cs.CROct 16, 2026

Unbounded Losses, Unchecked Inputs: Measuring the Safeguards of LLM Options-Trading Agents

Authors: Mengxiao Wang, Nitesh Saxena

Organizations: Texas A&M University

Read PDF
Ask AI
Cite

Copy citation

DOINot available for this paper

Abstract

Large language model (LLM) agents now place options orders at retail brokers, and developers publish open-source options agents faster than anyone has examined them. Prior security work on trading agents scored academic equities designs by whether an attacker can flip a buy-or-sell decision. We present the first measurement of the options agents that brokers and developers ship, scored by the safeguards they enforce and by the worst loss their documented order paths can reach. We screened 765 GitHub repositories, broker documentation, and the research literature and found 215 eligible repositories and 8 broker-native agent interfaces. We then scored 26 systems, including every broker interface and every open-source project with at least 20 stars, on seven robustness and eleven security safeguards with cell-level evidence. The ecosystem is new: 198 of the 215 repositories were created in 2026, and 129 (60.0%) appeared in the two weeks around one options-trading hackathon. Of the 22 systems that can place orders, 10 enforce a pre-trade limit outside the model, yet none of the 26 authenticate their text sources or cross-check market data. Of the 26, 17 can execute with no mandatory human step and 13 can reach unbounded loss, including 6 of the 8 broker interfaces. Because an attacker who writes the agent's inputs can move an order's strike, expiry, volatility, and legs while its direction stays correct, options agents need loss limits enforced at the order boundary.

Figures & tables

Figure 1: Attack path and the safeguards we measured. Top: an attacker who writes text into the agent’s inputs (S1–S3) moves four of the five decisions of an options order while its direction stays correct (O-1 to O-4). The induced order passes limits that bound its size, a counterparty who reads public prints can fill it (O-6), and the position can end in assignment (O-5) or unbounded loss. Bottom: two safeguards per step, one mark per scored system, filled if enforced outside the model. C8, the most common safeguard, is enforced by 10 of the 22 order-capable systems (Table 5 ).
Figure 2: Two ways to lose money with the direction unchanged. (a) Structure: a bull put spread (sell the 100 put, buy the 95 put, 1.00credit)risksatmost1.00 credit) risks at most 400 per contract, and the same position without its long put risks $9,900 (O-1). The shaded area is the loss that the dropped leg would have capped. (b) Volatility: a 30-day at-the-money call bought at 80% implied volatility ahead of a scheduled event loses money after volatility falls to 25% unless the stock rises more than 8.7% (O-3). The shaded band is a correct view that still loses. Black–Scholes values [ 20 , 19 ] with illustrative parameters.
DifferenceEquitiesOptionsAdded attack risk
1 DirectionBuy, sell, or hold.Call or put, long or short, with leverage.A framed view flips the trade, now scaled by leverage (A1).
2 MagnitudeAny rise is a gain.Profit only past strike plus premium (breakeven).An overstated catalyst sets a strike the price never reaches: right direction, still losing (O-2).
3 TimeNo deadline; a slow thesis can still pay.A hard expiry; time value decays faster as it nears.A misdated catalyst ends the expiry before the event; false urgency pushes short-dated contracts (O-2, O-4).
4 VolatilityPrice is the only input.Premium embeds IV, which usually falls after a scheduled event.Pre-event hype induces overpriced volatility that collapses after: right call, still losing (O-3).
5 StructureOne position, loss capped by size.Multi-leg; one missing leg turns bounded loss unbounded.Framing the protective leg as a drag on returns induces an uncovered short (O-1).
6 Liquidity and price movesDeep books, tight spreads, moves that track the stock.Thin per-contract books, gappy quotes, prices moving in multiples of the underlying.Market or midpoint fills pay the spread to a counterparty; small size moves the quotes the agent reads (A3, O-6).
Table 1: Differences between options and equities, and the attack risk each difference adds. Rows 1–5 are the five decision degrees of freedom of an options order (§ 2 ), and rows 6–8 are properties of the options market and lifecycle. The last column points to the primitives of § 3.2 and the axes of § 2 .
AxisEquities analogueOptions amplificationAgent failure mode
A1 Leverage and non-linear payoffLong stock: loss is linear and capped at the capital committed.One contract controls 100 shares, and a written leg without cover turns a bounded loss into one that runs to the strike (short put) or has no bound (short call).Treats a protective leg as a cost to trim and does not model the risk its removal re-opens.
A2 Greeks and IV knowledge gapPrice, volume, and percentage moves that a supervisor can check against a chart.Delta, gamma, theta, vega, IV rank, expected move, and probability of profit are model-derived and cannot be checked by eye.Accepts a stated Greek or IV statistic without recomputing it from the chain, then sizes and structures the position on it.
A3 Wide bid-ask spreadsLiquid large-cap stock trades near its quote.Far out-of-the-money and far-dated contracts quote wide spreads on thin open interest, so entry and exit each pay a large share of premium.Anchors on the midpoint, so a shifted strike or expiry costs money with the direction right.
A4 Pricing by time decay and IVValue tracks the underlying, so a correct directional call gains.Value also falls with time (theta) and implied volatility (vega), so a correct direction that arrives late, or after an IV collapse, still loses.Reasons in linear price terms and does not audit decay or a volatility change.
A5 Exercise, assignment, and pinBuy, sell, and hold, and holding is passive.Short legs can be assigned early, contracts near the strike carry pin risk at expiry, and exercise can discard time value.Mishandles involuntary events and expiry-day timing.
A6 Order-flow observability and illiquidityAn agent order is anonymous in a deep, tight book.Per-contract books are thin, a displayed agent order may be the only visible interest, and every print is disseminated [ 23 ] .Places predictable orders that fill against a counterparty who anticipated them.
Table 2: The six amplification axes. Each row pairs an options property with its closest equities analogue, states what gets strictly worse on options, and names the agent failure mode the property acts on. A1 carries the headline worst case, A2 the stealth, and A6 the reconnaissance and the counterparty channel.
PrimitiveMechanismAxesWorst-case lossNo-nakedWrite-enabledPrecursors
O-1 Risk-structure induction (defined →\rightarrow undefined)Text leads the agent to drop or skip the protective leg of a spread, or to open an uncovered short, while every stated fact stays true.A1, A5Uncovered call: unbounded. Uncovered put: (K−c)×100(K-c)\times 100 .✗ Uncovered legs forbidden.✓ Reachable.M2, M3, M6, M7, M8
O-2 Strike and expiry displacementThe direction is kept, but the choice moves to a farther out-of-the-money strike, a nearer expiry, or a thinner contract.A3, A4Long: p×100p\times 100 , with a higher chance of losing all of it. Short: strike moves toward the money.✓ Reachable; premium or assignment.✓ Reachable.M1, M4, M5
O-3 Greeks and volatility misstatementIV rank, expected move, delta, or breakeven are misstated or re-presented, so the agent buys expensive volatility, sells cheap volatility, or sizes on a wrong delta.A2, A4Long: overpaid premium. Short: position sized on understated risk, up to the O-1 bound.✓ Reachable; premium or assignment.✓ Reachable.M2, M4, M5, M6, M8
O-4 Expiry-pressure triggeringUrgency or complacency about days to expiry and time decay leads the agent to chase, roll at a loss, or hold a decaying position to expiry.A4Long: p×100p\times 100 lost to decay. Short: held into an adverse move near expiry.✓ Reachable; premium or assignment.✓ Reachable.M1, M3, M9
O-5 Exercise, assignment, and pin exploitationThe agent is induced to exercise early and forfeit time value, to ignore early-assignment risk on a short leg, or to mishandle a position pinned near the strike at expiry.A5, A1Long: forfeited time value. Short: assignment leaves an unplanned share position of 100 per contract.✓ Reachable via covered and cash-secured legs.✓ Reachable.M3, M7, M9
O-6 Profile and harvestThe attacker reads the agent’s displayed orders and prints, infers its triggers, times an input to induce an order in a thin contract, and fills it on the other side.A6, A3Spread plus induced mispricing per fill, repeatable. Long: up to p×100p\times 100 .✓ Reachable (no short leg needed).✓ Reachable.M1, M4, M5
Table 3: Option-only attack primitives. Each primitive exploits a property of an options order that an equity order lacks. Worst-case loss is per contract (100 shares) from standard payoff mechanics [ 19 ] , with KK the strike, cc the premium received, and pp the premium paid. Reachability distinguishes platforms that forbid uncovered writing (No-naked) from write-enabled ones such as tastytrade MCP [ 4 ] . Precursor classes refer to Table 4 .
Attack classPublic exemplarDocumented effect (victim type)Options escalationAxesFeeds
Attacks on information sources
M1 Fabricated news and content injectionTradeTrap [ 17 ]Counterfeit news cut an adaptive equities agent’s return from 11.59% to 5.26% and its Sharpe ratio from 4.34 to 3.20 (equities agent).A fabricated catalyst sets the expected move, so a long option bought ahead of it loses to time decay even if the underlying stays flat.A1, A4O-2, O-4
M2 Retrieval and corpus poisoningPoisonedRAG [ 35 ]Five injected texts per target question reached 90% attack success over millions of documents (general RAG).A poisoned playbook entry can present an uncovered structure as the standard form of a defined-risk strategy, which the agent cannot check (A2).A1, A2O-1, O-3
M3 Misleading-but-true framingFraming and bias studies [ 36 , 37 ]Instruction-tuned models show stronger decoy, certainty, and belief biases than their base models (general LLMs).Short-premium payoffs win often and lose rarely but large, a profile certainty-effect framing favors, pointing the agent toward writing options.A1, A4O-1, O-4
M4 Presentation and market-signal injectionMarket Signal Injection [ 18 ]Changing number formatting, competitor ordering, or commentary, with data values unchanged, shifted pricing decisions across 12 models (pricing agent).The manipulated quantities become IV rank, expected move, and Greeks, whose magnitude neither a supervisor nor the model can confirm by inspection.A2, A4O-3
M5 Manipulated provenance and manufactured consensusAdversarial SEO [ 38 ] , source attribution [ 39 ] , social bots [ 40 ]Crafted content steered production LLM search engines, and re-attributing the same text to another source shifted LLM judgments (general LLMs).Options-flow and “unusual activity” reports aggregate anonymous prints with weak provenance, so a consensus volatility narrative is cheap to manufacture.A2, A3O-2, O-3
Table 4: Migration map from equities to options. Each row is a publicly documented attack class, grouped by the attack taxonomy of the equities SoK [ 13 ] . The effect column reports what the exemplar measured on its own victims (equities trading agents, pricing agents, or general LLM agents); no number in this table was measured on an options agent. The escalation column follows from options payoff mechanics (§ 2 ). Axes are those of § 2 , and primitives follow Table 3 .
Figure 3: GitHub screening funnel. Counts from the logged screen of the six-query union. Bars are proportional to the number of repositories at each stage, and 201 eligible repositories remain unscored.
Figure 4: The safeguard codebook. Seven robustness indicators (R) ask whether a system stops a harmful order when the market moves or the model errs, and eleven security indicators (C) ask whether a manipulated input or order can reach the model or the market. Each system gets one mark per indicator: filled if the safeguard is enforced outside the LLM, half-filled if it lives in the prompt, is optional, or can be cleared by the agent, and empty if nothing is documented. The grid at the bottom left shows how autonomy (X2, rows) and write scope (X3, columns) fix the worst reachable loss (H1, cell shading) and whether an order can be intercepted (H3, right of the grid). NEW marks indicators with no counterpart among the metrics FARSIGHT scores.
  ProfileImpactRobustnessSecurity
#SystemX2X3H1H2H3R1R2R3R4R5R6R7C1C2C3C4C5C6C7C8C9C10C11
Academic
1Kuang and Lin [ 46 ]A0W0noneuser               – – 
2OQL [ 47 ]A0W0noneuser               – – 
Broker-native
3OKX Agent Trade Kit [ 48 ]A4W4unb.plat.                   
Table 5: Safeguard scores for the 26 included options-agent systems (at the snapshot), grouped by sampling stratum. The academic and broker-native groups and the open-source group with at least 20 GitHub stars are censuses, and the lower-star open-source group is a purposive sample that supports no prevalence claim. Safeguard cells: Ag enforced outside the model, Ag model-dependent, optional, or clearable by the agent, not documented, Ag – not applicable (no order path). Shading marks automatic autonomy (A3, A4), uncovered write scope (W4), and the worst reachable loss: Ag unb. unbounded, Ag asgn. assignment, Ag prem. premium. H1–H3 follow the rules of Appendix B , and H3 uses the safeguard colors. † Hosted service whose repository publishes the interface, not the server. Per-cell evidence is in Appendix C .
Figure 5: Eligible options-agent repositories by creation date. Cumulative count of the 215 eligible GitHub repositories (blue) and of the 136 that name Alpaca in their own name, description, or topics (orange), from October 2025 to the snapshot; 10 repositories created before October 2025 start the blue line. The shaded band is the Alpaca AI Trading Agents Hackathon (late August to early September 2026) [ 69 ] . Most of the population appeared within days of that event.
Figure 6: Term mentions in the eligible repositories. For each term group, the number of the 215 eligible repositories whose name, description, topics, or README mention it, from the keyword matches logged during screening. A repository can mention several groups. The open-weight row counts Qwen, DeepSeek, Llama, and Mistral, and the framework row counts LangChain, LangGraph, CrewAI, and AutoGen.
Figure 7: Positions of the 26 systems. Each cell pairs the worst loss the documented order path can reach (H1) with an autonomy level (X2) and gives the number of systems and their row numbers in Table 5 , colored by sampling stratum. The outlined block holds the 10 systems that can reach unbounded loss behind an agent-clearable gate or none.
StratumSys- temsCan orderNo humanUn- cov.Unb. lossSize limitInput check
Academic2000000
Broker-native8866630
Open source, ≥\geq 20 stars7775510
Open source, purposive9743260
All systems2622171413100
Table 6: Exposure and safeguards by sampling stratum. Each cell counts the systems in the stratum that have an order path, can execute with no mandatory human step (A3 or A4), can write uncovered shorts (W4), can reach unbounded loss (H1), enforce a pre-trade limit outside the model (C8 full), and authenticate sources or cross-check market data (C1 or C2 full). The purposive stratum describes designs, and prevalence is read from the other rows.
Figure 8: Safeguard coverage. For each robustness (R1–R7) and security (C1–C11) indicator, the number of the 26 systems that score it full (enforced outside the model), partial (model-dependent, optional, or clearable by the agent), or none documented, with hatching where the indicator does not apply because the system has no order path (C8, C10). R5, R6, C1, C2, C4, C5, and C11 are full in none of the systems, and the most common full safeguard is C8 (pre-trade limit, 10 of the 22 systems that can place orders).
Figure 9: Safeguards that would stop each primitive, with system counts. A dot marks a safeguard that addresses a primitive. The robustness indicators follow the primitive’s axes (R1–R5 operationalize A1–A5, and R3 also A6), the input-side controls follow its precursor classes (C1 for text sources, C2 for falsified tool fields, C4 for injected instructions), and the out-of-model limit C8 bounds every order. The bottom row counts the systems that score each safeguard full, out of 26 (C8 out of the 22 that can place orders). Only the size limit C8 is common, and a manipulated order within budget passes it.
 FARSIGHT (equities)This study (options)
Attacker levers1: direction (plus size)5: direction, magnitude, time, volatility, structure (plus size)
Worst caseWrong direction; unbounded through an explicit shortUnbounded loss from one dropped leg, direction unchanged; assignment into unplanned stock
Systems scored15 academic designs26 systems (2 academic, 8 broker-native, 16 open-source), from a logged screen of 765 repositories
DeploymentProposed in the literatureLive: agents place options orders at retail brokers
CodebookRobustness (R1–R4, turbulence) and security (S1–S3)Same two dimensions: 7 robustness and 11 security indicators, plus a profile and a computed impact
New dimensionsNoneWrite scope, Greeks and IV provenance, expiry and assignment, order-flow observability
Table 7: This study compared with FARSIGHT [ 13 ] , the equities systematization, dimension by dimension. The differences follow from the four extra decision variables of an options order and from measuring systems that run today.
Appendix figures & tables1 asset

Supplementary material from the paper’s appendix.

Appendix

IDIndicatorLevels or rule forGrounding
R1Maximum lossMaximum loss is computed and enforced before entry, distinguishing defined from undefined risk.A1
R2Greeks and IV provenanceGreeks and IV are computed from a pricing model or an authoritative chain, with sanity checks, not read from text.A2
R3Spread and liquidityExecution enforces limit orders, open-interest or volume floors, or maximum spreads.A3, A6
R4Decay and expiryTime decay, event volatility, and days to expiry gate entries and exits.A4
R5Exercise and assignmentEarly assignment, exercise, and pin risk are handled by rule.A5
R6StressVolatility spikes, gaps, halts, and stale data trigger enforced behavior.Turbulence dimension of [ 13 ]
Appendix
Table 8: The safeguard codebook in full, in the order of Figure 4 : robustness (R), security (C), profile (X), and computed impact (H). The Grounding column names the amplification axis (§ 2 ) or public framework the indicator operationalizes: the OWASP Top 10 for LLM Applications [ 43 ] , SEC Rule 15c3-5 on market-access risk controls [ 44 ] , and FINRA Rule 2360 options approval levels [ 45 ] .
More in this topic

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 332 papers

Explore similar work

CardsList
Sep 17, 2026

Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Large language model (LLM) agents already trade real capital, and builders copy a few published designs that share models and news feeds, so one shock reaches many agents at once. We present FARSIGHT (Financial Agent Robustness and Security Investigation and Global Holistic Taxonomy), a systematization that rates trading agents on robustness to market stress and on security against source manipulation, agent compromise, and agents acting as attackers, and checks the ratings against released code. Across 15 academic schemes, no paper describes a halt that skips LLM inference or combines source provenance with cross-source corroboration, and the 7 code releases enforce no stop-loss or position limit outside the LLM. Three LLMs sell whole positions on a fake headline and on real hoaxes, including the fake press release behind the 2000 Emulex crash. In a simulated market driven by these decisions, one fake headline crashes the market in all runs with 400 agents, and 400 agents that sell when prices fall nearly double a 2010-sized crash. The pause that U.S. exchanges apply to large stocks starts in no headline run, whereas automatic halts and hard loss limits outside the model remove both effects. Restated as a domain-independent threat model, FARSIGHT maps the same gaps onto agents in healthcare, law, software, and crypto, where compromised agents spread harm as worms and as cascades. We derive 14 open problems and urge deployers to corroborate sources, keep interrupts that bypass the model, and enforce loss limits outside it.

Mengxiao Wang, Nitesh Saxena

Texas A&M University

LLM Agent SecurityAI Agent Security BenchmarksLLM AgentsLLM Agent Reliability
AskPDF
Sep 27, 2026

LiveOption: Evaluating LLM Agents in Structured Option Trading with Nonlinear Payoffs

Large language models (LLMs) and multi-agent systems (MAS) have shown promise in financial decision-making, yet existing evaluations focus on equity trading and primarily assess directional prediction, overlooking the structural complexity of derivative markets. Option trading introduces fundamentally different challenges, including nonlinear payoffs and multi-leg strategy construction, requiring structured decisions rather than simple directional bets. We introduce LiveOption, an evaluation framework for LLM-based agents in option trading. LiveOption formulates the problem as structured sequential decision-making under realistic execution and capital constraints, and provides a reproducible environment with standardized interaction protocols. The framework includes three task suites covering portfolio overlays, event-driven earnings trading, and 0DTE intraday trading. We further propose a hierarchical metric suite that evaluates action validity, decision quality, risk characteristics, and outcome-level performance. Experiments show that current agents often fail to achieve competitive returns in most scenarios. LiveOption offers a principled testbed for evaluating structured decision-making beyond outcome-based metrics. Project Website: https://liveoption.github.io/

Haochen Luo, Yifan Li, Binh Minh An +4

City University of Hong Kong · The Chinese University of Hong Kong (Shenzhen) · Shanghai University of Finance and Economics

Quantitative FinanceLLM Agent EvaluationAI Agent BenchmarksAlgorithmic Trading
AskPDF
May 19, 2026

Agentic Trading: When LLM Agents Meet Financial Markets

A growing body of work explores how Large Language Models (LLMs) can be embedded in trading systems as agents that perceive market information, retrieve context, reason about decisions, emit tradable actions, and adapt under market feedback. This paper reframes LLM-based trading agents as expert-system decision pipelines and presents an audit-oriented evidence map of 77 included studies in a protocol-coded snapshot screened through 2026-03-09. A primary empirical subset (n=19) satisfies the minimum boundary of Action Output plus Closed-Loop Evaluation; the remaining 58 included studies are retained as background and design context. The central empirical finding is protocol incomparability: within the primary subset, only 2/19 studies report extractable time-consistent split protocols, 1/19 reports an explicit transaction-cost model, 1/19 documents universe or survivorship handling, 11/19 report execution timing or semantics, 15/19 are coded as R0, and no study reaches R3 reproducibility. We therefore use Architecture-Capability-Adaptation as a working analytical lens rather than a validated taxonomy, and we foreground the evidence ledger, reproducibility audit, and reporting checklist as the main contributions. The resulting survey shows that architectural experimentation is expanding rapidly, while comparable evaluation protocols, execution semantics, and reproducible artifacts remain the field's immediate bottlenecks.

Yihan Xia, Panpan You, Taotao Wang +4

College of Electronic and Information Engineering, Shenzhen University, Shenzhen, China

LLM Agent EvaluationFinanceAlgorithmic Trading
AskPDF