Written for engineers who are about to give an agent write access to something they cannot undo.
For about ten weeks I have run an LLM agent, Sovereign, unattended and around the clock, placing real orders with real money across three venues, no human in the loop.
It has not lost me much. It has not made me much either. That is not what this is about.
What I got out of it is an inventory of how an autonomous agent actually fails in production. The published threat models are about attackers. That is not what happened to me.
Nobody attacked my agent. It was blinded by a billing lapse, fed by a data pipe that had been silently dead for weeks, and reported its own costs three times too high for months.
Here are eleven, every one from my own logs: what went wrong, and what it means for an owner now.
Access to the model was cut off, and every backup failed with it, because underneath they were the same thing. Three decision cycles produced nothing, with real positions open.
Now: when the agent goes dark, what it already holds stays guarded anyway.
When the main path died, the backup gave up on the job roughly half the time. Nothing was broken; I had given it less room than the work needed.
Now: the backup is a real fallback, not a coin toss.
A call that dies halfway is still billed. Three failures each cost about as much as a success, produced nothing, and never appeared in my books.
Now: every attempt is counted, failed or not, so the spending an owner sees is the spending that happened.
The prices it used for its own costs were a generation out of date, so every cost figure it reported was three times too high. Nothing broke, which is exactly why it survived.
Now: its own cost figures are held to what the provider actually charges.
Two-thirds of its decision cycles produced no decision at all. Nobody noticed, because an agent that could not think looks exactly like one that chose to wait. After the fixes, about one in seven.
Now: Sovereign's record tells "chose not to act" apart from "could not decide," so an owner can see it is working, not just quiet.
One of its inputs had quietly stopped working. It kept answering "nothing today," a normal answer for that feed, so it read as healthy for weeks.
Now: Sovereign knows the difference between "nothing to report" and "I couldn't look," and a source gone dark gets flagged, not trusted.
A data source was quietly swapped for a worse one. For about a day, real decisions ran on poorer data while everything reported healthy.
Now: it knows where its numbers should come from, and a downgrade is loud instead of quiet.
A venue requirement my account did not meet meant a whole class of orders could never fill. Nothing complained.
Now: when something cannot be done, Sovereign says so up front, with a reason, instead of trying and going silent.
I retired two parts of the system by switching them off. Their trades stayed open: five positions worth $1,579.23, unmanaged for four days, still rewriting the records I had meant to freeze.
Now: retiring part of the system means retiring what it left in the market too.
Protection was left standing against positions that no longer existed. Harmless, until it fires against a newer position going the other way.
Now: leftover protection is found and cleared before it can turn on a position it was never meant for.
I moved money into the account and the system counted it as a gain: wrong in the most seductive direction.
Now: deposits and withdrawals never count as performance. Only the agent's own trading moves the score.
The agent is roughly flat. Down about 7% on a small account over ten weeks, which on a sub-$1,000 book is a loss of about fifty dollars.
That is not a track record. It is statistically indistinguishable from noise, and it licenses no conclusion in either direction.
A page like this that left out the returns would deserve your suspicion. The value here is the failure inventory, not the strategy, and nearly every item applies to any agent that can do something you cannot undo.
I do this as fixed-scope work: an inventory of your agent's irreversible actions with a number on each, and the controls to bound them. Deliberately outside financial markets — that domain has its own regulator, and this is an engineering practice, not an advisory one.