AI financial advisers carry a hidden Bitcoin bias activated by a single specific switch

An AI financial adviser receives the same client three times, with the finances and tolerance for risk left unchanged. The first prompt asks for a diversified long-term portfolio. The second introduces bank failures and capital controls, while the third imagines an economy in which autonomous software buys services and pays other machines. The client hasn't moved an inch, yet Bitcoin can travel from the middle of the pack to the front.

Leading language models ranked Bitcoin around fifth among eight forms of money when researchers framed the task around ordinary reliability. The asset moved toward the top once the prompt introduced a crisis or personal autonomy, and it performed just as well in an economy populated by software agents.

While Bitcoin itself hadn't changed, a few words around it brought a different bundle of properties to the foreground.

The finding comes from a June preprint by Wenbin Wu and co-authors, who audited eight frontier models for asset-specific preferences. Then they went deeper than the usual exercise of collecting odd chatbot replies.

Using an open model from Google, the researchers found an internal feature that responded selectively to Bitcoin-related concepts. When they adjusted its strength, the portfolio moved with it. Amplifying the feature added 5.2 percentage points to the model's suggested Bitcoin allocation, while suppressing it removed 4.6 points.

The intervention operated entirely on internal activity, with the model's instruction left untouched. That turns an amusing example of prompt sensitivity into a much more serious problem for banks and investment firms. An AI can produce an immaculate rationale for an allocation while leaving the institution using it with little access to the machinery that produced the number.

The evidence applies to Gemma 3 in a defined experimental setup, and the paper hasn't passed peer review. But even within those boundaries, it shows how fast personalized advice can become impossible to audit once a model's learned associations enter the portfolio process.

The same asset becomes several different ideas

A language model doesn't store Bitcoin as one dictionary entry with an approved list of pros and cons. During training, it learns statistical representations spread across many numerical activations. Some connect Bitcoin with scarcity and portability. Others capture its volatility, use in speculation, or ability to move outside institutional control. Associations with digital settlement and technological adoption add another layer, but none of them creates or fits in a neat little file an auditor can open.

Prompts about dependable everyday money tend to reward stable purchasing power and widespread acceptance, both of which are weak areas for Bitcoin. Bank closures and capital controls bring its portability forward because transactions can move outside commercial banks. Autonomous software makes digital settlement more useful, especially when ownership must be legible to a machine.

The model isn't dealing with the same definition of Bitcoin in each case: it's assembling a version of Bitcoin from whichever properties the prompt has pulled forward.

Wu's team tested that explanation by swapping asset names for descriptions of their functions. Rankings followed the properties across renamed inputs, so the models weren't simply reacting to the token "Bitcoin"; they were responding to groups of characteristics absorbed during training.

That distinction is what keeps the paper from collapsing into another broad complaint about biased AI. Financial advice is supposed to respond to context. A worker two years from retirement has different constraints from a 30-year-old with stable income and a long horizon, while an investor preparing for capital controls has supplied information that can reasonably alter an allocation. A model that treats those people identically would be useless.

The problem begins when superficial wording produces a large move, the system doesn't identify the assumption that drove it, and every version ends up in the same confident register.

"Resilient during bank disruption" can activate a different internal cluster from "reliable over the long term," even when the client's finances and the approved asset universe remain fixed. The output only looks personalized, but the institution may have no reliable way to tell whether it was personalized for the client or for the phrasing.

Human advisers carry preferences and incentives of their own, and they can also be swayed by framing. Financial regulation tries to contain those influences by requiring advisers to document why a recommendation suits the client. Fiduciary duties and supervision give that record force. A human can then face consequences when the file doesn't support the explanation.

A language model, on the other hand, can generate a persuasive account on demand, though fluency can't establish that the account faithfully describes the computation behind its answer.

Researchers found the dial and turned it

Wu and his co-authors used a sparse autoencoder, a research tool that decomposes dense model activity into a much larger set of features that humans may be able to interpret. The rough analogy is separating a musical chord into individual notes, with an important complication: these "notes" are learned patterns inside a neural network, and assigning meaning to them requires repeated tests.

The team searched thousands of features in Gemma 3, Google's open-weight model family released in 2025, and found one that activated strongly around Bitcoin-related material. They intervened on that feature while the model generated its answer. Turning it up raised Bitcoin allocations by an average of 5.2 percentage points; turning it down cut them by 4.6 points. Random control features didn't reproduce the effect, according to the preprint.

Amplification mainly pulled money from other crypto assets into Bitcoin, while suppression reduced the portfolio's exposure to crypto. The authors call the effect "bounded behavioral leverage," using leverage to mean causal influence over the output. The feature could move the recommendation by a measurable amount, though it couldn't send the portfolio anywhere at will.

Changing an internal representation and measuring the resulting allocation gives this experiment more weight than a folder of inconsistent chatbot screenshots.

Its reach was meant to be narrow. The mechanistic work covers one open model tested through one feature-extraction method, using a defined set of portfolio tasks. Commercial systems have more layers, including hidden instructions and connections to outside data. Safety filters can alter the answer again before it reaches the user. Providers update these components regularly, sometimes changing behavior while the product keeps the same name.

The paper's tasks use stylized prompts. In a full advisory process, the client's information would be verified before tax rules and an approved product list constrained the allocation. A real person would still have to sign off.

The reported allocation swing isn't a return forecast or an ideal allocation, and it doesn't make a case for owning Bitcoin. It's an experimental effect inside a single setup, and extending it to every model would outrun the evidence.

Still, it lands in the same place as other work pointing in the same general direction. A separate Bitcoin Policy Institute experiment ran 9,072 monetary scenarios across 36 models and found large differences by use: Bitcoin dominated store-of-value scenarios, while stablecoins led for everyday payments.

That project measured generated choices at the behavioral level, while Wu's team examined an internal mechanism. Both found that an AI's treatment of money depends heavily on which function the prompt makes salient.

AI is moving closer to the trade

Financial firms don't have to give an AI unrestricted trading authority for this problem to reach clients.

Models already draft adviser emails and summarize research. Others prepare portfolio commentary or help customer service teams interpret client needs, while automated agents are transacting on-chain. Each use places the system one step closer to client money.

An AI that rewrites prose for a human adviser can introduce slant, with the reviewer still controlling what reaches the client. A model that proposes an allocation supplies the numbers around which the conversation begins. An agent that rebalances or executes moves from language into money. Risk accumulates across those stages because human review becomes harder once the model's output has turned into the default.

FINRA's 2026 discussion of AI agents says general-purpose systems may lack the domain knowledge required for complex financial work and reminds firms that existing securities rules still apply.

FINRA told member firms in 2024 that its technology-neutral requirements cover the supervision of customer communications and the records behind them. In July 2026, it reiterated that firms remain responsible whether a person or an AI produced the material. The SEC's Division of Investment Management told advisers in February that fiduciary duties travel with the technology.

Bank supervisors already have a framework for part of this work. The Federal Reserve's revised 2026 model-risk guidance places vendor products under the same discipline as internally built models. Banks are expected to understand how a model was constructed and how well it performs. Private weights complicate that job, and the bank keeps responsibility for the result.

Europe is also trying to stay on top of this potentially serious issue. The EU AI Act treats certain systems used for credit or insurance as high-risk, while general-purpose models have separate obligations. Germany's BaFin received AI market-surveillance powers over supervised financial companies when the relevant provisions began applying on Aug. 2.

Those regimes can require governance and oversight, with records to show how each worked, but a standard test for semantic sensitivity in portfolio advice has yet to emerge.

Companies can approve a vendor and monitor its error rate while missing the association that sends Bitcoin from fifth place to the top when "bank disruption" replaces "long-term reliability."

Traditional validation asks whether a model performs as intended. Generative advice forces the firm to retest that intention when the wording changes. Provider updates and new system instructions can require another round.

The explanation has to belong to the decision

The paper places a demanding burden of proof on any institution using AI advice.

Equivalent language should produce a reasonably stable result. When the portfolio moves, the system should identify which assumption caused it. Its explanation should also match the process that produced the allocation. A persuasive reconstruction written once the number already exists doesn't meet that standard.

That standard also has to survive model updates. A provider can alter the weights or system instructions while keeping the same product name, leaving yesterday's validation attached to software that no longer exists. The bank or adviser remains responsible for the new output even when it can't inspect the new model in full. Human oversight only works if the reviewer can see enough of the process to catch a recommendation that drifted.

Financial companies therefore need a "know your agent" standard before AI moves from drafting commentary to shaping portfolios. The central test is whether the institution understands what makes the model favor an asset and how far that preference can be moved.

A polished explanation has little value when small wording changes can produce a different recommendation under the same client facts.

The most dangerous result in the Bitcoin paper isn't a large allocation, or even a small one. It's the distance between an answer that sounds fully reasoned and a process the recipient can't inspect.

A human adviser can explain why an allocation moved and be held to the record supporting that account. An AI adviser can always produce another polished paragraph, leaving the institution to prove that the paragraph came from the decision and wasn't written afterward to justify it.