Essay

Fifteen AI trading agent designs were graded on their brakes. Zero earned a full mark.

Two Texas A&M security researchers read fifteen academic designs for LLM trading agents against a checklist of four crash brakes: see the shock coming, react to it, cap the loss, recover. Sixty grades, four per design. Not one full mark. Eight of the fifteen describe nothing for any of the four.

The abstract of Wang and Saxena’s new paper will travel on two numbers: 80 percent “fail at least one core robustness metric” and 100 percent “exhibit security vulnerabilities.” Both are accurate. Neither means what it sounds like. Nobody attacked a running agent, and nobody staged a crash. Their framework, FARSIGHT, scores each design “as a scheme, the design described in its published paper, not as a running instance.” Two evaluators graded every design on nine criteria, the four brakes plus five for security, and matched on 126 of the 135 ratings. A spec-sheet audit. The spec sheet is still alarming.

No brake that skips the model. None of the fifteen describes a halt or a stop-loss that fires without going through the LLM. In the audit’s words, “none implement fast-path interrupt mechanisms,” and “none formalize containment into deterministic enforcement.” And the model is slow. TradingAgents, the most widely used of the fifteen and past 100,000 GitHub stars this week, needed over four minutes per decision when the audit’s authors timed it. Four minutes is the symptom, and a mild one for an agent that trades once a day; an exchange circuit breaker halts a slow agent as surely as a fast one. The disease is the wiring. Inside every one of these designs, the only thing that can stop the agent is the agent. Pilots call the missing piece a memory item, the move your hands make before the checklist.

One fake headline. At about 1:07 p.m. on April 23, 2013, a hacked AP account tweeted two explosions at the White House. The Dow fell more than 140 points. Reuters estimated that $136.5 billion of S&P 500 value briefly vanished. Within six minutes it was back, once a second source weighed in: the AP said its account had been hacked. FARSIGHT’s top grade against poisoned sources asks an agent for the same habit, record where a headline came from and require a second independent source before trading on it. None of the fifteen earns it. Seven describe no defense at all. Add four minutes per decision and you get what the audit calls price staleness: an agent that checks the lie against nothing would trade on it about the time everyone else had stopped believing it.

The returns came with fine print. The TradingAgents paper reports at least a 23 percent cumulative return on three stocks from January 1 to March 29, 2024. A footnote says the test ran three months “due to intensive LLM and tool use (11 LLM calls & 20+ tool calls/prediction).” The Sharpe ratio came in above the authors’ own expected range, which they put down to “few pullbacks” during the period. The cost that shortened the test is the same cost that makes the agent take four minutes to decide. And a window with few pullbacks never asks a brake to do anything. Brakes are the one part of a trading design that only a bad stretch can measure, so a short, kind window leaves them unmeasured, and the audit found them unwritten.

Stretch the window and the bad stretch shows up. Li, Kim, Cucuringu and Ma reran LLM strategies, FinMem and FinAgent among them, across two decades and more than 100 symbols. The “previously reported LLM advantages deteriorate significantly,” and the strategies turned “overly aggressive in bear markets, incurring heavy losses.” Their prescription includes “regime-aware risk controls.” A brake, by its finance name.

A result is only as wide as the conditions it was measured in. Three months certify three months. Inside its window, the TradingAgents result is honest, footnote and all. The overstep happens when a backtest walks out of its window, and what it leaves behind is the brake, because the window never had a day that needed one. That walk is now a product feature, no academic design required. When Robinhood opened its brokerage to customers’ own AI agents in May, its example for an active trader was to “backtest a mean reversion strategy to see how it performed historically, and deploy it.”

The strongest objection is printed in the audit itself. A failing grade “means only that the control is not evidenced in the paper: it may under-count mechanisms present in released code or later versions but not written up.” And the 100 percent is partly the ruler. The top security mark for tool abuse goes only to systems with no path to place a trade at all, and an appendix warns against reading the figure as “every agent is trivially exploitable.” Fair on every count. The audit documents no breach of any of these agents, and a careful team running one for real may have brakes that never reached the write-up.

The second objection is that the brakes live outside the agent by design. Under the SEC’s Market Access Rule, a broker must reject orders that exceed pre-set credit or capital thresholds or that look erroneous on price or size. Robinhood walls each agent into a dedicated account holding only what you deposit, with a button to disconnect it. Those controls are real, and they cap how big a mistake can get. None of them asks why the order exists. A right-sized sell on a fake headline clears every check, and the disconnect button is a memory item only if a thumb is already on it. As for the funds, proprietary systems “are not publicly accessible for security auditing,” the authors admit. Nobody outside those firms knows.

Which is the thesis again. The paper is the credential. A return figure travels with the paper’s name on it, and a brake that lives only in someone’s repo is not part of what gets cited. The audit printed its boundary in a Limitations section. TradingAgents printed its boundary in a footnote. Numbers travel. Caveats stay home.

Fifteen designs built to reason about the market. Not one memory item among them.

Sources: