Most of the conversation around agentic trading focuses on prediction: can an AI agent read the market better than a human? That's the wrong question. The failures that actually blow up trading accounts happen after the prediction is made — at the moment an agent turns a decision into an order. A model that calls the market correctly 60% of the time can still wipe out an account if the execution layer lets a single rogue order cascade into over-exposure.
That's the thesis behind a new research paper from INC4, conducted with our partners at True Trading / True Finance: execution is the new attack surface.
The paper introduces Survivability-Aware Execution (SAE), a safety middleware for agentic crypto trading systems, and tests it against real market data rather than backtested simulations. The results are a meaningful reminder that in agentic ai trading, the guardrails around the agent matter as much as the intelligence inside it.
What Goes Wrong When an Agent Executes Trades
An AI trading agent doesn't fail the way a human trader fails. It fails faster, more mechanically, and often without anyone noticing until the position is already underwater. The common failure modes cluster around a few patterns:
Over-exposure. An agent convinced of its own signal can size a position far beyond what risk tolerance allows, especially if nothing in the execution path enforces a hard ceiling.
Rate spikes. A model that gets stuck in a feedback loop — reacting to its own fills, or to noisy signals — can fire off orders in rapid succession, each one moving the market against itself.
Slippage. Industry data on execution quality backs this up: transaction costs and slippage are consistently the factor that kills strategies that look strong in simulation but underperform once real fills are involved, with realistic execution costs running well beyond what a backtest assumes. In cryptocurrency ai trading, where liquidity is thinner and price moves faster than in traditional markets, that gap between simulated and real execution is even wider.
Cascading losses. Any one of the above can trigger the next. Over-exposure amplifies slippage; slippage triggers stop logic that fires more orders; more orders spike rates. Without a layer designed specifically to interrupt that chain, an agent has no built-in reason to stop.
This is also a broader industry pattern, not one specific to INC4's research.
As more firms move from proof-of-concept to production with ai agents in finance, the gap between "agent that works in a demo" and "agent that survives live markets" keeps showing up as the harder problem — adoption is accelerating faster than governance is catching up, with over 40% of agentic AI projects expected to be canceled by 2027 according to Gartner.
Survivability-Aware Execution (SAE): A Safety Layer, Not a Smarter Model
SAE doesn't try to make the trading agent smarter. It assumes the agent will sometimes be wrong, sometimes be overconfident, and sometimes behave unpredictably — and it builds a middleware layer that constrains what any agent, regardless of its internal logic, is allowed to do at the point of execution.
The architecture is intentionally simple, which is part of the point. Three constraints do most of the work:
- Exposure budgets — hard caps on how much capital an agent can commit to a position or a strategy at any given time, independent of how confident the model claims to be.
- Rate limits — throttling on order frequency, so a feedback loop or noisy signal can't turn into a burst of trades that moves the market against the account.
- Slippage bounds — orders that would execute at a price outside an acceptable band are held or rejected rather than filled at any cost.
These are the kind of ai agent guardrails that sit between the model's decision and the exchange, using local executors so the constraints are enforced close to where orders actually go out — not as a policy the agent could theoretically talk itself around. It's a deliberately unglamorous approach: no new prediction model, no bigger context window, just hard limits on the blast radius of a mistake.
The Results — Tested on Real Binance Data
The team tested SAE against real Binance market data rather than relying solely on backtests, which matters because backtested results routinely overstate how well a strategy holds up once real order books, real latency, and real slippage enter the picture.
The headline numbers: maximum drawdown down 93.1%, and conditional value at risk (CVaR) down 97.5%, compared to the same underlying trading logic running without the SAE layer.
It's worth being precise about what that means and what it doesn't. This is a research result from testing on real market data, not a production track record or a guarantee of performance in live trading. The comparison isolates what the safety layer contributes — it shows that constraining execution, on its own, meaningfully reduces tail risk and drawdown severity, even when the underlying trading strategy itself is unchanged. That's a useful, and somewhat underappreciated, finding for anyone thinking about ai trading risk management: a large share of the risk reduction available to a trading system may come from execution constraints rather than from a better model.
Full methodology and results are available in the paper itself, and the implementation is open in the SAE policy-guard repository on GitHub for teams who want to inspect how the constraints are enforced.
What This Means for Teams Building Agentic Trading Systems
A few practical takeaways for teams building or evaluating agentic trading systems:
Treat execution as its own layer, not an afterthought. If the only thing standing between a model's decision and a live order is the model itself, the system has no real safety margin. Exposure budgets, rate limits, and slippage bounds should live outside the agent's own reasoning, enforced independently.
Test against real market conditions, not just backtests. Backtested performance is a starting point, not a risk assessment. The gap between simulated and real execution is where most of the unpleasant surprises live.
Separate "smarter model" work from "safer execution" work. They solve different problems, and conflating them can lead teams to over-invest in prediction accuracy while under-investing in the guardrails that determine how badly a wrong prediction actually hurts.
This research is part of INC4's broader R&D work in the AI Lab, and the execution-safety approach described here informs the architecture behind True Trading, a product built on this line of research. It's also the kind of problem INC4's algorithmic trading practice works on directly — the specific configuration here is still R&D, so teams evaluating something similar for their own systems should treat these results as a strong signal worth testing against their own data, not a plug-and-play guarantee.