Most of the broker AI connections launched this year fall into three buckets. The AI can look, the AI can draft an order you approve, or the AI can place the order itself. CMC Markets' new ChatGPT link for UK CFD clients sits firmly in the first bucket: balances, positions, orders and prices, but no trading and no moving money. Public's new prediction-market agents sit in the third. Which bucket you're in matters more than which model is behind it, because it decides where your stoploss, position size and max daily loss are actually enforced.
Three permission levels
Here's how the recent launches sort out, going by Finance Magnates' round-up and the brokers' own announcements.
Look. CMC Markets launched its ChatGPT connection on 24 September. It covers UK CFD accounts only; spread betting accounts aren't included. IG Australia did something similar in May, with client sentiment and transaction history added. In both cases the assistant reads your account and can't change anything.
Draft and approve. Interactive Brokers lets Claude, ChatGPT and Grok draft orders, but each one needs your manual approval before it goes. Leverate's version also sends orders only after the trader approves them.
Execute. Spotware's cTrader lets AI tools place trades and manage positions directly. ThinkMarkets allows execution but blocks access to funds. And on 24 September, Public launched AI agents for prediction markets, with Kalshi handling market access. Members can trade the events themselves or authorise an agent to trade on its own. One of Public's own examples is buying a stock if the probability of an FDA approval reaches a set level.
Note that the "AI" in these announcements is mostly the same handful of models. What actually separates the products is the permission the broker grants.
What read-only is genuinely good for
Read-only gets written off as the timid option. It isn't useless. Asking "what's my open risk across these three positions" or "which orders are still working" in plain English is handy, particularly on a phone when you're away from the platform. It also makes a decent journaling aid: pull the day's fills and write your notes against them.
BUT know what data you're getting. CMC shows live prices where real-time data is available, and 15-minute-delayed prices where it isn't. Its own product page warns that responses "can be inaccurate or delayed". That's fine for a review at the end of the day. It's not something to base an entry on.
Where the risk logic should live
This is the part that matters once you move past read-only. A stoploss, a max position size and a max daily loss are rules. Rules belong in deterministic code or in broker-side settings, where they behave the same way every time. For example:
- a NinjaTrader 8 strategy, or an ATM template that attaches the stop and target on entry
- an MT5 Expert Advisor with a hard cap on lot size and a stop on every order
- a daily loss limit set at the broker or prop firm, where one is offered
What you don't want is the only copy of a risk rule sitting in a prompt. "Never risk more than 1% per trade" typed into a chat is a request, not a control. The model will usually follow it. Usually isn't the standard you'd accept from a stoploss.
So the practical split is this. Let the AI propose or place orders if you want to. But make sure whatever flattens you at your max daily loss doesn't depend on the AI agreeing to it.
Why you can't backtest a conversation
A coded strategy gives the same output for the same bars. That's what makes the Strategy Tester, market replay and single-trade forensics work. You can go to trade 47 and see exactly which condition fired and why.
A language model doesn't behave like that. Ask the same question twice with the same data and you can get two different answers, and small changes in the prompt wording change the result. There's no real equivalent of running it over five years of tick data and reading the report.
That doesn't make it useless. It changes what testing means. If an AI is placing orders, log every prompt, every response and every order it sends, with timestamps. When something odd happens, those logs are your only way to reconstruct why. It's the same job as pulling NinjaTrader's log files or the Experts and Journal tabs in MT5 when an EA misbehaves.
For Australian readers, there's a regulatory side to this too. ASIC's market integrity rule changes of 24 September tighten controls on automated and AI-enabled trading. As Finance Magnates reports it, the rules define a trading algorithm as software that decides order parameters (placement, timing, price or quantity) with limited or no human input. The obligations sit with market participants rather than retail traders, and they don't apply until 2028. Still, an AI agent choosing when and how much to buy looks a lot like that definition.
A sensible setup
If you're going to try one of these, this is the order I'd go in:
- Start read-only. Use it for a few weeks and check how often it gets your account state right.
- Keep trade permission separate. Good implementations split them. CrossTrade's MCP server for NinjaTrader 8, for example, has separate
mcp:readandmcp:tradescopes, with confirmation gates before any trading action. Only switch on the second when you've got a reason to. - Prefer approve-first over fully autonomous while you're learning how it behaves. One click per order is a cheap brake.
- Keep hard limits outside the AI: stops attached by the platform or the EA, position caps, and a daily loss limit.
- Log everything, and actually read the logs.
Give it eyes before you give it hands, and keep the stoploss somewhere it can't argue with.