Written by: Luke Sobieraj, Founder & COO, Digital Colliers
The Wall Street Journal ran a piece last month on everyday US investors coding their own trading algorithms. These aren't sophisticated quant firms. These are retail traders wiring up Claude or GPT-4 to their Schwab or Fidelity APIs over a Saturday afternoon. The agents execute trades, rebalance portfolios, parse earnings calls, sometimes all three.
Your brokerage already sees these accounts. You just don't see them as a pattern yet.
Three Detection Surfaces You Already Own
The good news is the data's already in your systems. Three surfaces stand out.
Order-entry cadence. Humans click around. They hesitate. They fat-finger. Then they go make coffee. An agent fires orders at machine tempo. It retries on failure with exponential backoff. It batches requests at round timestamps. The timing signature's distinct.
API versus UI patterns. A human logs into your web portal or mobile app. An agent authenticates via OAuth and calls your REST endpoints directly. More than 15% of commits from AI coding assistants introduce at least one defect. The amateur who built this agent probably shipped bugs you'd catch in code review. But you won't see those bugs until the agent does something odd in production, and by then it's in your compliance log.
OAuth token audit trails. When an investor grants an API token, you record the scope, the timestamp, the client ID. Most brokers log this but don't monitor it in real time. The pattern worth watching is an account that granted broad trading scope to a third-party OAuth client last weekend and started firing unusual order velocity on Monday morning.
None of these signals are new. What's new is the volume's climbing fast, and the agents are written by people who aren't software engineers.
The Blind Spot Is Joining Them
Each of those three surfaces lives in a different silo at most mid-market brokers. Order timestamps live in your execution system. API logs live in your gateway. OAuth grants live in your identity service. The compliance team sees risk alerts from the AML system, but that system doesn't ingest OAuth metadata or API usage patterns.
Unresolved technical debt from AI-generated code climbed from a few hundred surviving issues in early 2025 to over 100,000 by February 2026. The agents your retail customers are deploying right now are likely carrying some of that debt. They'll do something weird eventually, and when they do, you need a single pane of glass that shows you order cadence, API usage, and OAuth scope all in one account view.
If you can't join those three surfaces, the pattern stays invisible. You see a spike in order velocity in one system and an unusual OAuth grant in another system, but no one connects them until the SEC examiner asks you to explain that account during your next exam.
What Winning Operators Are Doing
The firms that are ahead on this aren't building new surveillance tech from scratch. They're wiring the three surfaces together. That usually means a data pipeline that lands execution logs, API gateway logs, and identity events in a single warehouse, then a simple view layer that surfaces account-level patterns.
The first implementation's often a daily batch job that flags accounts with simultaneous API usage spikes and unusual order cadence. Then you add OAuth grants to the picture. Then you make it real-time.
88% of AI proof-of-concepts never reach widescale deployment. This isn't an AI moonshot project. This is plumbing. The winning move is to ship a narrow version in two weeks, watch what it catches, then iterate.
If you ship that before your next SEC exam, you'll see the agent-driven accounts as a coherent pattern instead of a series of unconnected anomalies. If you don't, you'll be explaining to the examiner why you logged all the right data but never looked at it as a whole.