An AI copilot and an autonomous AI agent can run on the identical model. What matters is custody: does the AI only suggest, with you clicking every trade, or does it hold the keys and execute on its own? Everything else is decoration.
This page tests that one question, who holds the keys, against public incidents and vendor documentation. Its sibling, AI Agent or AI Copilot? The Line We Actually Draw at 2mind, describes the approval boundary 2mind applies to its own AI roles. Use this page to judge a product, that one to design a process.
General information only, not financial, investment or legal advice. Nothing here recommends using or avoiding any trading product.
Key Takeaways
- The real dividing line is who holds the funds and who clicks confirm — not whether a product calls itself a “copilot” or an “agent.”
- Bitrue sells both: an explainable AI trading copilot that shows its reasoning and lets the user decide whether to launch a strategy, and a separate copy-trading feature that hands users’ portfolios to an AI model to trade automatically.
- In May 2026, an attacker used a permission NFT plus a Morse-code message on X to make the AI agent behind the Bankr trading bot transfer roughly $150,000–$200,000 — because a permission NFT raised its limits inside the Bankr system and a model-translated reply was then executed as a command.
- Anthropic’s red-team research found frontier models could already reproduce $4.6 million of historical smart-contract exploits in simulation — the capability risk exists whether or not a product markets itself as “autonomous.”
- The custody test is not crypto-specific: for coding, mail or operations agents, vendor documentation draws the same line between what an agent may do alone and what needs a human approval or an enforced limit outside the model.
What “copilot” means at the company that sells both products
Bitrue is a useful case because it did not have to be hypothetical about the difference — it built both products. Bitrue AI launched as an “explainable” copilot: pick an asset and a risk tier, get one of eight AI-generated strategies with a stated rationale.
Bitrue says it can also support automated execution and monitoring once the user launches a strategy, so the user’s decision to launch is the human step.
Separately, Bitrue’s AI copy-trading service, live since November 20, 2025, lets a user pick from six AI models — GPT-5, Gemini 2.5 Pro and Claude Sonnet 4.5 among them — allocate funds, and let that model manage the position without a per-trade click.
That is a different custody arrangement wearing a similar “AI” label.
The reporting does not detail execution limits beyond the chosen allocation — worth noting, since a feature that moves funds automatically is only as safe as the limits around it.
Neither is “the agent” and the other “the copilot” in an absolute sense — the copy-trading tool is more autonomous because it removes the human click, not because it uses a smarter model.
Where a soft limit actually breaks: the Grok/Bankrbot case
A documented example of what happens when permissions and limits are loosely enforced around an AI agent happened on May 4, 2026, logged in the OECD’s AI incident tracker.
An attacker first sent a “Bankr Club Membership NFT” to a wallet controlled by an AI agent built on Grok, running through the Bankr bot on X.
Holding that NFT reportedly granted “Executive” permissions, bypassing the account’s standard transfer limits.
With that escalation in place, the attacker posted a reply on X in Morse code, asking Grok to translate it. The decoded text was itself an instruction: send 3 billion DRB tokens to a specific address.
The agent treated the translated text as an authenticated command rather than untrusted content it had merely been asked to decode, and executed the transfer.
Reported losses range from $150,000 to $200,000, depending on the outlet and token price used; roughly 80% was later recovered after the community identified the attacker.
Two failures stacked here: a permission system that let one asset silently raise another’s spending ceiling, and a pipeline that executed a model’s translated public reply as a command without a separate human or wallet-level check. Neither required breaking any cryptography.
The baseline risk exists even without an attacker
It’s tempting to treat the Bankr incident as a one-off — a bot with unusually loose permissions, hit by a clever trick. Anthropic’s Frontier Red Team gives a reason not to be reassured.
Its published research built a benchmark, SCONE-bench, from 405 real contracts exploited between 2020 and 2025, then tested Claude Opus 4.5, Sonnet 4.5 and GPT-5 against contracts exploited after each model’s training cutoff, to reduce the chance that the models had memorized them.
Working only inside simulators, never on a live chain, the models reconstructed exploits worth $4.6 million in simulated funds.
Sonnet 4.5 and GPT-5 also found two new vulnerabilities worth $3,694 combined — GPT-5 scanning all 2,849 contracts cost about $3,476 in API fees — roughly $1,738 per vulnerability found against about $1,847 average revenue per exploit — so automated discovery is already close to break-even for an attacker.
| What was tested | Result |
|---|---|
| Historical exploits reproduced (post-cutoff contracts) | $4.6M in simulated funds, across Claude Opus 4.5, Sonnet 4.5, GPT-5 |
| Genuinely new vulnerabilities found | 2, worth $3,694 combined; GPT-5 scan of all 2,849 contracts cost ~$3,476 in API fees |
| Where testing happened | Simulators only — Anthropic states it never tested exploits on live chains |
None of this means every AI agent is a lurking exploit engine. It means the capability already exists in general-purpose models, regardless of whether the product built on top calls itself a copilot. The real question is what stands between that capability and your funds.
The same custody test for coding, email and operations agents
Nothing in the five questions is specific to crypto. Replace “funds and keys” with whatever the agent can change without a person approving it: files, shell commands, mailboxes, tickets, production settings. Vendor documentation shows the same split between what an agent may do alone and what needs a human.
| Custody test | Coding or operations agent | What the vendor documents |
|---|---|---|
| Does it hold keys, or only suggest? | Can it edit files, run shell commands or call connected tools? | Claude Code asks before shell commands, file edits and most web fetches in manual mode. File reads inside the working directory need no approval. |
| Who clicks confirm? | Which actions run without a prompt? | Claude Code’s bypassPermissions mode skips prompts; its docs say to use it only in isolated environments such as containers or VMs. OpenAI advises keeping tool approvals on for MCP tools. |
| Where is the limit enforced? | Is the limit a rule or sandbox outside the model? | Claude Code checks deny rules before ask and allow rules. Its Bash sandbox is enforced by the operating system, but covers shell commands only. |
| Can it act on content it merely reads? | Can a web page, ticket or email steer a tool call? | OpenAI defines prompt injection as untrusted text or data that tries to override the AI’s instructions, for example tricking an agent into sending raw customer records. |
| Is there an external kill switch? | Can access be removed without the agent’s cooperation? | In Claude Code, a deny rule naming a whole tool removes it from the model’s context and takes effect from the next tool call, even if added mid-session. |
Anthropic’s “Building effective agents” separates workflows, which follow predefined code paths, from agents, where the model directs its own tool use.
It says agents can pause for human feedback at checkpoints, that stopping conditions such as a maximum number of iterations maintain control, and that autonomy brings higher costs and compounding errors.
Two limits apply. Claude Code also offers an auto mode in which a background classifier, not you, checks actions before they run; that is a different control from a per-action click. And its sandbox does not cover file tools, MCP servers or hooks.
These are documented settings, not proof that any given setup is safe.
Decision rule, our synthesis rather than a vendor claim: give an agent only access whose worst misuse you could undo, keep anything irreversible behind a human click or a limit enforced outside the model, and treat every piece of text the agent reads as untrusted.
Two Lenses
Wanting to stop watching the screen
The appeal of the copy-trading version is not laziness so much as a real limit: no person can watch a market continuously, and much of a fast-moving trade’s value comes from acting within minutes.
Handing that job to a model that never sleeps is a rational trade for anyone who has watched a good setup evaporate mid-meeting.
Wanting a hand on the wallet at all times
The same person also does not want to learn, after the fact, that the “AI” managing their funds could be redirected by a stranger’s social-media post. The Bankr case is uncomfortable because the reported attack used only a public social-media post and an NFT transfer.
Wanting both convenience and control at once is not a contradiction to resolve; it is the design brief for anyone choosing one of these tools.
Five questions before you grant custody
Five questions do more work than a product’s name:
| Question | If the answer is concerning |
|---|---|
| Does it hold funds/keys, or only suggest? | Custody products (copy-trading, agent wallets) carry execution risk a suggestion tool does not |
| Who clicks “confirm” — you, every time, or the agent? | No per-trade confirmation means a bad instruction executes before you see it |
| Where is the spending limit enforced — in the model’s prompt, or outside the model entirely? | A prompt-based limit can be argued away by injected text; the Bankr case showed a related failure, where permissions were escalated and a model reply was executed |
| Can the agent act on content it merely reads (a post, a message, an API response)? | If reading equals following orders, any public content becomes an attack surface |
| Is there a fast, external kill switch that doesn’t depend on the agent’s own cooperation? | If revoking access requires the agent to behave correctly first, it isn’t really a kill switch |
Infrastructure is starting to answer the third question directly. Cloudflare launched wallet infrastructure for AI agents on August 4, 2026, enforcing spending caps at the wallet’s API layer — outside the model’s prompt.
That addresses limits written as instructions. Whether it would stop a permission-escalation path like the Bankr NFT depends on who may raise the caps, which the launch coverage does not detail.
As of launch, Cloudflare was only opening handle reservations; full infrastructure ships over the following months, so it’s a direction, not yet something to rely on.
What would change our view
We would trust a custody-holding AI product more if its spending limits were verifiably enforced outside the model — at the wallet or payment infrastructure — and tested against adversarial prompts, not just described in a blog post.
We would grow more cautious about any product that lets one credential silently expand what another is allowed to do. That pattern, not the AI itself, is what let the Bankr attacker’s Morse code become a transfer instruction.
FAQ
Q. Is an “AI trading copilot” safe to connect to my exchange account?
A. Check what it’s actually authorized to do. An explain-only copilot that requires you to place every trade carries different risk than one with trading permissions, even if both are called “copilot.”
Q. Does a well-known model like GPT-5 or Claude make an agent safer with funds?
A. Not by itself. Model quality doesn’t substitute for how spending limits and permissions are enforced around it.
Q. What made the Grok/Bankrbot breach possible?
A. An NFT that silently escalated the agent’s spending permissions, plus a pipeline that executed a model-translated public reply as a transfer command.
Q. Does the custody test apply outside crypto?
A. Yes. For a coding, email or operations agent, ask what it can change without approval, where the limit is enforced, and whether text it reads can steer its actions. Vendor documentation from Anthropic and OpenAI covers each of these controls.
Sources
- Anthropic, “Frontier models exploit unpatched, exploitable smart contract vulnerabilities” — SCONE-bench methodology and simulated exploit figures
- OECD.AI Incident Tracker, incident 2026-05-04-4a73 — record of the Grok/Bankrbot prompt-injection transfer
- Giskard, “How Grok got prompt-injected” — NFT permission escalation and Morse-code mechanism
- BeInCrypto, “Bitrue Launches AI Copilot That Explains the ‘Why’ for XRP and Crypto Trades” — Bitrue AI’s explainable-strategy design
- Finance Magnates, “Bitrue to Let Investors Hand Crypto Portfolios to AI” — copy-trading launch and model list
- Help Net Security, “Cloudflare gives AI agents wallets with built-in spending controls” — infrastructure-layer spending caps
- Anthropic, “Building effective agents” — Anthropic, December 19, 2024; workflows versus agents, human checkpoints, stopping conditions
- Claude Code, “Permissions” — Anthropic documentation, accessed October 2, 2026; approval defaults, rule order, bypass and auto modes
- Claude Code, “Sandboxing” — Anthropic documentation, accessed October 2, 2026; operating-system enforcement and its scope
- OpenAI, “Safety in building agents” — OpenAI documentation, accessed October 2, 2026; prompt injection and tool approvals
Correction, October 2, 2026. An earlier version described Bitrue’s AI copilot as explain-only with no execution; Bitrue says it can support automated execution once the user launches a strategy.
It said the Bankr/Grok limit existed only in a system prompt; reporting describes a permission NFT that raised the agent’s limits and a model-translated reply executed as a command.
It also said GPT-5 found one vulnerability for $3,476; that was the cost of scanning all 2,849 contracts.
Update, October 2, 2026. Added a mapping of the custody test to coding and operations agents, a not-advice line, and a link to the sibling post. Removed a generic “Two Lenses” section. Corrected an image description and a Cloudflare sentence that still described the Bankr case as a prompt-only limit.
Leave a Reply