An AI copilot and an autonomous AI agent can run on the identical model. What matters is custody: does the AI only suggest, with you clicking every trade, or does it hold the keys and execute on its own? Everything else is decoration.
Key Takeaways
- The real dividing line is who holds the funds and who clicks confirm — not whether a product calls itself a “copilot” or an “agent.”
- Bitrue sells both: an explain-only AI copilot (early access, no execution) and a separate copy-trading feature that hands users’ portfolios to an AI model to trade automatically.
- In May 2026, an attacker used a permission NFT plus a Morse-code message on X to make the AI agent behind the Bankr trading bot transfer roughly $150,000–$200,000 — because its spending limit lived inside the model’s instructions, not outside them.
- Anthropic’s red-team research found frontier models could already reproduce $4.6 million of historical smart-contract exploits in simulation — the capability risk exists whether or not a product markets itself as “autonomous.”
What “copilot” means at the company that sells both products
Bitrue is a useful case because it did not have to be hypothetical about the difference — it built both products. Bitrue AI launched in early access as an “explainable” copilot: pick an asset and a risk tier, get one of eight pre-built strategies with a stated rationale. It does not place a trade — a person still acts on what it says.
Separately, Bitrue’s AI copy-trading service, live since November 20, 2025, lets a user pick from six AI models — GPT-5, Gemini 2.5 Pro and Claude Sonnet 4.5 among them — allocate funds, and let that model manage the position without a per-trade click. That is a different custody arrangement wearing a similar “AI” label.
The reporting does not detail execution limits beyond the chosen allocation — worth noting, since a feature that moves funds automatically is only as safe as the limits around it.
Neither is “the agent” and the other “the copilot” in an absolute sense — the copy-trading tool is more autonomous because it removes the human click, not because it uses a smarter model.
Where a soft limit actually breaks: the Grok/Bankrbot case
A documented example of what happens when a spending limit is only a sentence in a system prompt happened on May 4, 2026, logged in the OECD’s AI incident tracker. An attacker first sent a “Bankr Club Membership NFT” to a wallet controlled by an AI agent built on Grok, running through the Bankr bot on X. Holding that NFT reportedly granted “Executive” permissions, bypassing the account’s standard transfer limits.
With that escalation in place, the attacker posted a reply on X in Morse code, asking Grok to translate it. The decoded text was itself an instruction: send 3 billion DRB tokens to a specific address. The agent treated the translated text as an authenticated command rather than untrusted content it had merely been asked to decode, and executed the transfer.
Reported losses range from $150,000 to $200,000, depending on which day’s token price an outlet used; roughly 80% was later recovered after the community identified the attacker.
Two failures stacked here: a permission system that let one asset silently raise another’s spending ceiling, and a limit that existed only as an instruction the model could be talked out of. Neither required breaking any cryptography.
The baseline risk exists even without an attacker
It’s tempting to treat the Bankr incident as a one-off — a bot with unusually loose permissions, hit by a clever trick. Anthropic’s Frontier Red Team gives a reason not to be reassured.
Its published research built a benchmark, SCONE-bench, from 405 real contracts exploited between 2020 and 2025, then tested Claude Opus 4.5, Sonnet 4.5 and GPT-5 against contracts exploited after each model’s training cutoff, so the models could not have memorized the answer.
Working only inside simulators, never on a live chain, the models reconstructed exploits worth $4.6 million in simulated funds. Sonnet 4.5 and GPT-5 also found two new vulnerabilities worth $3,694 combined — GPT-5 found one at an API cost of about $3,476, meaning automated discovery is already close to break-even for an attacker.
| What was tested | Result |
|---|---|
| Historical exploits reproduced (post-cutoff contracts) | $4.6M in simulated funds, across Claude Opus 4.5, Sonnet 4.5, GPT-5 |
| Genuinely new vulnerabilities found | 2, worth $3,694 combined; one found by GPT-5 at ~$3,476 in API cost |
| Where testing happened | Simulators only — Anthropic states it never tested exploits on live chains |
None of this means every AI agent is a lurking exploit engine. It means the capability already exists in general-purpose models, regardless of whether the product built on top calls itself a copilot. The real question is what stands between that capability and your funds.
Two Lenses
Wanting to stop watching the screen
The appeal of the copy-trading version is not laziness so much as a real limit: no person can watch a market continuously, and much of a fast-moving trade’s value comes from acting within minutes. Handing that job to a model that never sleeps is a rational trade for anyone who has watched a good setup evaporate mid-meeting.
Wanting a hand on the wallet at all times
The same person also does not want to learn, after the fact, that the “AI” managing their funds could be redirected by a stranger’s social-media post. The Bankr case is uncomfortable because nothing about it required the victim to make a mistake. Wanting both convenience and control at once is not a contradiction to resolve; it is the design brief for anyone choosing one of these tools.
Five questions before you grant custody
Five questions do more work than a product’s name:
| Question | If the answer is concerning |
|---|---|
| Does it hold funds/keys, or only suggest? | Custody products (copy-trading, agent wallets) carry execution risk a suggestion tool does not |
| Who clicks “confirm” — you, every time, or the agent? | No per-trade confirmation means a bad instruction executes before you see it |
| Where is the spending limit enforced — in the model’s prompt, or outside the model entirely? | A prompt-based limit can be argued away by injected text, as in the Bankr case |
| Can the agent act on content it merely reads (a post, a message, an API response)? | If reading equals following orders, any public content becomes an attack surface |
| Is there a fast, external kill switch that doesn’t depend on the agent’s own cooperation? | If revoking access requires the agent to behave correctly first, it isn’t really a kill switch |
Infrastructure is starting to answer the third question directly. Cloudflare launched wallet infrastructure for AI agents on August 4, 2026, enforcing spending caps at the wallet’s API layer — outside the model’s prompt — because a prompt-based limit is the failure mode the Bankr breach demonstrated. As of launch, Cloudflare was only opening handle reservations; full infrastructure ships over the following months, so it’s a direction, not yet something to rely on.
What would change our view
We would trust a custody-holding AI product more if its spending limits were verifiably enforced outside the model — at the wallet or payment infrastructure — and tested against adversarial prompts, not just described in a blog post.
We would grow more cautious about any product that lets one credential silently expand what another is allowed to do. That pattern, not the AI itself, is what let the Bankr attacker’s Morse code become a transfer instruction.
FAQ
Q. Is an “AI trading copilot” safe to connect to my exchange account?
A. Check what it’s actually authorized to do. An explain-only copilot that requires you to place every trade carries different risk than one with trading permissions, even if both are called “copilot.”
Q. Does a well-known model like GPT-5 or Claude make an agent safer with funds?
A. Not by itself. Model quality doesn’t substitute for how spending limits and permissions are enforced around it.
Q. What made the Grok/Bankrbot breach possible?
A. An NFT that silently escalated the agent’s spending permissions, plus a transfer limit that existed only as a model instruction, not wallet-enforced.
Sources
- Anthropic, “Frontier models exploit unpatched, exploitable smart contract vulnerabilities” — SCONE-bench methodology and simulated exploit figures
- OECD.AI Incident Tracker, incident 2026-05-04-4a73 — record of the Grok/Bankrbot prompt-injection transfer
- Giskard, “How Grok got prompt-injected” — NFT permission escalation and Morse-code mechanism
- BeInCrypto, “Bitrue Launches AI Copilot That Explains the ‘Why’ for XRP and Crypto Trades” — Bitrue AI’s explain-only design
- Finance Magnates, “Bitrue to Let Investors Hand Crypto Portfolios to AI” — copy-trading launch and model list
- Help Net Security, “Cloudflare gives AI agents wallets with built-in spending controls” — infrastructure-layer spending caps
Leave a Reply