global agentic commerce could reach as high as $3 trillion to $5 trillion by 2030. Ask the people actually running money today, though, and the picture looks different. A Mercer survey of 131 asset managers worldwide, run in February 2026 and published in May, found 73% using AI for operational efficiency and 68% as a partner in the investment process that provides insights and analysis, but only 5% granting it autonomous or semi-autonomous decision-making authority for investment recommendations or trades.
The pitch is always the same. Replace the human with an AI model and everything gets faster, cheaper, and smarter. Machines have already taken over the majority of modern financial infrastructure, so allowing an agent to autonomously move money is framed as the natural next step. The only issue is that financial systems do not need to be intelligent, they just need to be correct.
There is a place for agents in finance, but its scope is much narrower than what is marketed. This isn’t about who’s better at deciding, it’s about whether real-time decision belongs in the execution path at all. Finance spent decades taking human judgment out of execution. High-frequency trading alone was already roughly 55% of US equity volume by 2015, according to a Congressional Research Service report citing SEC research, and the NYSE’s trading floor shrank from 1,244 equity members in 2005 to 442 in 2009. Current agentic finance narratives are proposing putting real-time judgment back into the one place the entire industry has spent decades removing it from, just swapping who or what makes the calls.
To be clear, “agentic finance” here aligns with the most commonly understood definition now, an AI model deciding, and holding the authority to execute transactions on its own. Much of modern finance already moves through digital rails that automate the same transactions reliably millions of times a day. Every time you make a transfer, you already know what to expect, since the same inputs produce the same results. This article’s claim is narrower and more specific. Replacing that deterministic, rules-based execution with a probabilistic intelligence model is where things go wrong.
The parts of agentic finance that work today are the parts where a deterministic system, not the model, holds the actual authority to move money. Wherever a model does get closer to that authority, it only survives wrapped in new hard external guardrails to keep judgment calls out of the hot path. Deterministic systems already needed guardrails of their own, for the same reason. This isn’t a temporary gap newer models will close. It follows from what a financial transaction actually requires, and what a large language model actually is.
Reliable ≠ Smart
When your life savings are on the line, you need reliability, not intelligence. Every single transaction, executed the same way, without any surprises. This has nothing to do with AI but everything to do with risk management.
In 2012, Knight Capital updated its trading software across eight production servers but missed one, whose dormant old code was then accidentally reactivated by a routine order flow. In 45 minutes, it executed millions of unintended trades across 154 stocks, took on billions in unwanted positions, and lost the firm more than $460 million. A one-line deployment mistake in a fully rules-based system running at machine speed left one of the most sophisticated firms in the business nearly bankrupt by lunch, and acquired within months.
Knight Capital’s system was never designed to adjust its own strategy in real time. It was built to execute Knight Capital’s rules at high speed, nothing else. The SEC found that Knight had left a defective, unused function in its order router and deployed new code to the same router without adequate safeguards, and its $12 million settlement in 2013 was the first enforcement action under the market access rule. The industry’s response wasn’t to make the systems smarter. It was Regulation SCI, which now requires exchanges and other core market infrastructure to prove, on an ongoing basis, that their systems have the capacity, resiliency, and availability to run safely. This means a system that does what it is told at speed and scale with zero randomness.
Code is deterministic. A language model is not.
Modern financial software, no matter how complex, is ultimately deterministic. The same inputs always produce the same outputs, every single time. This predictability allows financial strategies to be properly specified and financial systems to be fully tested before they touch any real money. Financial strategies that went through multiple rounds of manual professional review won’t be suddenly changed without approval.
Large language models (LLMs), which power modern agentic AI systems, are probabilistic. The same prompt can produce different results from one run to the next. By picking up patterns across various concepts, LLMs are able to correlate different information, which makes chatting with an agent feel so natural. But correlation isn’t causation, and that gap is exactly why agents are bad at math reasoning and can frequently hallucinate. This is a structural limitation of current agentic systems, not something that gets patched with the latest update.
This isn’t just a theoretical gap. On Vals AI’s Finance Agent benchmark v2, real financial-analyst tasks against actual SEC filings, the best model reaches just 50.88% when graded all-pass, getting every part of an answer right, against 65.40% with partial credit (leaderboard of October 29, 2026, when Vals archived v2 in favour of v2.1). The single worst-performing category is financial modeling, topping out at 34.52% for the category leader. A 2026 benchmark on SEC filings found accuracy falling by 18.6% on longitudinal tracking across reporting periods and 14.35% on cross-entity comparison, compared with single-document questions, exactly the kind of analysis a trading or lending decision requires.
Beyond accuracy, the same relationship-building ability that makes LLMs so powerful is also what makes them unsuitable for financial use cases. Putting an LLM in the execution path introduces randomness into a system that was already fully predictable. That holds across TradFi and DeFi alike, both have spent years building their own version of deterministic control, legal contracts on one side, smart contracts and oracle networks on the other. An LLM in that path reintroduces an unverifiable third party making judgment calls in place of fixed code.
Where the execution path breaks
In addition to reintroducing uncertainty into the execution path, letting an agent execute transactions also compounds failures across 3 more critical axes.
Latency
Finance runs at the millisecond scale with financial institutions willing to pay billions to save fractions of a second when trading. Instant-payment rules give a transfer seconds, not minutes. The EU’s Instant Payments Regulation requires the funds to reach the payee within 10 seconds, and India’s NPCI cut UPI’s response limits to 10 and 15 seconds from June 2025. Adding an agent in front of a transaction only adds to the existing transaction time.
Agents run on a different clock. In APort Vault, a September 2026 benchmark that ran 14 live models as a payment agent, the median run from request to completed transfer took 17.8 seconds for Claude Fable 5.1 and between 8 and 67 seconds across the 14 models, while the deterministic authorization check inside the flow took 53 milliseconds, about 0.3% of the wait. The paper’s author sells that authorization layer, and the 53 millisecond figure comes from the author’s own earlier measurement. On Vals AI’s Finance Agent benchmark the top-ranked models took from about three minutes to nearly an hour per financial-analyst task, and WildClawBench (May 2026) averages roughly eight minutes and more than 20 tool calls per long-horizon task. This means that reasoning alone already blows past the entire window an instant payment allows.
Every point is from 2025 or later. Sources are APort Vault (September 2026), Solana's Alpenglow upgrade (a finality target, activated October 21, 2026), Ethereum's docs, Vals AI (leaderboard of October 29, 2026, per task), WildClawBench (May 2026, about eight minutes on average), EU Regulation 2024/886, and NPCI's April 2025 circular.
Vendor reliability
A Statista chart of survey data collected from October 2025 to January 2026 shows 69% of surveyed financial institutions and other industry participants using OpenAI as a foundation model provider, with Google at 47% and Anthropic at 32%, since most run several third-party vendors at once rather than building their own. Wherever such models get used, this means relying on the LLM provider to ensure availability and accuracy of their service.
Payments infrastructure like Stripe reports 99.999% historical uptime on its own site, a company-reported figure with no published methodology, while a March 2026 review of provider reliability put Stripe at roughly 99.99%, about 53 minutes of downtime a year. Even against that more conservative bar, the AI providers’ own status pages, read on November 8, 2026, show OpenAI’s API at 99.97% over the past 90 days, about 2.6 hours of downtime a year and roughly 3 times Stripe, and the Claude API at 99.77% over the same 90 days, about 20 hours a year and roughly 23 times. TierZero’s review of 215-plus tracked services, covering October 2025 to February 2026, shows how much worse it gets under stress. During one measured bad stretch, OpenAI’s API components dipped to 98.89%, about 4 days of downtime a year.
Critically, a hosted model can change without the customer changing anything. In 2025, Anthropic traced weeks of degraded Claude responses to three infrastructure bugs, one of which sent as many as 16% of Sonnet 4 requests to the wrong servers in its worst hour, and admitted its own evaluations “simply didn’t capture the degradation users were reporting” (postmortem, September 2025). OpenAI rolled back a GPT-4o update in April 2025 after it turned sycophantic, conceding it had no deployment evaluations tracking the behavior (OpenAI, May 2025). Fixed code stays the same until someone changes it. Payment rails have a regulation mandating recourse, models don’t, and the vendor’s contract disclaims any guarantee at all.
Security and privacy
A code bug is something you can find, test, and fix for good. A model that’s allowed to act on its own can be talked out of following its own rules by the right content. OWASP published a Top 10 for Agentic Applications in December 2025, treating agents that plan, act, and make decisions across workflows as their own security category, and OpenAI said that same month that prompt injection, much like scams and social engineering on the web, is unlikely to ever be fully “solved”.
The newest vendor numbers show real progress and the gap that remains. Anthropic’s September 2026 system card for Claude Opus 5.5 reports that on Gray Swan’s indirect injection benchmark, which includes unintended financial transactions, an attacker succeeds 1.0% of the time within 15 attempts, down from 4.8% for Claude Opus 5, and that with its strongest safeguards on, none of the professional red-teamers’ attacks succeeded across 110 browser environments. The same card warns that fixed benchmarks can give “a false sense of security”. Against an adaptive attacker given 200 attempts per scenario, Opus 5.5 was still broken in 37 of 40 coding scenarios without safeguards and in 36 of 40 with its injection probes on, where 11.13% of attempts succeeded. Anthropic notes that real attackers usually get far fewer attempts. Researchers outside the labs found the same pattern in October 2025, bypassing 12 published defenses with attack success above 90% for most of them, defenses that had reported near-zero success. Models still process instructions and content as a single stream, with no privilege boundary between them.
The attack surface also compounds once more agents are involved. Multi-agent frameworks pass full, unredacted context between agents by default, and guardrails only filter the final output, not the internal channels. A documented CrewAI deployment, from the AgentLeak paper of February 2026, shows the pattern. A prompt-injected “compliance check” got one agent to forward a client’s IBAN and tax bracket to an external API, while the visible output stayed clean. Output-only audits miss approximately 41.7% of these internal privacy violations, and multi-agent systems carry 1.6 times the attack surface of a single agent, as the paper reports.
What does change the outcome is a deterministic check outside the model. In APort Vault, human-written attacks from a public capture-the-flag against 14 live models produced 140 unpermitted transfers in 76,842 evaluations with the model alone and none in 69,297 behind a deterministic authorization check. The choice of model did not decide whether an unauthorized payment went through, the check did. The paper’s author sells that layer.
The cost of trying to fix it anyway
With trillions of dollars pouring into AI, the industry continues to incentivize fixing the issues it introduced in the first place. Defending the four axes above means building guardrails deterministic code never needed, redaction pipelines, injection detection, retry logic for outputs that are corrupted, monitoring for a model that has silently drifted.
Critically, the costs and timelines for building an agentic system are much greater due to LLMs being probabilistic. The fact that the same prompt can produce a different but equally valid answer on every run means that software testing now requires statistical evaluation across multiple rounds, which is still less certain than a binary pass or fail. A GitLab survey of 1,528 developers and technology buyers, released in June 2026, found that among organizations that had a production incident in the past year, 34% couldn’t determine whether AI-generated code was the cause. Gartner projects that over 40% of agentic AI projects will be canceled by the end of 2027 (Reuters, June 2025), due to escalating costs and unclear business value, and its analysts put the blame on hype and misapplication rather than on the agents themselves.
That extra engineering effort competes directly with the reliability engineering the execution path actually needs, and the evidence suggests it usually loses. A 2026 Gartner survey of 782 infrastructure and operations leaders, fielded in late 2025, found only 28% of AI use cases fully succeed and meet ROI expectations while 20% fail outright, and more than half of the wins sit in IT service management. Inside finance, a May 2026 academic benchmark of agents across trading, hedging, market insights, and auditing found auditing hard even under deterministic scoring, with the best configuration reaching only 54.73% accuracy and most failures coming from calculation errors. Every hour spent on an agent’s guardrails and observability is an hour not spent hardening the execution path itself.
The above is before accounting for business costs, which only compound the problem. The majority of workflows are designed around a repeatable single purpose with predictable costs. For example, pulling financial data for an automated report can be called a million times for $3.50 on AWS’s REST API Gateway and succeeds every time. Put an agent in that flow and the bill turns variable. EY’s June 2026 whitepaper describes a customer-service chat that once cost $0.04 turning into a $1.20 orchestration once tool retrieval, planning, and subagents are added, about 30 times the cost, without succeeding every time. Paying for reasoning on every execution just to cover the rare case where judgment is required is bad economics, especially since most workflows don’t need decisions made, just consistent reliability.
The market is already converging on this with many companies finding it hard to justify the actual returns after millions and months being spent integrating agents into their workflows.
Ranked employee AI usage on leaderboards, exhausting its annual AI budget in about four months with its own executives struggling to tie the spending to value (June 2026).
A Claude deployment cost $1.8 million, 860% over its budget, with the overspend unnoticed for nearly five months (August 2026, citing the Financial Times).
Hired 350 veteran engineers, some from suppliers, after automated quality systems fell short of its quality goals, while continuing to use AI (June 2026).
Rolled voice AI out to more than 500 drive-throughs, then said it is rethinking where to use it, its technology chief saying it "might not make sense to exclusively use artificial intelligence at every drive-through" (August 2025).
A Salesforce research team found LLM agents succeed only 58% of the time on single-step tasks (June 2025).
Some calls need an owner, not a model
Agents have gotten dramatically better at engineering tasks. These problems are usually bounded, it either works or it doesn’t, and that’s exactly what current AI training rewards, a checkable right answer like a passing test or a correct equation. Much of what agentic finance is asking agents to do isn’t solvable. A financial market is made up of thousands of participants, each looking at the same information, but making their own judgment calls that change the market in real time.
A bug stays fixed but a market edge doesn’t. Trading firms guard their strategies so tightly because once others find out that it works, they will start copying it. The market edge disappears not because the strategy stops working but because the mispricing it depended on corrects itself the moment everyone discovers it. Agents make the copying automatic. In a 2026 workshop paper, LLM agents given identical market data and risk controls, with no communication at all, grew steadily more alike as the share of documents they retrieved in common rose, their pairwise action correlation climbing from 0.04 to 0.41 in minute-level crypto backtests, and average profitability did not improve. In real-time trading, an agent can’t adjust its strategy as fast as the market moves, which means it falls back to predictions.
At its core, a market is an aggregate of individual predictions about what the real value should be. Two reasonable traders can look at the same earnings report and land at different prices for a stock. Neither one is wrong, because how much something is worth is partly a matter of personal risk preference. A user can personalize an agent, but those personal preferences then require constant updating. If the agent is allowed to update a user’s strategy on its own, it runs into the same problem as above, where agents converge on the same strategy and the edge disappears.
None of this means these decisions don’t get made. Companies make them every day, a trader decides when an edge is still real, a portfolio manager decides how much risk a client should carry. It means someone has to own that call and answer for it once it’s made, and that’s exactly the judgment agentic finance proposes handing to a model instead. The market keeps moving and the trade-offs keep shifting no matter who or what is sitting in that seat, and OpenAI’s own services agreement already disclaims any guarantee that its output will meet the customer’s requirements or be accurate. The firm that put a model in that seat is left holding the call regardless. That’s a seat for a person, not a model.
Where an agent earns its place
Agents provide the most value where their unreliability is contained rather than exposed. This means crafting and maintaining the execution path rather than being inside it.
These are the roles where agents genuinely excel, without the unbounded risk of an agent handling money directly: translating a fuzzy natural-language goal into an actionable financial strategy, synthesizing a flood of market data faster than any person can track, and turning a dense execution log into something a person can actually act on. Every one of these lets a user take advantage of what an agent is good at while bounding the damage a probabilistic model can do.
OpenAI’s own 2025 guide to building agents makes essentially the same point in engineering terms. Agents are suited to workflows where traditional deterministic and rule-based approaches fall short, and “otherwise, a deterministic solution may suffice.” Most financial operations can be reduced to a fixed set of rules. That’s the whole reason deterministic finance infrastructure exists in the first place.
Where reality and the marketing diverge
Both regulators and researchers are converging on the same approach, albeit from different ends. FINRA’s 2026 Regulatory Oversight Report, released in December 2025, lists “AI agents acting autonomously without human validation and approval” among its notable generative AI risks, and every serious institution now frames this internally as copilot, not autopilot. Recent work on compliance for agentic financial systems proposes wrapping agent behavior in formally verified, mathematically proven guardrails, built with theorem-proving tools, so its actions are checked against a deterministic specification before anything executes, not evidence the model got good enough to trust directly, but an admission that its output can’t be trusted on its own.
The marketing hasn’t caught up, or is choosing not to. The market-size numbers are guesses stacked on guesses, impossible to check against what’s actually happening. Even McKinsey’s own $3 trillion to $5 trillion agentic-commerce projection for 2030 has the same problem. The “agent” label is getting slapped onto things making no real decision in what has now been called agent washing. Trading is no exception, plenty of what’s marketed as an autonomous trading agent is just a rule-based script with a chat interface bolted on, doing the same automated, threshold-triggered trading that’s existed for years.
Even Coinbase’s own products split along the same copilot-versus-autopilot line. Coinbase Advisor, a Coinbase Advisors LLC product registered with the SEC as an investment adviser and with the NFA as a commodity trading advisor, keeps a human in the loop by design, every action requires your approval. Coinbase for Agents, launched in June 2026, skips that step and lets an agent trade and pay from an isolated portfolio, with exact rules such as a maximum trade size described as coming soon. Either way, the agent can’t be fully trusted with real money on its own, both versions need extra safety tooling bolted on to contain it. The pitch deck still frames the agent as the autopilot, because the more boring copilot version doesn’t raise the round.
The honest version
The most heavily marketed version of agentic finance means a model having the autonomy to allocate and move money on its own. Held to that standard, agentic finance is a dead end. Financial infrastructure spent decades and millions of dollars learning that execution reliability is non-negotiable. A probabilistic model dropped into the same execution path doesn’t clear a bar that deterministic code was already struggling to clear. It resets the bar to zero and asks the industry to rebuild the guardrails from scratch, against a system that can be talked out of its own rules.
Every axis agentic execution was tested against converges on the same conclusion. An agent executing transactions is less reliable, too slow, less available, and easier to compromise than the deterministic system it would replace. Fixing these comes at a real and growing cost deterministic systems never had to bear. Where it’s been shipped anyway, the deterministic infrastructure does the actual work of keeping it safe, wrapping the agent in isolated accounts, spending caps, and a kill switch.
Agentic finance earns its place where an agent’s intelligence supports building and updating the execution path, not sitting inside it. An agent’s probabilistic nature lets it draw patterns across vast amounts of data and translate efficiently between natural language and code. These are genuinely valuable tools, but users still have to own the call on what’s valuable to them personally. Agentic finance can still make money management more accessible to the average person, not through automated execution, but through educating and empowering people to take control of their own finances.
