WolfSociety: Understanding Collective Risk from Harmful-Agent Scaling in Financial Agent Societies

Lejun Zhang; Sarah Lu-Liang; Xin Jiang; Muning Wen; Weinan Zhang; Shangding Gu

physics.soc-phSep 4, 2026

WolfSociety: Understanding Collective Risk from Harmful-Agent Scaling in Financial Agent Societies

Authors: Lejun Zhang, Sarah Lu-Liang, Xin Jiang, Muning Wen, Weinan Zhang, Shangding Gu

Organizations: Shanghai Jiao Tong University · University of California, Berkeley · University of Toronto

Abstract

Safety evaluations typically focus on individual agents, but interacting agents can spread harmful information and influence the environment in which later decisions are made. We study how collective failure changes with harmful-agent fraction and society size in a controlled financial agent society, where agents communicate over a social network and trade in a shared market. In the primary financial scenario, collective failure requires broad harmful diffusion together with severe price dislocation or liquidity stress. Across all tested society sizes, failure remains rare at low harmful fractions but rises sharply over a narrow range. As society size grows from N=100 to N=2000, the harmful fraction associated with a 50% failure probability decreases from 4.7% to 2.2%, while the corresponding number of harmful agents increases from approximately 5 to 44. In contrast, when the number of harmful agents is held fixed, their impact becomes weaker as the society grows. Controlled interventions further show that broader network reach shifts the collapse boundary toward lower harmful fractions, whereas stronger conformity alone has little effect. To characterize these effects, we introduce Agent Society Dynamics, a finite-size framework for relating harmful-agent fraction, society size, and interaction structure to collective failure. Overall, our results reveal a nonlinear, size-dependent collapse transition in financial agent societies, showing that collective failure depends not only on the prevalence of harmful agents but also on the size and interaction structure of the surrounding society. Code is available at https://github.com/SAIL-Research-Lab/WolfSociety.

Figures & tables

Figure 1

Scenario	Perturbed channel	Primary readout
Social-information manipulation
S1 Pump-and-dump	Social demand and diffusion	Price–liquidity dislocation
S2 Scalping	High-reach promotion	Price–liquidity dislocation
Market-microstructure manipulation
S3 Spoofing/layering	Displayed market depth	Cancellation and liquidity stress
S4 Wash trading	Artificial trading volume	Fake liquidity and withdrawal loss

Table 1: Manipulation scenarios inspired by public cases and their primary readouts. S1 is the primary analysis scenario.

Figure 2: Nonlinear collapse transition in the primary scenario. Collapse probability remains low at small harmful fractions, rises sharply over a narrow range, and saturates at higher fractions. The underlying episode severity provides a continuous view of the same transition.

Figure 3: Finite-size scaling of the collapse boundary. As society size grows, the harmful fraction associated with

50\%

collapse probability decreases, while the corresponding harmful count increases sublinearly.

$\boldsymbol{\ell}$	$\boldsymbol{b_{N}}$ [95% CI]	$\boldsymbol{b_{K}}$ [95% CI]
0	$-0.764\;[-0.818,-0.717]$	$1.046\;[0.902,1.195]$
0.5	$-0.811\;[-0.860,-0.759]$	$1.022\;[0.897,1.150]$
1	$-0.822\;[-0.865,-0.780]$	$1.103\;[0.977,1.232]$

Table 2: Fixed-count severity under three directly implemented liquidity rules. Each rule is evaluated using a separate set of simulated trajectories.

Figure 4: Intervention effects on the collapse boundary. Points show the mean boundary shift across

N\in\{300,1000\}

, with 95% CIs from paired bootstrap resampling. Negative values indicate that collapse occurs at lower harmful fractions, while positive values indicate that higher harmful fractions are required. The joint-decrease and joint-increase conditions change response precision, conformity, attention capacity, and graph degree together.

Condition	Exponent [95% CI]	Boundary evidence
All-rule	$0.164\;[-0.009,0.251]$	$0.0475\rightarrow 0.0300$
Standard quota	$0.181\;[-0.063,0.289]$	$0.0500\rightarrow 0.0300$
Increased quota	$0.190\;[-0.081,0.276]$	$0.0475\rightarrow 0.0280$

Table 3: Controller robustness over the common resolved range of five society sizes,

N\leq 1000

Backbone	$\boldsymbol{\alpha_{\mathrm{c}}(100)}$	$\boldsymbol{\alpha_{\mathrm{c}}(1000)}$	$\boldsymbol{\widehat{\nu}_{\mathrm{2pt}}}$
GPT-4.1	0.0525	0.0260	0.305
Qwen3-235B	0.0550	0.0260	0.325
Llama-3.3-70B	0.0550	0.0260	0.325
GLM-4.5	0.0550	0.0260	0.325
Kimi K2.6	0.0525	0.0280	0.273

Table 4: Cross-backbone robustness in the primary S1 setting. Each backbone is evaluated under the same protocol at

N=100

and

N=1000

Appendix figures & tables18 assets

Supplementary material from the paper’s appendix.

Appendix

ID	Mechanism abstraction	Public record	Preserved structure
S1	Pump, social amplification, exit	SEC social-media manipulation enforcement [ U.S. Securities and Exchange Commission, 2022a ]	Promote–recruit–sell ordering; no named asset or amount
S2	High-reach promotion and scalping	SEC social-influencer and touting enforcement [ U.S. Securities and Exchange Commission, 2022a , U.S. Securities and Exchange Commission, 2022b ]	Promoter reach and private-position conflict
S3	Spoofing/layering	DOJ JPMorgan spoofing enforcement [ U.S. Department of Justice, 2020 ]	Non-bona-fide displayed depth and rapid cancellation
S4	Wash trading/fake liquidity	CFTC Coinbase wash-trading order [ U.S. Commodity Futures Trading Commission, 2021 ]	Self-trading, false volume, and later withdrawal

Appendix

Table 5: Public-case provenance and scenario abstraction. Sources motivate mechanism classes only; numerical simulation settings are not case estimates.

ID	Case-grounded mechanism	Plain-language episode	Primary failure event
S1	Microcap pump-and-dump	Harmful accounts build a position, promote a low-liquidity asset, recruit amplifiers, and exit after ordinary agents buy.	Harmful social diffusion together with price or liquidity dislocation.
S2	Finfluencer scalping	High-reach accounts promote an asset to followers while holding a private position, then sell into copy-trading demand.	Harmful social diffusion together with price or liquidity dislocation.
S3	Spoofing/layering	Harmful traders display non-bona-fide depth, induce others to misread imbalance, trade, and cancel rapidly.	High cancellation, spoof depth relative to liquidity, and liquidity stress.
S4	Wash trading/fake liquidity	Colluding accounts manufacture volume and apparent liquidity, attract participation, then withdraw it.	Artificial volume share and distortion followed by withdrawal loss.

Appendix

Table 6: WolfBench scenario mechanisms and episode-level failure events.

ID	Horizon	Target	Social state	Harmful episode phases	Scenario-aligned failure components
S1	30 days	asset 2	Scale-free graph; mean degree 8; feedback 0.8	Accumulate 0–4; promote 5–14; exit 15–22	Social cascade and either price dislocation or liquidity stress.
S2	30 days	asset 2	Scale-free graph; mean degree 10; feedback 0.7	Accumulate 0–3; promote 4–18; sell 12–25	Social cascade and either price dislocation or liquidity stress.
S3	30 days	asset 1	Scale-free graph; mean degree 6; feedback 0.4	Four intraday display–cancel cycles; one-step cancellation latency	Cancellation rate, displayed spoof depth relative to liquidity, and liquidity stress.
S4	30 days	asset 2	Scale-free graph; mean degree 6; feedback 0.6	Accumulate 0–4; manufacture volume 5–18; withdraw 19–25	Wash share and volume distortion, followed by withdrawal loss.

Appendix

Table 7: Frozen scenario configuration. Asset indices refer to the three-asset environment shared by all scenarios; each row identifies the asset on which the scenario-aligned failure event is evaluated.

ID	Component 1	Component 2	Component 3
S1	cascade 0.55	dislocation 0.21	liquidity 0.85
S2	cascade 0.55	dislocation 0.35	liquidity 1.45
S3	cancellation 0.45	depth/liquidity 50	liquidity 1.50
S4	wash share 0.45	distortion 0.80	withdrawal 0.06

Appendix

Table 8: Prespecified thresholds for the scenario-aligned failure scores.

$N$	Pilot grid	Main grid
100	0, .030, .040, .050, .060, .070, .075, .100	0, .030, .040, .050, .060, .070, .075, .100
200	–	0, .020, .030, .040, .050, .060
300	0, .015, .025, .030, .035, .040, .050	0, .015, .025, .030, .035, .040, .050
500	–	0, .010, .015, .020, .025, .030, .040
1000	–	0, .006, .010, .014, .018, .022, .030
2000	–	0, .004, .007, .010, .013, .016, .022

Appendix

Table 9: Frozen S1 harmful-fraction grids. A dash indicates that no dedicated pilot shard preceded the recorded main grid at that size.

Intervention	$\Delta D_{N}$	$\Delta G_{\mathrm{fb}}$	$\Delta\alpha_{\mathrm{c}}$
Joint decrease	-0.405	-0.889	+0.046
Joint increase	+0.200	+8.465	-0.018
High conformity	+0.183	+0.930	+0.003
Increased network reach	-0.007	+0.914	-0.017

Appendix

Table 10: Matched diagnostics for selected interaction conditions.

Condition	$\boldsymbol{\widehat{\nu}}$	95% CI	$\boldsymbol{\alpha_{\mathrm{c}}(100)}$	$\boldsymbol{\alpha_{\mathrm{c}}(1000)}$
All-rule behavioral	0.164	[-0.009, 0.251]	0.0475	0.0300
Standard quota	0.181	[-0.063, 0.289]	0.0500	0.0300
Increased quota	0.190	[-0.081, 0.276]	0.0475	0.0280

Appendix

Table 11: Controller realization audit on the common resolved support

N\leq 1000

. Intervals are paired seed-bootstrap percentile intervals for the common-support exponent; all include zero.

Experiment shard	Calls	Cache hits	Cost (USD)	Errors
Primary S1 refined sweep	15,902	7,965	1.6182	3
S3–S4 transfer sweep	1,374	426	0.1439	0

Appendix

Table 12: Population-LLM invocation and cache audit. Counts are cumulative manifest totals; cache keys cover the complete request and schema.

$\boldsymbol{N}$	$\boldsymbol{\alpha_{\mathrm{c}}}$	$\boldsymbol{K_{c}=N\alpha_{\mathrm{c}}}$	10–90 width
100	0.047	4.71	0.024
200	0.036	7.20	0.013
300	0.037	11.00	0.028
500	0.034	17.22	0.018
1000	0.030	30.00	–
2000	0.022	44.00	–

Appendix

Table 13: Finite-size scaling point estimates for the S1 primary analysis. All tested sizes bracket

p=1/2

. The main paper reports the headline values and visualizes the trend in Figure 3.

Rule	$\boldsymbol{\widehat{\nu}}$	95% CI	$\boldsymbol{P(\nu>0)}$	$\boldsymbol{P(\nu<1)}$
All six sizes	0.222	[0.206, 0.277]	1.000	1.000
$\geq 2$ sizes	0.223	[0.152, 0.283]	1.000	1.000

Appendix

Table 14: Seed-bootstrap uncertainty for the finite-size exponent. The bootstrap unit is the experiment seed: each resample reconstructs all size-specific response curves, re-estimates

\alpha_{\mathrm{c}}(N)

, and refits the log–log exponent. The conservative row uses the all-size bracketing rule; non-bracketing midpoints are treated as censored rather than imputed.

$N$	Linear $\alpha_{\mathrm{c}}$	Logistic $\alpha_{\mathrm{c}}$	Abs. diff.
100	0.0471	0.0482	0.0011
200	0.0360	0.0392	0.0032
300	0.0367	0.0351	0.0016
500	0.0344	0.0328	0.0017
1000	0.0300	0.0299	0.0001
2000	0.0220	–	–

Appendix

Table 15: Midpoint-estimator sensitivity for the S1 finite-size sweep. Linear midpoints are the main estimand; logistic midpoints provide a monotone parametric check where finite.

Dropped size	$\widehat{\nu}$
None	0.222
100	0.213
200	0.239
300	0.222
500	0.224
1000	0.238

Appendix

Table 16: Leverage analysis for the finite-size exponent. Each row refits the linear-midpoint log–log slope after dropping one society size.

$N$	$\alpha_{\mathrm{c}}$	$K_{c}=N\alpha_{\mathrm{c}}$	Logistic $\alpha_{\mathrm{c}}$
100	0.015	1.50	0.0152
200	0.010	2.00	0.0101
300	0.0075	2.25	0.0076
500	0.005	2.50	0.0051
1000	0.003	3.00	0.0030
2000	0.002	4.00	0.0020

Appendix

Table 17: Watts-style threshold null on the matched society sizes and S1

\alpha

-grids. Collapse is final active fraction at least one half.

Threshold scale	Resolved sizes	$\widehat{\nu}$	Support
0.8	6/6	0.155	all sizes
0.9	6/6	0.268	all sizes
1.0	6/6	0.222	all sizes
1.1	4/6	0.144	$N\leq 500$
1.2	3/6	0.278	$N\leq 300$

Appendix

Table 18: S1 failure-threshold sensitivity. The exponent is fitted only over the resolved sizes in each row; rows with fewer than six resolved sizes are partial-support diagnostics.

Response subset	$b_{N}$	$b_{K}$	$\nu_{\mathrm{response}}$
All fixed- $K$	-0.784	1.575	0.503
Subcritical cells	-0.894	1.683	0.469
Zero-failure cells	-0.950	1.817	0.477

Appendix

Table 19: Fixed-count response-surface analysis. The response-contour exponent is

\nu_{\mathrm{response}}=1+b_{N}/b_{K}

Held-out $N$	Obs. $\alpha_{\mathrm{c}}$	Pred. $\alpha_{\mathrm{c}}$	Ratio	Abs. log err.
100	0.0471	0.0462	0.980	0.020
200	0.0360	0.0324	0.900	0.105
300	0.0367	0.0253	0.691	0.370
500	0.0344	0.0204	0.592	0.525
1000	0.0300	0.0154	0.514	0.665
2000	0.0220	0.0114	0.518	0.658

Appendix

Table 20: Strict no-midpoint response-contour predictions. Each row is predicted from subcritical fixed-count data at the other five society sizes. Ratios are predicted over observed critical fraction.

Diagnostic	$\Delta$	95% CI	+seeds
Role–action info	+0.327	[0.318, 0.335]	12/12
Role trade-rate gap	+0.264	[0.256, 0.271]	12/12
Action entropy	+1.089	[1.081, 1.098]	12/12
Trade participation	+0.348	[0.342, 0.354]	12/12
Social dominance $D_{N}$	+0.512	[0.461, 0.561]	12/12

Appendix

Table 21: Mixed-role behavioral diversity analysis. Values are paired differences relative to legacy-score agents across the 12 paper seeds.

Population	$\alpha_{\mathrm{c},300}$	$\alpha_{\mathrm{c},1000}$	Readout
legacy score	0.041	0.020	baseline
mixed roles	0.040	0.022	persists
risk-averse	0.065	0.045	robust
value	0.050	0.036	moderate
trend	0.041	0.031	near base
social	0.038	0.022	fragile

Appendix

Table 22: Role-homogeneous transition ablations. Smaller

\alpha_{\mathrm{c}}

indicates a more fragile population.

Agent Failure Analysis

Agent failure analysis studies how and why AI agents make errors, traces causes through execution, and helps detect or prevent recurrence.

See all 154 papers

Financial Fragility in Societies of LLM Agents: Coordination Failures and Stabilizing Mechanisms
Sep 25, 2026Zhenhao Fu, Ruipeng Xu, Qibing RenLLM Agent Safety Finance
Shanghai Advanced Institute of Finance, Shanghai Jiao Tong University · School of Artificial Intelligence, Shanghai Jiao Tong University
Predicting the scale limits of social mechanisms in agent societies
Aug 24, 2026Zengqing Wu, Chuan XiaoLarge Language Model-Based Social Simulation Emergent Behavior in Multi-Agent Systems
University of Osaka Osaka, Japan
Superminds Test: Actively Evaluating Collective Intelligence of Agent Society via Probing Agents
Apr 24, 2026Xirui Li, Ming Li, Yunze Xiao +4Multi-Agent Coordination AI Agent Evaluation
University of Maryland · 2Mohamed bin Zayed University of Artificial Intelligence · 3Carnegie Mellon University

Sep 25, 2026J/K move · Enter open · S save

Financial Fragility in Societies of LLM Agents: Coordination Failures and Stabilizing Mechanisms

Zhenhao Fu, Ruipeng Xu, Qibing Ren

Shanghai Advanced Institute of Finance, Shanghai Jiao Tong University · School of Artificial Intelligence, Shanghai Jiao Tong University

LLM Agent Safety Finance Multi-Agent LLM Systems Multi-Agent Systems AI Agent Safety Benchmarks

Open paper AskPDF arXiv

Individually protective decisions can produce avoidable collective failures. As large language model (LLM) agents take on greater roles in financial decision-making, financial AI safety must therefore be considered not only at the level of individual agents, but also at the level of the systems they jointly create. We study this problem with FRAIL, a controlled experimental framework that places LLM agents in three dynamic financial environments---bank runs, debt rollover, and reward crowdfunding---where agents' decisions reshape the financial conditions faced by others. Across seven leading LLMs, we find widespread collective fragility even when no agent is instructed to destabilize the system: 77% of baseline bank-run episodes and 83% of debt-rollover episodes end in failure. We then compare three interaction mechanisms based on compensated commitments, centralized commitment agreements, and participant-led coalitions. All three improve aggregate outcomes, but no single mechanism performs best across all financial structures. Across mechanisms, successful stabilization shares a common temporal pattern: broad commitment forms early, before defensive behavior becomes self-reinforcing. Our findings show that individually capable agents do not automatically form safe financial systems, highlighting system-level evaluation and interaction design as central problems for financial AI safety. Code is available at https://anonymous.4open.science/r/FinFrail-CF26.

Abstract

Agent Failure Analysis

Explore similar work

Financial Fragility in Societies of LLM Agents: Coordination Failures and Stabilizing Mechanisms

Predicting the scale limits of social mechanisms in agent societies

Superminds Test: Actively Evaluating Collective Intelligence of Agent Society via Probing Agents