This one is subtle because nothing looks "hacked" — your agent dutifully places an order. It just buys the wrong thing. When an agent maps a name or a story to a ticker, that mapping is a step an attacker can corrupt.

How it works

  • Look-alike symbols. A well-known company and an unrelated microcap can have confusingly similar tickers. An agent told to "buy the company in this headline" can resolve to the wrong one — sometimes a thinly-traded name someone wants you buying.
  • Planted tickers. Injected text ("the ticker is XYZ") in an article or post overrides the agent’s own lookup, pointing it at a manipulated security.
  • Newly listed / confusable names. Around IPOs, spin-offs, and ticker changes, the name-to-symbol mapping is genuinely ambiguous — fertile ground for misdirection.

The result is real money into a security you never intended, often one chosen because it’s easy to manipulate.

The defense is mostly one control

  • An allowlist. If the agent can only trade the exact symbols you approved, a look-alike or planted ticker has nowhere to go — the order is simply refused. For a focused setup this is the highest-leverage guardrail you can set. (How to set limits and lists.)
  • Confirm symbol against intent. Have the agent state both the company name and the ticker before any order, and require approval if they don’t unambiguously match.
  • A denylist for sub-$1 and low-float names removes the usual destinations for this trick.
  • The approval gate catches anything unexpected before it executes.
  • *Treat any ticker that arrives in fetched text as untrusted* — the agent should resolve symbols itself, not take them from an article. (Why that matters.)

The takeaway

Pin the universe to symbols you chose and make the agent show its work (name and ticker) before it buys. Misdirection only works when the agent is free to trade anything it’s handed. See the full attack surface.

Catching a one-character ticker swap is exactly the kind of detail that separates a careful operator from a costly one — a measurable skill. Test yours at secprove.com.