AI trading agents on Solana: what they can do with your wallet
An AI trading agent can do almost anything you can do with a Solana wallet, from swaps to leveraged perps, as long as it can sign. What it can lose depends on how it gets that power, not on how clever it is.
The short answer
Claude, ChatGPT and other AI apps cannot touch a wallet on their own. They need a tool connected to them, usually over MCP, the Model Context Protocol, which its own docs call “an open-source standard for connecting AI applications to external systems”. Once a tool that can sign is connected, the AI can do whatever that tool allows.
On Solana, that list is long. So the useful question is not “can the AI trade?” but “what can it sign without me, and with how much money?”
What an agent can do on Solana
Here is what two well known setups say an agent can do, from their own pages.
| Solana Agent Kit (SendAI) | Phantom MCP | |
|---|---|---|
| Swaps | Jupiter, plus pools on Raydium, Orca and Meteora | buy and wallet_rebalance, which Phantom says carry no swap fee |
| Leverage | Perps on Drift and Adrena | Perps on Hyperliquid: open, close, set leverage |
| Limit orders | Through Manifest | Not listed |
| Lending | Lulo and Drift | Not listed |
| Launch a coin | On Pump, through PumpPortal | Not listed |
| Staking | Jito, jupSOL, Solayer | Not listed |
| Sends | Transfers and bridging | Transfers, simulated first |
| Whose wallet | Whatever key you give it | A new wallet that starts empty |
From the Solana Agent Kit README and Phantom’s MCP docs, read 2 November 2026.
The Agent Kit README says agents can “autonomously perform 60+ Solana actions” and describes an “Autonomous mode for independent agent actions”. In plain words: once it runs, it can trade without asking you each time.
Phantom’s perps tools also show a liquidation price, which is a reminder that leverage means an agent can lose more than a bad swap would.
How an agent gets into a wallet
This is the part that decides your worst day. There are three common ways.
1. You hand it a private key. The Agent Kit’s example loads a secret key into the agent, and its OKX setup reads SOLANA_PRIVATE_KEY from an environment variable. That works, but anything that can read that file can take the whole wallet. The README itself says to use it “in a secure environment” and “never share your private keys”. Treat this as a builder’s tool for test money. More on what a key unlocks in seed phrase vs private key.
2. It gets its own walled-off wallet. Phantom MCP gives the agent “a new dedicated wallet, not your existing personal wallet”. It “starts with a zero balance”, and the agent can only use what you send it. Your main Phantom wallet stays out of reach. The most a mistake can cost is what you funded.
3. It asks, and something else signs. MoonPay’s PayBox works inside Claude and ChatGPT and can trade tokens on Solana. In Always Ask, every transaction needs your passkey. In Autonomous, the AI acts inside limits you choose, and changing permissions needs a new passkey. MoonPay says the key is split so that no single party, the AI included, can sign alone.
For a side by side of who signs and where keys live, see Solana MCP wallets compared.
How agents get tricked
An AI reads text, and text can be written by an attacker. That is the real risk, more than the AI making a bad call.
In May 2026, Cointelegraph reported that someone hid an instruction for Grok in a post, disguised with Morse code or similar so people would likely miss it. Grok echoed it, and a Bankr wallet linked to Grok treated that reply as an order. About 3 billion DRB tokens, worth an estimated $155,000 to $174,000, went to the attacker. The report says no key was stolen and no contract was broken. The attacker had also sent the wallet a free NFT that, by the report, carried permissions inside Bankr. That was on Base, not Solana, but the lesson carries: anything that can feed words to an agent with signing power is part of its attack surface.
On Solana, coin names, descriptions and memos are written by strangers. An agent that reads them while it trades is reading text an attacker can control. Limits that live outside the AI, where no message can argue with them, are what save you.
Scams that call themselves AI trading bots
Not every “AI trading agent” is an agent at all. The CFTC, the US derivatives regulator, warns that “AI technology can’t predict the future” and that scammers promise returns of “tens of thousands of percent” or “100 percent ‘win’ rates”. One case it describes, Mirror Trading International, took more than $1.7 billion in bitcoin from at least 23,000 people while promising at least 10% a month. Very little was ever traded.
Red flags worth stopping on:
- Guaranteed or very high returns.
- A bot that asks for your recovery phrase or private key. Never give either to anyone.
- A site you found through a reply or a DM. Check how new the domain is, as the CFTC suggests.
If a “bot” needs you to connect your main wallet and sign something you do not understand, read how Solana wallet drainers work first.
How to let an agent trade without risking everything
- Give it its own wallet. Fund it with what you can afford to lose and nothing more. A burner wallet is the right shape.
- Never paste a key or your 12 words into a chat, a config file or a bot. Use a setup where the AI asks and something else signs.
- Start with asking every time. Watch what it wants to do for a week, then loosen only the moves you are happy with.
- Keep a cap. A daily limit or a per-trade ceiling stops a run of small mistakes adding up.
- Be wary of leverage. Perps can be liquidated. An agent on its own with leverage can lose fast.
- Know how to stop it. Find the off switch before you need it.
Where Raven fits
Raven is not a trading bot and does not run an AI. It is a Solana wallet manager that your own AI can connect to: Claude, ChatGPT, Claude Code or Cursor. AI access is off until you connect one. Then you pick view only, ask me, on its own up to a daily limit, or full access. It can swap any coin to any coin through Jupiter, at 0.4%, from one wallet or many. The AI never touches your keys, which are made and locked in your browser, and paying an address you have not saved always waits for you.
Raven is invite only for now. You can join the waitlist. More in AI wallet for Solana.
Questions
Can Claude trade crypto for me?
Only through a tool you connect to it, such as a wallet with an MCP server. Claude on its own has no wallet. What it can trade, and how much, is set by that tool and its limits.
Is it safe to give an AI agent my private key?
No, not for real money. Anything that can read the key can take everything in that wallet. Use a setup where the agent asks and something else signs, or a separate wallet funded with only what it may lose.
Can an AI trading agent beat the market?
No one can promise that. The CFTC says AI cannot predict the future, and treats guaranteed returns as a sign of fraud.
What happens if the agent is tricked?
It loses whatever it is allowed to move. That is why the cap matters more than the model: a walled-off wallet or a daily limit decides your worst case.
Sources
Raven lets your own AI swap and move coins, inside the limits you set.
Join the waitlistSee how Raven does it: AI wallet for Solana, AI access, On your phone.