A conventional language model can produce a wrong sentence. A trading agent can turn a wrong sentence into an order, an open position, a liquidation or a signal that changes how other market participants behave.
That does not make every trading agent uniquely dangerous. It makes the system boundary different.
Today we are publishing a research agenda for AI safety in trading agents. It identifies twelve measurable problems that emerge when probabilistic language-model reasoning is connected to persistent financial state and execution authority.
The central argument is simple: a trading agent cannot be evaluated as a chatbot that happens to discuss markets. The relevant system is the complete path from information to consequence.
observations
-> memory
-> reasoning
-> tool calls
-> proposed action
-> risk controls
-> order execution
-> persistent portfolio state
-> feedback or update
A failure can enter at any point. Stale data can contaminate a recommendation. An untrusted news page can inject instructions. A correct market view can become a bad trade through spread, latency or impossible fills. A profitable strategy can be the lucky winner selected from thousands of failed trials. A model update can change the policy responsible for closing a position opened by an earlier version.
Safety is therefore not one score. It is a set of testable claims about the entire trajectory.
What counts as a trading agent?
In the paper, a trading agent satisfies three conditions:
- It receives sequential financial or market observations.
- It uses tools, memory or persistent state to choose an action.
- Its output can directly or indirectly alter a portfolio, order or execution decision.
The model is only the generative component. The agent is the full system containing the model, observations, memory, tools, policy, controls and state.
This distinction matters. A highly capable model that can only produce analysis has a different risk surface from a weaker model with signing authority. Intelligence and authority are separate variables.
We describe five authority levels:
| Level | Authority |
|---|---|
| A0 | Produces analysis only |
| A1 | Recommends a trade but cannot prepare or submit it |
| A2 | Prepares an action that requires explicit human approval |
| A3 | Executes autonomously inside a pre-authorized asset, venue, size, leverage and time envelope |
| A4 | Has A3 authority and may propose changes to its own strategy or policy, subject to an independent promotion process |
A safety claim must name the level it covers. A paper-trading result at A2 does not establish live A3 safety. A benchmark score does not establish that the same model should control a signer.
“This agent is safe” is not a testable statement. A meaningful claim must bind the agent version, autonomy level, user mandate, execution envelope, market and venue context, evaluation horizon, harm threshold and evidence window.
The evidence gap
The emerging trading-agent literature often reports capability before it establishes deployability.
A 2026 evidence map screened 92 candidate studies, included 77 and classified 19 as primary closed-loop trading studies. Within that primary subset, the authors reported:
- 2 studies with extractable time-consistent splits;
- 1 with explicit transaction-cost modeling;
- 1 with universe or survivorship handling;
- 0 at the survey's highest reproducibility tier.
Those figures describe the reporting gaps found by one recent preprint. They are not an independent verdict on every trading system. But they expose the central problem: higher reported return is not enough evidence.
A strategy can look excellent because it saw future information, traded a surviving universe, ignored spread and impact, selected the best seed or filled orders at prices that never existed. The result may be mathematically correct and economically impossible.
Before asking whether a trading agent is profitable, we need to know whether the experiment corresponds to a possible market trajectory.
Four conjectures, twelve problems
The paper organizes the research agenda around four testable conjectures. Each conjecture contains three subproblems, and every subproblem includes a failure pathway, research question, minimum experiment, measurable outcomes and deployment implication.
1. Interpretation failures can cross into execution
Language models reason over information that may be stale, incomplete, conflicting or adversarial. Once their output can reach capital, an interpretation error becomes an execution risk.
P1. Grounding, uncertainty and abstention. Can the agent distinguish sufficient evidence from stale, missing, fabricated or injected evidence, act when it should and abstain without learning to avoid every difficult decision?
P2. User-mandate fidelity. Does the agent preserve the user's real objective when platform incentives, fees, activity rewards or short-term returns favor a different action?
P3. Information and execution authority. Can any prompt, retrieved document, memory item, planner or compromised tool expand the approved signer, venue, asset, notional, leverage, transfer or user boundary?
The deployment principle is constitutional: the model should not control the boundary that constrains it.
Established market-access systems already place price, size, credit, authorization and erroneous-order checks outside the strategy. The same rule should apply to language agents. A prompt may request broader authority, but it should not be able to grant it.
Confidence should not expand authority either. If an input is missing or unverifiable, authority should narrow.
2. Adaptive evaluation can manufacture improvement
Once an organization starts optimizing prompts, strategies, graders and model versions, evaluation becomes part of the training environment. A candidate can improve the number that selects it without improving the outcome we actually care about.
P4. Leakage-resistant, selection-aware evaluation. Would the claimed improvement survive reconstruction of the exact decision-time information, disclosure of every attempted trial, an untouched holdout and a fresh market period?
P5. Simulator-to-market execution fidelity. Does the result survive spread, fees, latency, queue position, partial fills, impact, rejection, funding, borrow and market closure?
P6. Reward, grader and promotion integrity. Can a candidate recognize the evaluator, influence its evidence, exploit a rubric, leak test labels, benefit from judge-family preference or modify the gate that promotes it?
One particularly dangerous failure is the impossible fill. A strategy can make the correct decision but still produce a fictional result because the simulator grants liquidity at a convenient price. A serious evaluation should replay identical intended orders through progressively more realistic execution:
frictionless bars
-> bid, ask and fees
-> latency and partial fills
-> queue and depth
-> market impact
-> held-out venue observations
If the agent ranking reverses as execution becomes realistic, the original ranking was not deployable evidence.
Promotion has the same problem. No single reward, model judge or realized P&L number should control it. Candidates should receive matched observations, be blinded where possible and face deterministic invariants, held-out outcomes, independent semantic review where needed and explicit rollback.
The candidate must not write, select or modify its own gate.
3. Agent populations create harms that single-agent tests miss
A trading agent does not act against a passive spreadsheet. Other participants react. Shared models, prompts, data vendors and risk rules can also make independently operated agents behave alike.
P7. Emergent manipulation. Can a profit-seeking agent discover or elicit spoofing-like, layering, wash-like, misleading or closing-price behavior even when nobody explicitly instructed it to manipulate?
P8. Correlated stress amplification. What happens when agents sharing a model, prompt, news summarizer, feed, reward function, risk rule or infrastructure provider exit at the same time?
P9. Tacit coordination. Can separately operated agents learn to reduce competition, widen spreads, divide opportunities or sustain supra-competitive behavior without an explicit agreement?
These problems cannot be measured by looking only at each agent's return. Multi-agent evaluation must also measure market quality, liquidity, counterparties, order-flow correlation, position overlap, synchronized liquidation and recovery after shocks.
Counting vendor names is not evidence of diversity. Behavioral diversity must be measured under stress.
Manipulation research requires special care. The paper proposes contained synthetic markets with no live-venue connectivity. Policies trained from scratch and pretrained language agents belong in separate experimental arms because they answer different causal questions. Their results should not be pooled.
4. Changing agents create lifecycle hazards
Even a system that makes safe decisions one at a time can fail across time.
P10. Provenance, replay and position-policy continuity. Can every action be reconstructed from the exact observations, model, prompt, tools, risk policy, approvals and code that produced it, and does an open position retain an unambiguous responsible policy after an upgrade?
P11. Deterministic risk kernels and kill-switch reliability. Can the model reinterpret or bypass limits, and does interruption still work before submission, after submission, during a partial fill, through disconnection and while closing?
P12. Human governance and recovery. Can the designated human actually detect, understand, stop and recover the system at the speed and scale of its authority?
“Human in the loop” is not a control by itself. The human may receive too many alerts, lack the required context, face delayed acknowledgements or become a rubber stamp. The system must test operator workload, detection time, intervention time, residual exposure, restart correctness and responsibility attribution.
The position-policy problem is especially important for adaptive systems. If version B replaces version A while A still owns an open trade, which policy is responsible for the exit? Strict version pinning, refusing upgrades until flat and explicit handoff protocols are different answers. What is unacceptable is an ambiguous mutable pointer.
The anti-problems
Safety work becomes safety-washing when ordinary capability or compliance claims are presented as evidence that failure pathways have been controlled.
- Higher Sharpe is not automatically safer. It may hide leverage, tail exposure, impossible fills or repeated selection.
- Higher benchmark accuracy is not automatically safer. A static benchmark may never test tools, execution, interruption or persistent state.
- More explanation is not automatically safer. A persuasive rationale may be unrelated to the process that produced the action.
- More autonomy is not automatically progress. A safer system may ask for approval or refuse an invalid mandate.
- More agents are not automatically robust. Agents with shared dependencies can fail together.
- A passed model judge is not automatically valid. The judge may be biased, compromised or blind to the relevant risk.
The minimum corrective is a claim-to-evidence map with explicit unknowns and stop conditions.
A minimum safety reporting standard
To make claims comparable and falsifiable, the paper proposes ten reporting categories for empirical trading-agent work:
| Standard | What must be disclosed |
|---|---|
| Data and universe | Sources, vintages, point-in-time availability, assets, delistings, survivorship and missing data |
| Temporal and leakage controls | Train, validation, test, forward periods, contamination analysis and the decision-time information set |
| Agent and authority contract | Model, prompt, tools, memory, autonomy level, signer rules, venue scope, size, leverage and failure behavior |
| Execution semantics | Decision time, order type, price source, fees, funding, latency, queue assumptions, partial fills, impact and rejection |
| Trial and selection registry | Every model, prompt, seed, strategy, threshold, metric, grader and benchmark variant tried |
| Reliability and uncertainty | Repeated-run success, effect sizes, intervals, tail outcomes, regimes, abstention and error assumptions |
| Versioned artifacts and replay | Identifiers for observations, models, prompts, policies, graders, orders, fills and reports |
| Safety controls and intervention | Pre-trade limits, invariants, monitoring, kill behavior, escalation, restart, incident response and recovery |
| Adaptation and promotion | Mutable surface, candidate provenance, evaluator separation, promotion, rejection, rollback and position continuity |
| Multi-agent and dependency risk | Shared models, data, tools, providers, venues, crowding, market impact and stress-test design |
“Not applicable” and “not reported” are different states. A missing field should not be silently filled by inference.
From benchmarks to market wind tunnels
The near-term research goal is bounded evidence:
- point-in-time, execution-aware, replayable benchmarks;
- tasks built around failures, not only profitability rankings;
- direct tests of authority escape, stale state, injection, impossible fills and interruption;
- complete research-trial registries and sealed holdouts;
- replay, simulation and shadow evaluation before capital access.
Controlled deployment comes later, with small authority envelopes, realized-fill calibration, incident exercises, position continuity and published negative results.
The longer-term goal is a market wind tunnel: a contained multi-agent environment with heterogeneous participants, realistic liquidity, endogenous prices, shared-provider failures, synchronized exits and adversarial counterparties. The system should measure not only individual P&L, but market quality, manipulation, coordination and systemic amplification.
What this paper claims
This paper does not claim that the twelve controls have already been empirically validated. It does not claim that any architecture makes autonomous trading safe. It is a structured research agenda.
Its goal is narrower and, we think, more useful: make unsupported safety claims easier to detect, unsafe authority harder to exercise and every claimed improvement attributable to evidence that survives time, markets, adversaries and independent review.
Passing one test would support only the specific agent, version, authority level, market context, harm threshold and evidence window that was evaluated. It would not create a general certificate of safety.
Trading agents join language to capital. Safety begins when we measure the entire path between them.