How Does AI Decide When to Buy or Sell? Inside a ChatGPT or Claude Trading Agent

A model proposes an action; the application determines what it can do

A ChatGPT trading bot or Claude trading bot is a system assembled around a model. The application chooses its task, observations, instructions and available tools. The model uses that context to produce an answer, a structured proposal or a tool request. The trading application then decides which requests are admissible, how much capital they may commit and how execution is recorded. A product name does not specify those rules.

There is no universal indicator recipe in that interface. One application can ask a model to interpret an earnings release; another can supply momentum features and request BUY, SELL or HOLD. A third can use a conventional numerical strategy while AI only helps write its code. To understand a decision, identify what role the model has and inspect the information it actually received.

OpenAI and Anthropic document client-tool workflows in which the model requests a named function with arguments and the application dispatches the implementation. That request is an intermediate message. A market-data tool must supply the relevant observations; a broker adapter and account authorization must exist before an admitted request can become a real order. Consumer chat products and developer-model applications have different integrations and permissions. [1] [2]

Our earlier AI trading agent guide explains the architecture. This investigation follows the control boundary: a constructed proposal is evaluated, sized, reserved, partially filled and reconciled. It also shows how the same proposed action changes when information or account state fails a check.

Start with one complete worked decision

Consider 16 deliberately constructed control cases around the same trading mandate. The clean BUY is admitted for 20.86 units. Its modeled stopped loss is $49.98061318 against a $50 planning budget. A later imposed price gap produces a $60.38976622 paper loss. Correct admission does not create a profitable trade or guarantee that the budget will contain the loss.

The instrument, prices, evidence, proposals and later outcome are constructed. No model API was called, and none of the proposals is attributed to ChatGPT or Claude. The purpose is to inspect decision-to-ledger mechanics without inventing model outputs, API timings or a trading track record.

The article shows the decision packet, proposal, sizing formulas, all 16 case outcomes and the cash-and-position transitions. The worked account ends with $9,939.61023378 and zero asset quantity. Sixteen constructed cases are neither sixteen market observations nor an estimate of model accuracy.

Freeze what is knowable before asking for a decision

The constructed packet uses the artificial instrument TP-USD. At 12:00:00 UTC on 22 October 2026, the account has $10,000 cash, no position and no outstanding order. The reference mid is 100, bid 99.95 and ask 100.05. A separate completed feature record has a constructed three-bar return of +1%. The feature supplies an illustrative premise for a BUY request; it has no demonstrated predictive value.

The decision packet records source IDs, observation times, availability times and account version. A record can describe an earlier event yet become available later. The controller checks both clocks against its own receipt time and the proposal cutoff. An assistant cannot make a future record usable by assigning it an earlier as_of label.

The later 97.50 outcome belongs only to the simulator. It is excluded from the proposer packet and from the governor’s policy settings. The earlier admission and size depend on the information available at entry; the subsequent outcome determines the later P&L. This separation addresses an application information boundary. It does not establish what a pretrained model might already know about recognizable historical events.

Fresh account state matters alongside fresh prices. The packet binds the market snapshot to account-v001, and account observation/availability times are checked separately. A correct quote cannot establish that a cached balance still reflects another order. A production implementation needs authoritative reconciliation and coordinated reservation at the point of admission.

Ask for a bounded proposal, with quantities owned by code

The example below is a constructed proposal, not a transcript from either provider. It requests BUY for a named snapshot, cites two record IDs and proposes a reference stop of 98. It cannot supply an order quantity, change the account, select an arbitrary execution destination or increase the risk budget. The application retains those authorities.

{
  "proposal_id": "proposal-001",
  "action": "BUY",
  "instrument": "TP-USD",
  "snapshot_id": "tp-snapshot-001",
  "as_of": "2026-10-22T12:00:00Z",
  "valid_until": "2026-10-22T12:00:30Z",
  "evidence_ids": [
    "quote-Q001",
    "feature-F001"
  ],
  "observed_reference_price": 100,
  "stop_reference_price": 98,
  "rationale": "Constructed example only: the positive feature motivates a hypothetical BUY request; no forecasting evidence is supplied.",
  "confidence_label": "MEDIUM"
}

A structured output or strict tool interface makes fields and permitted values easier to enforce. It does not establish that an economic interpretation is correct. Provider APIs also have exceptional outcomes such as refusals, incomplete responses and tool errors; the application must inspect completion status and validate what it receives. Shape validation and the financial checks below answer different questions. [3] [4]

The governor checks the structured observed price against the authoritative quote and the cited IDs against available records. It does not determine whether the free-text rationale follows from those records. This distinction becomes visible in the presentation-only case: the rationale falsely says the price is 120, while the structured price remains 100. The admitted size stays unchanged, and the unsupported sentence remains unsupported.

Follow the admitted BUY through the arithmetic

The governor permits one active intent or position, a planned loss budget of 0.5% of marked equity and reference-mid notional no greater than 25% of equity. Quantity increments are 0.01 and the assumed minimum pre-fee order notional is $10. These are disclosed policy choices for the exercise, not recommended limits or current venue specifications.

The entry convention fills at ask × 1.0005 and charges 0.1% of execution value in USD. For planning, a stop referenced to mid 98 is converted to a modeled bid using a 0.05% half-spread, then receives another 0.05% adverse execution adjustment and the same fee. The exact planned loss per unit is entry cash paid minus modeled net stop proceeds.

Entry fill is 100.100025; entry cash per unit including commission is 100.200125025. Modeled stop fill is 97.90202450, and modeled net stop proceeds are 97.80412247550. The difference is 2.39600254950 per unit. A $50 budget permits about 20.86809132 units before rounding. The 25% reference-notional cap permits 25 units, while available cash permits more. The risk ceiling binds, so the admitted quantity is 20.86.

entry_cash_per_unit = ask × (1 + adverse_fraction) × (1 + fee_fraction)
modeled_stop_net_per_unit = stop_mid × (1 - half_spread_fraction) × (1 - adverse_fraction) × (1 - fee_fraction)
planned_loss_per_unit = entry_cash_per_unit - modeled_stop_net_per_unit
risk_quantity = marked_equity × risk_budget_fraction / planned_loss_per_unit
cap_quantity = marked_equity × reference_notional_cap_fraction / reference_mid
cash_quantity = authorized_available_cash / entry_cash_per_unit
quantity = floor(min(risk_quantity, cap_quantity, cash_quantity) / quantity_increment) × quantity_increment

At that quantity, reference-mid notional is $2,086.00, planned stopped loss is $49.98061318 and entry cash reserved is $2,090.17460802. Reference notional and cash commitment differ because entry execution and commission are included in the latter. A HIGH confidence label does not appear anywhere in the sizing calculation.

The same BUY becomes a smaller order, a skip or a block

The table considers all 16 constructed cases. Most change one conceptual condition from the clean BUY. The held-position SELL is a separately labeled positive control, and the two ID replays declare their prior intent state. Each case starts from its stated account conditions. They must not be added together as trades from one portfolio.

The positive controls matter: rejecting everything would also reject the admissible BUY, owned-position SELL and tighter-cap cases. HOLD, a flat-account SELL, a below-minimum skip, an unknown-state block and a duplicate suppression have different meanings. They should not all be relabeled as an AI choosing to wait.

The 5% cap case admits 5.00 units. In the $5-authorized-cash case, the account’s marked equity remains $10,000 but the candidate quantity falls to 0.04 units and fails the minimum. It is skipped instead of being rounded upward. The UNKNOWN case blocks a replacement until state is reconciled; it does not assume that the earlier order failed.

These are controlled examples of application behavior, with the changed condition and resulting disposition shown together. They supply no model error rate, market hit rate, attack-success rate or production reliability estimate. The useful question is which rule explains each admitted, reduced, skipped or blocked request.

A reservation, an order and a fill change different records

Admission creates intent-proposal-001 and reserves $2,090.17460802. Cash is still $10,000 at that point; the reservation limits what can be committed elsewhere. The paper execution then reports 12.00 units at 12:00:01 UTC and the remaining 8.86 units at 12:00:02. The artificial ask is held constant for both fills. These are imposed stable-price execution fixtures, not later observed market quotes.

After the first fill, cash is $8,797.59849970, inventory is 12.00 units and $887.77310772 remains reserved. Marked equity at mid 100 is $9,997.59849970. Subtracting the reservation again would understate NAV: it is an internal commitment against cash, not an additional economic loss. Available cash and account equity answer different questions.

Replaying the identical first fill ID leaves the account unchanged. A new proposal with a fresh account version is still blocked while the first intent is partial. After the second fill, the account holds 20.86 units and cash of $7,909.82539198. The remaining reservation becomes zero. This trace verifies internal fill ingestion and commitments in a single-process paper state machine.

The intent fingerprint uses structured fields and exact decimal canonicalization; presentation text has no authority. An identical structured request under the same ID creates no second internal intent, while a changed structured request under that ID conflicts. This does not guarantee exactly-once execution at an external broker. Real recovery must query orders and fills, persist reconciled state and handle changed reports, partial cancellations and network uncertainty.

The admitted trade loses more than its planning budget

At 12:05:00 UTC, the simulator receives the separately frozen midprice of 97.50, below the stored stop reference of 98. The independent stop handler creates paper-stop-exit-001 for the full position. The exit fill is 97.50 × 0.9995 × 0.9995 = 97.402524375, with another 0.1% commission. This exit is triggered by the simulator’s stored rule; it is not a new model prediction.

At reference mids, the move loses 20.86 × (97.50 − 100) = $52.15. Bid/ask and adverse execution add $4.11986304 of shortfall. Entry and exit commissions total $4.11990318. The resulting net loss is $60.38976622, or 0.60389766% of initial account equity, leaving $9,939.61023378 and no asset position. Each cost is deducted once.

The planned $49.98061318 stopped loss used an assumed gap-free exit around mid 98. The imposed gap invalidates that execution assumption. Passing the risk check therefore does not cap the realized loss at $50. The relevant response is to examine the planning assumption and gap exposure, while preserving the original decision record.

The cash, position and cost balances reconcile: initial equity plus net P&L equals the final flat-account cash balance. Cash doing nothing returns zero in this no-interest exercise. One imposed path cannot establish an investment ranking, expected return or probability of future loss.

A stated reason is useful evidence to inspect, not a causal proof

The presentation-only case gives a precise answer to one question: more emphatic language does not increase size in this controller. It also exposes a limit. The program accepts the structured BUY while leaving the false prose price claim unchecked. Matching evidence IDs establish reference consistency; they do not establish that the rationale is true, that the cited record entails the conclusion or that the trade has an edge.

Research by Chen and colleagues tested whether model-generated reasoning disclosed influential hints in controlled multiple-choice settings. Influential hints were not always acknowledged. The finding supports caution about using an explanation as a complete causal audit; it is not a measurement of this trading setup or proof that every explanation is false. Retain the actual packet, tool calls, outputs and controller results alongside a concise stated rationale. [5]

A HIGH label, an answer-token likelihood and an empirically calibrated probability of an after-cost win are different quantities. Kadavath and colleagues studied task- and elicitation-dependent self-evaluation in earlier language models. Their results do not turn a trading confidence field into a validated probability. A financial calibration claim needs a defined instrument, horizon, trade rule, cost model and subsequent outcomes. Our market-prediction protocol treats that as a separate investigation. [6]

For text-driven signals, require claims that can be checked: what was reported, when it became available and which record supports the interpretation. Audit factual extraction and semantic support separately from order validity. Correctly reading a document can still lead to an unprofitable trade if the market already reflected the news or the relevant move occurs before execution.

Imported text cannot grant trading authority

A filing, news page or tool result can contain instructions aimed at the model. The application should treat that material as evidence to evaluate, rather than a mandate to change accounts, increase leverage or disable limits. Anthropic’s guidance describes this indirect-injection boundary. Keep the permitted tools and financial limits enforced outside the model’s generated text. [7]

AgentDojo’s original agent-security benchmark studies benign tasks and attacks in simulated application environments. It motivates testing both useful task completion and harmful redirection, not merely testing whether a model refuses every request. Its results are not a security certification for a trading bot. [9]

Our malformed-quantity case shows that a proposal cannot add an unauthorized sizing field to this contract. The narrative case shows that prose does not override the governor. Neither is a prompt-injection test against ChatGPT or Claude, because no model consumed an attack here. A real model-facing security evaluation must pass the adversarial material through the actual model and tool setup and inspect final state.

A schema-valid malicious proposal can still fit every financial limit. Independent controls bound permitted actions; they cannot manufacture sound intent or investment value. Limiting authority and testing the signal’s usefulness are complementary jobs.

Where a language model earns its place in the system

If a strategy is completely specified by numerical thresholds, compute those thresholds directly. A Python trading bot or Pine Script strategy can evaluate a fixed rule without making an LLM call at each bar. AI can still help implement the strategy, review the ledger or diagnose an error. That is a different role from choosing trades online.

For someone learning how to build a trading algorithm, write the trading mandate and measurable acceptance conditions first. Codex or Claude Code can help implement the packet builder, decimal sizing, tests and adapters. Keep versions of those components as carefully as versions of the signal. A TradingView trading bot bridge must preserve the alert time, order policy and reconciliation rather than treating an alert as a fill.

An online LLM role is more plausible when the task needs interpretation that a simple numerical rule does not provide, such as classifying a filing under a defined taxonomy. Record the extracted claim, its source and the resulting action. Then test whether that interpretation adds value after its latency, data costs and inference costs. The worked analysis here does not establish that incremental benefit.

A useful proposal brief asks for evidence references, a concise rationale and HOLD when a required premise is missing. That is an interface requirement, not a prompt proven to generate profitable trading. A sensible first milestone is a paper pipeline that can explain every accepted, blocked, skipped and unresolved request from its records.

Separate controller correctness, model behavior and trading edge

Evaluate three layers separately. For the controller, use independent numerical identities, controlled bad inputs, positive controls and state reconciliation. For the model, make actual requests using frozen packets and record exact provider/model versions, prompts, tool results, sampling settings, refusals, retries and costs. For the strategy, seal decisions before market outcomes and evaluate their incremental after-cost value against reasonable alternatives.

Anthropic’s agent-evaluation guidance distinguishes transcripts and final outcomes. That distinction matters here: a model saying “order filled” is a statement; the fill ledger and resulting position establish the environment state. In a real provider comparison, measure usable-proposal rate, evidence accuracy, action stability, latency and cost under the same harness. Repeated calls on one packet are repeated trials of that packet, not independent market opportunities. [8]

To avoid overfitting trading strategies, retain every model, prompt and threshold variant tried. Trading strategy optimization includes choosing the prompt that happens to fit a historical period. Out-of-sample testing and walk-forward analysis must respect what was available at each decision and which earlier outcomes were used to choose the next version. Recognizable historical events can introduce training-data hindsight even when application timestamps are correct.

Keep the same risk and execution machinery for the LLM and a no-LLM baseline. Otherwise a difference in costs or sizing can masquerade as superior reasoning. A Monte Carlo trading simulation can examine consequences conditional on its inputs, but it does not supply a missing predictive edge or calibrate an informal confidence label. Our executed ML backtest and algorithm-building study investigate the separate evidence needed for strategy performance.

What the investigation establishes

A trading decision is distributed across the model interface, the application’s mandate, the risk governor and the execution record. In the worked cases, the same BUY request keeps the same size when its prose becomes more confident, shrinks under a tighter cap, skips when authorized cash cannot support a valid order and blocks when previous order state is unknown.

The admitted order then loses $60.38976622 on its constructed gap path despite passing a $50 planning-budget check. The ledger preserves that result instead of rewriting the entry explanation. The arithmetic explains the loss; the control-case outcomes do not establish that ChatGPT or Claude predicts the market.

When assessing an AI trading system, ask to see the packet, the structured proposal, the exact authority that admitted it, the order and fill records, and the reconciled account outcome. Those records explain what the system actually did. A persuasive BUY paragraph supplies only one part of that chain.