AI Agents at Retail Brokerages

Introduction

For ten years, we have opened real accounts with real money to test what the digital advice industry actually delivers. That work began in 2015 with the Robo Report, the first independent, unbiased, and free source of performance data on robo advisors, at a time when marketing claims in that industry ran far ahead of evidence. A decade later, the same thing is happening again. A new category of digital investing has arrived: AI agents that can read a brokerage account and place real trades in it, either through the brokerage’s own AI product or through a third-party assistant such as Claude, ChatGPT, or Gemini connected to the brokerage’s published tools. And once again, there is almost no independent, transparent testing of whether any of it works.

This report is our first attempt to change that. It is also a new chapter for us. With this edition, The Robo Report becomes Condor Capital’s Digital Advice Report. The name is new; the approach is not. Real accounts, real money, standardized conditions, and results reported whether they flatter the products or not, unbiased, transparent, and free, as they have been for ten years.

A note on these tests: these products and capabilities are rapidly evolving. The testing period was short and the balances were small. These AI tools are non-deterministic, meaning that the same agent given the same instruction can give different results. That is how the technology works rather than a flaw, but means we are reporting on our own experience, not what they will always do.

How we tested

We ran three tests across combinations of AI agents (Claude, ChatGPT, Gemini) and brokerages (Robinhood, Public, Webull), all in funded taxable accounts we own, with every order routed to a live market. Our first test asks whether an agent can responsibly run a simple robo-style 60/40 account over time, governed by an Investment Policy Statement the agent wrote for itself; four accounts run this test, one third-party agent at each of the three brokerages, plus Public’s own on-site agent running the same mandate inside the app. The second test is a capability matrix: an identical script run by two agents at each of three custodians, scored against the account’s own records. Our third test gives an agent an open-ended goal: make as much money as you can, end the day in cash, never risk more than the account holds.

Setting this up is not for the average person

The single clearest finding of this project is how much work it took before any test could begin. None of this resembles downloading an app and answering a risk questionnaire.

At Public, gaining agent access meant generating a long-lived API secret from account settings, exchanging it for an access token that expires every fifteen minutes, and connecting a hosted server, after which a freshly minted, perfectly valid token still returned errors for days because trading-API access had not been enabled on the account. At Webull, credentials are read once at startup; change anything and the agent’s trading tools silently do not exist until the connection is rebuilt. The AI agent can do the set up for you, but the average person will still probably feel the sense of being thrown in the deep end. Robinhood was the easiest by a wide margin, as it offers a connector-based setup that feels close to an ordinary app login.

The agent’s knowledge has an expiration date

The agents were sometimes wrong about the rules in both directions and equally confident either way. The clearest example came from Gemini. At Webull, Gemini wrote into its own Investment Policy Statement (IPS) that the platform only supported whole shares, and built its rebalancing rules around that constraint. It was wrong; Webull supports fractional shares, and the limitation was invented. When we pushed back, the agent checked, agreed, and amended its IPS to authorize fractional trading. A week later it discovered a constraint that actually exists, a strict $5.00 minimum per fractional order but only by hitting it, and amended the IPS a second time. The account has held $4.60 in cash it cannot deploy ever since.

The more concerning version involves regulation. During testing, Gemini warned us about pattern-day-trader restrictions on our activity, the familiar rule flagging accounts under $25,000 that make four or more day trades in five business days. The warning was delivered confidently and would have changed our behavior. It was also out of date. The pattern-day-trading rule was removed in June 2026. The agent was reciting the regulatory world as of its training data, not the one we were trading in. An investor who trusted it would have constrained real activity to comply with a rule that no longer exists. Of course, the reverse case would be worse: an agent could just as easily bless activity a new rule now prohibits. For anything that turns on current law, tax treatment, or exchange rules, these agents are a starting point for a question, not an answer.

Model training data lags the world by months and brokerage capabilities and regulations change faster than that. If you are looking closely, you may notice that the agent searches the web for information, which tends to produce more current information, but little distinguishes a fact it verified today from one frozen at training time. The fact that the agent reversed itself when we pushed back is only half-reassuring, an agent that changes its answer under pressure from the account owner is also an agent that can be talked out of a correct one.

Both of these errors came from Gemini. Any AI agent can hallucinate or go stale, and our sample of questions was small enough that we would not treat this as a definitive ranking. Still, the identity of the agent is notable. Developers have reported a similar pattern with Gemini in programming work: it scores well on intelligence benchmarks and produces moments of brilliance, but it also makes occasional errors strange enough to undermine confidence in the output as a whole. Reliability, not raw capability, is the constraint. It is also worth noting that we were not testing a budget version, the testing was done using Gemini 3.1 Pro, Google’s top of the line model at this time.

The 60/40 test: completely generic

Our first test was deliberately unglamorous: hold a 60/40 account to its mandate, week after week, under an Investment Policy Statement the agent wrote for itself. The agents converged on similar portfolios, a total-market US equity ETF, a total-international ETF, and a bond fund, allowing allocations to drift by 5% points away from targets, weekly reviews, and cash-flows-first rebalancing. Every choice is defensible.

The IPS documents read like textbook summaries: correct on tax location, wash sales, and turnover, and on when doing nothing is the right answer. What none of them contains is a household, a goal, a spending need, or any awareness of assets beyond the one account the agent can see. The mechanical core of a robo advisor is now something an agent drafts in one sitting; most of real advice lives outside that core.

The fourth column is different in kind. Public also offers an agent inside its own app, and we handed it the same 60/40 mandate. It built the plainest portfolio of the four, 60% VTI and 40% AGG, with taxable bonds where all three outside agents reached for municipals. That configuration, the agent living inside the brokerage, is the one we expect to become the bigger deal and the one the incumbents will lean into. It is almost certainly not the brokerage’s own AI: the likely construction is an LLM API rented from one of the frontier labs, wrapped in custom system prompts designed by Public, and that is probably how larger brokerages will approach agents if and when they launch them.

The robos are less generic than that. Our Schwab account holds eleven funds, tilted toward the firm’s fundamental-index family, with a REIT sleeve, a TIPS sleeve, and roughly 11% of the account sitting in cash by design. Our Wealthfront account also holds eleven, including a dividend tilt alongside separate developed and emerging international sleeves and a bond mix spanning municipal, corporate, and inflation-protected funds. Agree with those calls or not, each expresses a point of view the firm maintains and defends. Vanguard Digital Advisor is the exception and the most instructive one: four funds, US and international stock, US and international bond, weighted to the market and nothing else. It is also the closest thing in our robo universe to what the agents built for themselves. The robos sell judgment plus implementation; the agents currently supply implementation only.

The capability test

The headline from the capability matrix shows that the AI agents were essentially interchangeable across the prompts both ran on the same brokers. The differences that matter are between the brokerages, not the agents. Overall scores are the same between the agents, as each was able to make use of the brokerage’s tools as designed.

The basics work generally the same. Account balances, positions with cost basis, live and batch quotes, market and limit orders, order listing and cancellation, pre-trade cost estimates, and transaction history scored 100% at every broker under both agents. If what you want is a simple DIY account, the plumbing is already adequate at all three.

The frontier is where the brokers diverge. Bracket and combo orders were the sharpest split. Webull supports a native OTOCO combo with linked exits; at Robinhood and Public no native bracket exists, and the agents either composed unlinked workarounds or refused rather than leave a position with untethered exits. Public’s interface has no watchlist tools at all and no true good-till-cancel (agents substituted good-till-date orders capped at 90 days). Robinhood’s agent interface offers no crypto and no short selling.

A note on the roster: Gemini runs the Webull 60/40 account and the Webull leg of our open-ended test, but it is absent from the matrix. Google offers no command-line agent comparable to Claude Code or OpenAI’s Codex CLI; access runs through Antigravity, an app that favors published connectors over tools the user configures in code, and published brokerage connectors are scarce today, preventing us from wiring Gemini to the brokers under the same conditions as the other two.

2 points awarded for completing the request, 1 point awarded if capacity is not fully offered but the agent completed the task using a workaround

The open-ended test: make as much money as you can

The third test handed each agent the most rope. Each was given an identical daily prompt to make as much money as you can in realized dollars, long stocks and ETFs only, and to return back to 100% cash by the close. Nobody prompts the agent during the day; each had to schedule its own check-ins, so the cadence it chose became part of the test.

Given an open goal, Claude and ChatGPT tried similar approaches. They searched the web for what profitable traders supposedly do and came back with loose approximations of momentum trading, buying the day’s strong movers, setting stops, flattening at the close. The temperaments differed. ChatGPT checked in every five minutes and churned, thirteen round trips in a single day. Claude scheduled ten check-ins a day, honored the stops it set, and journaled lessons to itself. Gemini checked in a handful of times a day, never set a stop, and only ever traded Nvidia.

The self-journaling is worth pointing out as an example of something these agents can do that may surprise readers. When Claude bought into the top of an opening spike and had to sell at a loss, it wrote the mistake into the instructions it prepared for its own next morning, and the following day it cancelled two orders rather than chase a vertical open, citing the lesson. It noticed something, wrote it down, and behaved differently the following day. The loop is simple, but it offers a glimmer of what self-learning agents will eventually be able to do.

Gemini traded once a day and always the same stock. ChatGPT traded twenty-eight times and finished below where it started. Claude sat in the middle and finished ahead, mostly on a single day. All three had their best day on Tuesday and their worst on Wednesday, which is the clearest signal in the table: over three days on $500, the tape decided more of the outcome than the agents did. Gemini’s Wednesday stayed positive, but by barely trading, not by reading the day better.

The more useful finding is what one sentence produced. “Make as much money as you can” is an instruction, not a strategy, and each agent filled the gap in its own way. ChatGPT read it as a mandate for activity and traded twenty-eight times in three days. Claude read it as a directive to buy the day’s strongest movers, defend a stop, and write itself a lesson each night. Gemini read it as a constraint problem: find the one liquid stock it can hold in whole shares, buy it in the morning, sell it at the deadline, repeat. Asked to summarize the three days, Gemini described the outcome as “a 100% win rate across three days of disciplined trading.”

Given a real strategy, these agents could plausibly execute it faithfully. These tests were intentionally simplistic, meant to replicate the experience of having money managed by someone else. The agents would do considerably better with detailed, continuously updated system prompts (the standing instructions an agent reads before every message the user sends), which is where most of the context and judgment lives. But the average person who needs money management does not want to manage a system to that level of detail, so the agent is worth the most to the people who need help the least.

Security and liability

Security is an open question that this report does not answer. The vulnerabilities exist with long-lived API secrets sitting on a user’s machine with standing authority for software to make financial decisions. Nobody should assume these systems are safe until someone tests them thoroughly and we see what happens once they are widely available.

Liability is just as unsettled. When an agent hallucinates a ticker or sizes an order wrong, the loss lands on the customer: under today’s account agreements the agent is the customer’s instruction, not the broker’s advice, and no AI vendor accepts responsibility for trades its model places.

Our favorite combination

Ranked by ease of use, the spectrum runs like this. The easiest is no setup at all: Public’s on-site agent is already inside the app with nothing to wire, though you get the brokerage’s packaged assistant rather than an agent you choose. Robinhood is the easiest way to connect an agent you do choose. Its connector feels close to an ordinary app login. Public’s API access and Webull are the deep end, keys, short-lived tokens, and configuration files, with Webull’s tooling exposing the deepest capability set once you get there.

Ease is not the same thing as safety, so the same list is worth reading a second time as a risk posture. At Public and Webull, a third-party agent works inside a real account, at Public the main account itself, and nothing but the agent’s own reliability limits what a mistake can touch. Robinhood confines agents to dedicated, budget-capped agentic accounts with a kill switch. If ease decides, and for most people it will, we would point readers to the on-site agent at Public if they want the assistant handed to them, and to Robinhood if they want to bring their own. We would not send anyone to the deep end unless they arrive with a strategy that needs it.

Is any of this worth doing?

For most investors, today, the answer is no. After the setup effort, the security caveats, and the babysitting, what we built is roughly what a robo advisor already offers with none of the risk of an agent hallucinating an order. The value today accrues to a narrow group of technically comfortable, actively engaged investors who want a capable assistant and are willing to verify its work. This is a toolbox, not a solution.

Two caveats keep that from being the last word. First, the toolbox is genuinely powerful, particularly for day traders looking to implement complex, rules-based strategies; the agents did things no robo advisor can do. Second, every hard part of this, the keys, the connectors, the configuration, is exactly the kind of friction that platform companies are good at removing.

The pace of advancements

The entire category is under a year old. Alpaca, a developer-focused brokerage, shipped the first official agent interface in November 2025. Public opened agent access in March 2026, directly into the customer’s main account. Webull’s interface was quietly operational by April and formally announced in June. Robinhood launched “Agentic Trading” on May 27 with its ring-fenced account model. Interactive Brokers arrived in June where its agents can read everything and draft any order, but every trade waits for the human to approve it in the app, which is why Interactive Brokers does not appear in our head-to-head tests.

The three most trading-active retail platforms, Interactive Brokers, Robinhood, and Webull, all opened agent connectivity within a ten-week window. This is a customer-acquisition race for the most engaged traders. A recent survey of nearly a thousand US retail investors found 62% already use AI to inform investment decisions, while only 23% say they mostly or completely trust it. The brokers are building for the first number.

The heavy users today are not the mass market; they are the advanced end of the day-trading population, people who want to run algorithmic, rules-based strategies and previously had to write their own code against a broker’s API. They arrive with the strategy defined and the agent supplies the tireless execution.

Where this is going

The firms that hold much of America’s retail wealth, Schwab, Fidelity, Vanguard, are conspicuously absent from this discussion. Schwab is building its own guardrailed assistant inside its own app; its CEO has said the firm will “start to test how clients can interact with AI agents”, inside Schwab’s walls. Fidelity does not offer APIs to retail clients. Vanguard’s AI work is aimed at advisors. We do not expect these firms to open their doors to outside agents. We expect that the incumbents will prefer closed, integrated systems and will try to keep the intelligence built in, with the account access never leaving their system, which is the same pattern the big banks followed when they shut down screen-scraping and forced data aggregators onto their own paid rails.

That closed model is where the average investor will benefit. Everything that made our testing hard, the keys, the connectors, the entitlements, disappears when the AI ships inside the brokerage app, tested and warrantied by the firm that holds the account. Public’s on-site agent is the early template: the customer never sees a key or a connector, and the intelligence underneath is supplied the way we expect the whole industry to supply it, a frontier-lab model behind the firm’s own system prompts.

Nor does the category stop with traders. Today’s connectors and prompt boxes are the raw-material stage; a wave of packaged products is still to come, planning assistants, advisor-facing agents, out-of-the-box automated trading, and that second wave is the one most investors will actually meet.

The other door opens on the consumer side. Apple has built agent connectivity into the foundations of its upcoming operating systems, and the rebuilt Siri, capable of multi-step actions across apps, ships this fall. No brokerage has yet announced trade-capable Siri actions, and Apple has historically kept financial actions out of autonomous flows. But the day an investor can tell the assistant already in their pocket to rebalance an account, every conclusion in this report about setup difficulty becomes history. We think that day is closer than the current state of these tools suggests, and that setting up these tools will become trivial very soon.

Conclusion

Ten years ago we opened accounts at robo advisors because nobody else would tell investors the truth about a heavily marketed new category. The AI agent era needs the same thing, and sooner: the products are more powerful, the failure modes are more treacherous. What we found is a toolbox of capable, though occasionally dangerous, tools which are not yet a solution for anyone unwilling to read the manual. We will keep the accounts open, keep the tests running, and keep publishing what actually happens, unbiased, transparent, and free.