Your agent will get things wrong.
Usually in small ways. It reads a price that is thirty seconds old, sizes a position larger than it should, or acts on a signal that already moved. We build on the assumption that this happens, because it does. Most of what an agent proposes here goes through. The work is in the part that doesn't.
We are not speculating about agents. We run them in production.
The intelligence Fexr publishes is computed by agents on a schedule rather than assembled by people. That is where our opinions about agent failure come from — we read their output every day, and we correct it.
- Market signalsAgents compute the signals behind Market Signals on a schedule — volume anomalies, unlock calendars, smart-money flow, whale movement. Definitions and cadences are fixed; the agent does the work, not the judgement about what counts as a signal.
- ResearchDeep research and screener runs are agent jobs. They are priced per call because they cost real compute, and they are slow enough that a person would not do them at this frequency.
- Portfolio sessionsThe autonomous session engine evaluates open positions against its exit conditions on a fixed cycle and acts inside the limits it was given. This is the part with money attached, and it is the most constrained thing we run.
- Peer reviewAgents check each other. Where several independent agents reach the same conclusion, that agreement is recorded as its own signal — with the caveat, which we take seriously, that agreement between similar models is weaker evidence than it looks.
The failures are boring, and that is what makes them expensive.
An agent that goes rogue is a good story and a rare event. What we see instead is a model that is fluent, confident and working from something slightly stale, or sizing off a number it read correctly and interpreted badly. None of these look like errors while they are happening.
Each one below has a check sitting in front of it in the order path.
| What it does | Why it is not caught by better prompting |
|---|---|
| Acts on a price that has gone stale | The reasoning is sound and the input is thirty seconds old. Nothing in the model's context tells it the market moved while it was thinking. |
| Concentrates without noticing | Each buy is defensible on its own. The fourth one in the same asset is not, and the agent is evaluating orders rather than the book. |
| Enters a perp with punitive funding | The trade thesis can be right while the carry quietly eats the position. Funding is easy to leave out of a decision that is otherwise about direction. |
| Sizes with no room to be wrong | Leverage that looks fine at entry leaves no distance to the liquidation price. The agent optimised for the case where it is correct. |
| Trades a symbol that is not what it appears to be | Ticker collisions and lookalike listings are a solved problem only if someone maintains the list. A model reading a symbol string cannot tell. |
| Retries into a wall | A rejected order looks transient. The agent tries again, and again, and the underlying condition has not changed and will not. |
Checks in the execution path, not instructions in a prompt.
The standard offers are approve-every-action or hand over your keys. Approval stops working the moment volume is real — people confirm the four hundredth prompt without reading it, and everyone shipping these dialogs knows that. Keys stop working the first time something goes wrong.
What we do instead is unglamorous. The limits live in the code that submits orders, so they apply the same way whether the instruction came from a strategy, a signal, an autonomous session or a person in a hurry.
- You define a space, not a queue of approvalsHow much, which assets, how concentrated, how much leverage, for how long. The agent moves freely inside it and cannot step outside. Your funds stay in your own wallet under a capped permission you can withdraw at any point.
- Every order is checked before it is submittedSize against your book, concentration, leverage, how old the price behind the decision is, what funding costs, and whether the asset is one we trade at all. This runs on every path to the exchange. There is no route around it.
- Restraints only point one wayThe rules that stop an agent opening a position never apply to closing one. A check that can trap you in a trade has stopped being a safety feature.
- Repeated failure stops the agent rather than the orderA few rejected trades in an hour pauses the session and tells you. The assumption is that something upstream is wrong, not that the next attempt will land.
- Autonomy needs a floorA goal-seeking session will not start without a stop-out level, and it has to sit below the target. Setting a goal with no floor is not autonomy, it is an open position with a story attached.
- You can end it in one actionRevoking cancels the open orders, closes the positions and tells you what is left. It is a receipt, not a confirmation dialog.
Things we do not let an agent do, and are not planning to.
Some of these are permanent and some are just not ready. We would rather say which is which than let the distinction sit in a footnote.
Past performance of an agent, a strategy or a signal does not predict future results. Nothing here is investment advice.
Agents buying from other agents, without a person in the loop.
This part is already working and is small. An agent on Fexr holds its own balance and pays per call for the data it uses, in stablecoins, without anyone provisioning access for it. It can publish what it found and charge for that. Its record follows it.
We think this becomes the normal way agents get data, and we would rather have the accounting and the access controls in place while the volume is low. External agents cannot reach your vault until you let them in — the flag is off until you turn it on, and there is no discovery path that bypasses it.
If you are building against this, Fexr LLM Skills has the catalog and the payment flow, and the API documentation has the endpoints and the exact thresholds.
Useful and unreliable at the same time.
That is the accurate description of an agent trading right now, and it is not a criticism. Plenty of things we depend on are in that category. It only becomes a problem when the system around them pretends otherwise.
So the agent does the work, the limits do not move, and you can end it in one action. That is the whole arrangement.
- Trading Agent — the agent as something you use day to day
- The Wallet — where the permission is granted and revoked
- Fexr LLM Skills — what an agent can call, and what it pays
- Market Signals — the data these decisions run on