cs.CROct 16, 2026
SaveUnbounded Losses, Unchecked Inputs: Measuring the Safeguards of LLM Options-Trading Agents
Organizations: Texas A&M University
Abstract
Large language model (LLM) agents now place options orders at retail brokers, and developers publish open-source options agents faster than anyone has examined them. Prior security work on trading agents scored academic equities designs by whether an attacker can flip a buy-or-sell decision. We present the first measurement of the options agents that brokers and developers ship, scored by the safeguards they enforce and by the worst loss their documented order paths can reach. We screened 765 GitHub repositories, broker documentation, and the research literature and found 215 eligible repositories and 8 broker-native agent interfaces. We then scored 26 systems, including every broker interface and every open-source project with at least 20 stars, on seven robustness and eleven security safeguards with cell-level evidence. The ecosystem is new: 198 of the 215 repositories were created in 2026, and 129 (60.0%) appeared in the two weeks around one options-trading hackathon. Of the 22 systems that can place orders, 10 enforce a pre-trade limit outside the model, yet none of the 26 authenticate their text sources or cross-check market data. Of the 26, 17 can execute with no mandatory human step and 13 can reach unbounded loss, including 6 of the 8 broker interfaces. Because an attacker who writes the agent's inputs can move an order's strike, expiry, volatility, and legs while its direction stays correct, options agents need loss limits enforced at the order boundary.
Figures & tables
Figure 1: Attack path and the safeguards we measured. Top: an attacker who writes text into the agent’s inputs (S1–S3) moves four of the five decisions of an options order while its direction stays correct (O-1 to O-4). The induced order passes limits that bound its size, a counterparty who reads public prints can fill it (O-6), and the position can end in assignment (O-5) or unbounded loss. Bottom: two safeguards per step, one mark per scored system, filled if enforced outside the model. C8, the most common safeguard, is enforced by 10 of the 22 order-capable systems (Table 5 ).
Figure 2: Two ways to lose money with the direction unchanged. (a) Structure: a bull put spread (sell the 100 put, buy the 95 put, 400 per contract, and the same position without its long put risks $9,900 (O-1). The shaded area is the loss that the dropped leg would have capped. (b) Volatility: a 30-day at-the-money call bought at 80% implied volatility ahead of a scheduled event loses money after volatility falls to 25% unless the stock rises more than 8.7% (O-3). The shaded band is a correct view that still loses. Black–Scholes values [ 20 , 19 ] with illustrative parameters.
| Difference | Equities | Options | Added attack risk |
| 1 Direction | Buy, sell, or hold. | Call or put, long or short, with leverage. | A framed view flips the trade, now scaled by leverage (A1). |
| 2 Magnitude | Any rise is a gain. | Profit only past strike plus premium (breakeven). | An overstated catalyst sets a strike the price never reaches: right direction, still losing (O-2). |
| 3 Time | No deadline; a slow thesis can still pay. | A hard expiry; time value decays faster as it nears. | A misdated catalyst ends the expiry before the event; false urgency pushes short-dated contracts (O-2, O-4). |
| 4 Volatility | Price is the only input. | Premium embeds IV, which usually falls after a scheduled event. | Pre-event hype induces overpriced volatility that collapses after: right call, still losing (O-3). |
| 5 Structure | One position, loss capped by size. | Multi-leg; one missing leg turns bounded loss unbounded. | Framing the protective leg as a drag on returns induces an uncovered short (O-1). |
| 6 Liquidity and price moves | Deep books, tight spreads, moves that track the stock. | Thin per-contract books, gappy quotes, prices moving in multiples of the underlying. | Market or midpoint fills pay the spread to a counterparty; small size moves the quotes the agent reads (A3, O-6). |
Table 1: Differences between options and equities, and the attack risk each difference adds. Rows 1–5 are the five decision degrees of freedom of an options order (§ 2 ), and rows 6–8 are properties of the options market and lifecycle. The last column points to the primitives of § 3.2 and the axes of § 2 .
| Axis | Equities analogue | Options amplification | Agent failure mode |
| A1 Leverage and non-linear payoff | Long stock: loss is linear and capped at the capital committed. | One contract controls 100 shares, and a written leg without cover turns a bounded loss into one that runs to the strike (short put) or has no bound (short call). | Treats a protective leg as a cost to trim and does not model the risk its removal re-opens. |
| A2 Greeks and IV knowledge gap | Price, volume, and percentage moves that a supervisor can check against a chart. | Delta, gamma, theta, vega, IV rank, expected move, and probability of profit are model-derived and cannot be checked by eye. | Accepts a stated Greek or IV statistic without recomputing it from the chain, then sizes and structures the position on it. |
| A3 Wide bid-ask spreads | Liquid large-cap stock trades near its quote. | Far out-of-the-money and far-dated contracts quote wide spreads on thin open interest, so entry and exit each pay a large share of premium. | Anchors on the midpoint, so a shifted strike or expiry costs money with the direction right. |
| A4 Pricing by time decay and IV | Value tracks the underlying, so a correct directional call gains. | Value also falls with time (theta) and implied volatility (vega), so a correct direction that arrives late, or after an IV collapse, still loses. | Reasons in linear price terms and does not audit decay or a volatility change. |
| A5 Exercise, assignment, and pin | Buy, sell, and hold, and holding is passive. | Short legs can be assigned early, contracts near the strike carry pin risk at expiry, and exercise can discard time value. | Mishandles involuntary events and expiry-day timing. |
| A6 Order-flow observability and illiquidity | An agent order is anonymous in a deep, tight book. | Per-contract books are thin, a displayed agent order may be the only visible interest, and every print is disseminated [ 23 ] . | Places predictable orders that fill against a counterparty who anticipated them. |
Table 2: The six amplification axes. Each row pairs an options property with its closest equities analogue, states what gets strictly worse on options, and names the agent failure mode the property acts on. A1 carries the headline worst case, A2 the stealth, and A6 the reconnaissance and the counterparty channel.
| Primitive | Mechanism | Axes | Worst-case loss | No-naked | Write-enabled | Precursors |
| O-1 Risk-structure induction (defined undefined) | Text leads the agent to drop or skip the protective leg of a spread, or to open an uncovered short, while every stated fact stays true. | A1, A5 | Uncovered call: unbounded. Uncovered put: . | ✗ Uncovered legs forbidden. | ✓ Reachable. | M2, M3, M6, M7, M8 |
| O-2 Strike and expiry displacement | The direction is kept, but the choice moves to a farther out-of-the-money strike, a nearer expiry, or a thinner contract. | A3, A4 | Long: , with a higher chance of losing all of it. Short: strike moves toward the money. | ✓ Reachable; premium or assignment. | ✓ Reachable. | M1, M4, M5 |
| O-3 Greeks and volatility misstatement | IV rank, expected move, delta, or breakeven are misstated or re-presented, so the agent buys expensive volatility, sells cheap volatility, or sizes on a wrong delta. | A2, A4 | Long: overpaid premium. Short: position sized on understated risk, up to the O-1 bound. | ✓ Reachable; premium or assignment. | ✓ Reachable. | M2, M4, M5, M6, M8 |
| O-4 Expiry-pressure triggering | Urgency or complacency about days to expiry and time decay leads the agent to chase, roll at a loss, or hold a decaying position to expiry. | A4 | Long: lost to decay. Short: held into an adverse move near expiry. | ✓ Reachable; premium or assignment. | ✓ Reachable. | M1, M3, M9 |
| O-5 Exercise, assignment, and pin exploitation | The agent is induced to exercise early and forfeit time value, to ignore early-assignment risk on a short leg, or to mishandle a position pinned near the strike at expiry. | A5, A1 | Long: forfeited time value. Short: assignment leaves an unplanned share position of 100 per contract. | ✓ Reachable via covered and cash-secured legs. | ✓ Reachable. | M3, M7, M9 |
| O-6 Profile and harvest | The attacker reads the agent’s displayed orders and prints, infers its triggers, times an input to induce an order in a thin contract, and fills it on the other side. | A6, A3 | Spread plus induced mispricing per fill, repeatable. Long: up to . | ✓ Reachable (no short leg needed). | ✓ Reachable. | M1, M4, M5 |
Table 3: Option-only attack primitives. Each primitive exploits a property of an options order that an equity order lacks. Worst-case loss is per contract (100 shares) from standard payoff mechanics [ 19 ] , with the strike, the premium received, and the premium paid. Reachability distinguishes platforms that forbid uncovered writing (No-naked) from write-enabled ones such as tastytrade MCP [ 4 ] . Precursor classes refer to Table 4 .
| Attack class | Public exemplar | Documented effect (victim type) | Options escalation | Axes | Feeds |
| Attacks on information sources | |||||
| M1 Fabricated news and content injection | TradeTrap [ 17 ] | Counterfeit news cut an adaptive equities agent’s return from 11.59% to 5.26% and its Sharpe ratio from 4.34 to 3.20 (equities agent). | A fabricated catalyst sets the expected move, so a long option bought ahead of it loses to time decay even if the underlying stays flat. | A1, A4 | O-2, O-4 |
| M2 Retrieval and corpus poisoning | PoisonedRAG [ 35 ] | Five injected texts per target question reached 90% attack success over millions of documents (general RAG). | A poisoned playbook entry can present an uncovered structure as the standard form of a defined-risk strategy, which the agent cannot check (A2). | A1, A2 | O-1, O-3 |
| M3 Misleading-but-true framing | Framing and bias studies [ 36 , 37 ] | Instruction-tuned models show stronger decoy, certainty, and belief biases than their base models (general LLMs). | Short-premium payoffs win often and lose rarely but large, a profile certainty-effect framing favors, pointing the agent toward writing options. | A1, A4 | O-1, O-4 |
| M4 Presentation and market-signal injection | Market Signal Injection [ 18 ] | Changing number formatting, competitor ordering, or commentary, with data values unchanged, shifted pricing decisions across 12 models (pricing agent). | The manipulated quantities become IV rank, expected move, and Greeks, whose magnitude neither a supervisor nor the model can confirm by inspection. | A2, A4 | O-3 |
| M5 Manipulated provenance and manufactured consensus | Adversarial SEO [ 38 ] , source attribution [ 39 ] , social bots [ 40 ] | Crafted content steered production LLM search engines, and re-attributing the same text to another source shifted LLM judgments (general LLMs). | Options-flow and “unusual activity” reports aggregate anonymous prints with weak provenance, so a consensus volatility narrative is cheap to manufacture. | A2, A3 | O-2, O-3 |
Table 4: Migration map from equities to options. Each row is a publicly documented attack class, grouped by the attack taxonomy of the equities SoK [ 13 ] . The effect column reports what the exemplar measured on its own victims (equities trading agents, pricing agents, or general LLM agents); no number in this table was measured on an options agent. The escalation column follows from options payoff mechanics (§ 2 ). Axes are those of § 2 , and primitives follow Table 3 .
Figure 3: GitHub screening funnel. Counts from the logged screen of the six-query union. Bars are proportional to the number of repositories at each stage, and 201 eligible repositories remain unscored.
Figure 4: The safeguard codebook. Seven robustness indicators (R) ask whether a system stops a harmful order when the market moves or the model errs, and eleven security indicators (C) ask whether a manipulated input or order can reach the model or the market. Each system gets one mark per indicator: filled if the safeguard is enforced outside the LLM, half-filled if it lives in the prompt, is optional, or can be cleared by the agent, and empty if nothing is documented. The grid at the bottom left shows how autonomy (X2, rows) and write scope (X3, columns) fix the worst reachable loss (H1, cell shading) and whether an order can be intercepted (H3, right of the grid). NEW marks indicators with no counterpart among the metrics FARSIGHT scores.
| Profile | Impact | Robustness | Security | |||||||||||||||||||||
| # | System | X2 | X3 | H1 | H2 | H3 | R1 | R2 | R3 | R4 | R5 | R6 | R7 | C1 | C2 | C3 | C4 | C5 | C6 | C7 | C8 | C9 | C10 | C11 |
| Academic | ||||||||||||||||||||||||
| 1 | Kuang and Lin [ 46 ] | A0 | W0 | none | user | – | – | |||||||||||||||||
| 2 | OQL [ 47 ] | A0 | W0 | none | user | – | – | |||||||||||||||||
| Broker-native | ||||||||||||||||||||||||
| 3 | OKX Agent Trade Kit [ 48 ] | A4 | W4 | unb. | plat. | |||||||||||||||||||
Table 5: Safeguard scores for the 26 included options-agent systems (at the snapshot), grouped by sampling stratum. The academic and broker-native groups and the open-source group with at least 20 GitHub stars are censuses, and the lower-star open-source group is a purposive sample that supports no prevalence claim. Safeguard cells: Ag enforced outside the model, Ag model-dependent, optional, or clearable by the agent, not documented, Ag – not applicable (no order path). Shading marks automatic autonomy (A3, A4), uncovered write scope (W4), and the worst reachable loss: Ag unb. unbounded, Ag asgn. assignment, Ag prem. premium. H1–H3 follow the rules of Appendix B , and H3 uses the safeguard colors. † Hosted service whose repository publishes the interface, not the server. Per-cell evidence is in Appendix C .
Figure 5: Eligible options-agent repositories by creation date. Cumulative count of the 215 eligible GitHub repositories (blue) and of the 136 that name Alpaca in their own name, description, or topics (orange), from October 2025 to the snapshot; 10 repositories created before October 2025 start the blue line. The shaded band is the Alpaca AI Trading Agents Hackathon (late August to early September 2026) [ 69 ] . Most of the population appeared within days of that event.
Figure 6: Term mentions in the eligible repositories. For each term group, the number of the 215 eligible repositories whose name, description, topics, or README mention it, from the keyword matches logged during screening. A repository can mention several groups. The open-weight row counts Qwen, DeepSeek, Llama, and Mistral, and the framework row counts LangChain, LangGraph, CrewAI, and AutoGen.
Figure 7: Positions of the 26 systems. Each cell pairs the worst loss the documented order path can reach (H1) with an autonomy level (X2) and gives the number of systems and their row numbers in Table 5 , colored by sampling stratum. The outlined block holds the 10 systems that can reach unbounded loss behind an agent-clearable gate or none.
| Stratum | Sys- tems | Can order | No human | Un- cov. | Unb. loss | Size limit | Input check |
| Academic | 2 | 0 | 0 | 0 | 0 | 0 | 0 |
| Broker-native | 8 | 8 | 6 | 6 | 6 | 3 | 0 |
| Open source, 20 stars | 7 | 7 | 7 | 5 | 5 | 1 | 0 |
| Open source, purposive | 9 | 7 | 4 | 3 | 2 | 6 | 0 |
| All systems | 26 | 22 | 17 | 14 | 13 | 10 | 0 |
Table 6: Exposure and safeguards by sampling stratum. Each cell counts the systems in the stratum that have an order path, can execute with no mandatory human step (A3 or A4), can write uncovered shorts (W4), can reach unbounded loss (H1), enforce a pre-trade limit outside the model (C8 full), and authenticate sources or cross-check market data (C1 or C2 full). The purposive stratum describes designs, and prevalence is read from the other rows.
Figure 8: Safeguard coverage. For each robustness (R1–R7) and security (C1–C11) indicator, the number of the 26 systems that score it full (enforced outside the model), partial (model-dependent, optional, or clearable by the agent), or none documented, with hatching where the indicator does not apply because the system has no order path (C8, C10). R5, R6, C1, C2, C4, C5, and C11 are full in none of the systems, and the most common full safeguard is C8 (pre-trade limit, 10 of the 22 systems that can place orders).
Figure 9: Safeguards that would stop each primitive, with system counts. A dot marks a safeguard that addresses a primitive. The robustness indicators follow the primitive’s axes (R1–R5 operationalize A1–A5, and R3 also A6), the input-side controls follow its precursor classes (C1 for text sources, C2 for falsified tool fields, C4 for injected instructions), and the out-of-model limit C8 bounds every order. The bottom row counts the systems that score each safeguard full, out of 26 (C8 out of the 22 that can place orders). Only the size limit C8 is common, and a manipulated order within budget passes it.
| FARSIGHT (equities) | This study (options) | |
| Attacker levers | 1: direction (plus size) | 5: direction, magnitude, time, volatility, structure (plus size) |
| Worst case | Wrong direction; unbounded through an explicit short | Unbounded loss from one dropped leg, direction unchanged; assignment into unplanned stock |
| Systems scored | 15 academic designs | 26 systems (2 academic, 8 broker-native, 16 open-source), from a logged screen of 765 repositories |
| Deployment | Proposed in the literature | Live: agents place options orders at retail brokers |
| Codebook | Robustness (R1–R4, turbulence) and security (S1–S3) | Same two dimensions: 7 robustness and 11 security indicators, plus a profile and a computed impact |
| New dimensions | None | Write scope, Greeks and IV provenance, expiry and assignment, order-flow observability |
Table 7: This study compared with FARSIGHT [ 13 ] , the equities systematization, dimension by dimension. The differences follow from the four extra decision variables of an options order and from measuring systems that run today.
Appendix figures & tables1 asset
Supplementary material from the paper’s appendix.
Appendix
| ID | Indicator | Levels or rule for | Grounding |
| R1 | Maximum loss | Maximum loss is computed and enforced before entry, distinguishing defined from undefined risk. | A1 |
| R2 | Greeks and IV provenance | Greeks and IV are computed from a pricing model or an authoritative chain, with sanity checks, not read from text. | A2 |
| R3 | Spread and liquidity | Execution enforces limit orders, open-interest or volume floors, or maximum spreads. | A3, A6 |
| R4 | Decay and expiry | Time decay, event volatility, and days to expiry gate entries and exits. | A4 |
| R5 | Exercise and assignment | Early assignment, exercise, and pin risk are handled by rule. | A5 |
| R6 | Stress | Volatility spikes, gaps, halts, and stale data trigger enforced behavior. | Turbulence dimension of [ 13 ] |
Table 8: The safeguard codebook in full, in the order of Figure 4 : robustness (R), security (C), profile (X), and computed impact (H). The Grounding column names the amplification axis (§ 2 ) or public framework the indicator operationalizes: the OWASP Top 10 for LLM Applications [ 43 ] , SEC Rule 15c3-5 on market-access risk controls [ 44 ] , and FINRA Rule 2360 options approval levels [ 45 ] .
More in this topic
LLM Agent Security
Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.
See all 332 papers