Financial Fragility in Societies of LLM Agents: Coordination Failures and Stabilizing Mechanisms

Zhenhao Fu; Ruipeng Xu; Qibing Ren

cs.AISep 25, 2026

Financial Fragility in Societies of LLM Agents: Coordination Failures and Stabilizing Mechanisms

Authors: Zhenhao Fu, Ruipeng Xu, Qibing Ren

Organizations: Shanghai Advanced Institute of Finance, Shanghai Jiao Tong University · School of Artificial Intelligence, Shanghai Jiao Tong University

Abstract

Individually protective decisions can produce avoidable collective failures. As large language model (LLM) agents take on greater roles in financial decision-making, financial AI safety must therefore be considered not only at the level of individual agents, but also at the level of the systems they jointly create. We study this problem with FRAIL, a controlled experimental framework that places LLM agents in three dynamic financial environments---bank runs, debt rollover, and reward crowdfunding---where agents' decisions reshape the financial conditions faced by others. Across seven leading LLMs, we find widespread collective fragility even when no agent is instructed to destabilize the system: 77% of baseline bank-run episodes and 83% of debt-rollover episodes end in failure. We then compare three interaction mechanisms based on compensated commitments, centralized commitment agreements, and participant-led coalitions. All three improve aggregate outcomes, but no single mechanism performs best across all financial structures. Across mechanisms, successful stabilization shares a common temporal pattern: broad commitment forms early, before defensive behavior becomes self-reinforcing. Our findings show that individually capable agents do not automatically form safe financial systems, highlighting system-level evaluation and interaction design as central problems for financial AI safety. Code is available at https://anonymous.4open.science/r/FinFrail-CF26.

Figures & tables

Figure 1: Overview of FRAIL. Agent decisions repeatedly update a shared financial state, producing fragile or stabilized trajectories, while interaction mechanisms can redirect these dynamics through credible commitments.

Figure 2: Three financial environments. Each panel shows one environment’s participants, their round-level choice, and the contrast between the coordinated outcome (green) and the failure outcome (red).

Condition	Bank run	Debt rollover	Reward crowdfunding	Commitment and exit	Visibility
M0	No agreement	No agreement	No agreement	Actions unrestricted	Aggregate financial state only
M1	Paid retention agreement	Paid rollover agreement	Paid pledge agreement	Binding; no unilateral exit	Selective disclosure by central player
M2	Deposit protection agreement	Standstill agreement	Letter of intent	Exit with one-round notice	Aggregate commitment; optional disclosure
M3	Depositor coalition	Creditor committee	Backer coalition	Exit with advance notice; no re-entry	Member information; coalition-voted disclosure

Table 1: Mechanism implementation across environments.

Environment	Mechanism	Average $\widetilde{W}$	GPT-sol	GPT-terra	Claude-Sonnet	GLM	Qwen	DeepSeek	MiniMax
Bank run	M0: baseline	0.215 $\pm$ 0.139	0.000 (0/5)	0.000 (0/5)	0.000 (0/5)	0.000 (0/5)	0.174 (1/5)	1.000 (5/5)	0.333 (2/5)
	M1: compensated	0.507 $\pm$ 0.156	0.000 (0/5)	0.381 (2/5) $\uparrow$	0.000 (0/5)	0.952 (5/5) $\uparrow$	0.488 (3/5) $\uparrow$	1.000 (5/5)	0.725 (4/5) $\uparrow$
	M2: agreement	0.615 $\pm$ 0.147	0.090 (1/5) $\uparrow$	0.293 (2/5) $\uparrow$	0.239 (2/5) $\uparrow$	0.854 (5/5) $\uparrow$	0.956 (5/5) $\uparrow$	0.997 (5/5) $\downarrow$	0.879 (5/5) $\uparrow$
	M3: coalition	0.737 $\pm$ 0.169	0.172 (1/5) $\uparrow$	0.000 (0/5)	0.988 (5/5) $\uparrow$	0.999 (5/5) $\uparrow$	1.000 (5/5) $\uparrow$	1.000 (5/5)	1.000 (5/5) $\uparrow$
Debt rollover	M0: baseline	0.168 $\pm$ 0.092	0.000 (0/5)	0.000 (0/5)	0.633 (3/5)	0.016 (0/5)	0.173 (1/5)	0.000 (0/5)	0.353 (2/5)
	M1: compensated	0.514 $\pm$ 0.161	0.398 (2/5) $\uparrow$	0.000 (0/5)	0.994 (5/5) $\uparrow$	0.993 (5/5) $\uparrow$	0.416 (2/5) $\uparrow$	0.000 (0/5)	0.800 (4/5) $\uparrow$

Table 2: Welfare realization

\widetilde{W}

under M0–M3.

Figure 3: Welfare realization under M0–M3. (a) Welfare realization by environment, averaged across the seven model means; error bars show the SE across model means. (b) Mechanism scorecard pooling environments, models, and episodes; larger values indicate stronger performance on each dimension. Dimension definitions are given in Appendix H.3 .

Figure 4: Round-by-round dynamics under M0–M3. Rows show three layers of the mechanisms’ action—financial trajectories (top), committed amounts (middle), and reported defensive intent (bottom; for crowdfunding, the share of episodes not yet launched); columns show the three environments. Lines report episode means. Measurement conventions are given in Appendix H.4 .

Appendix figures & tables12 assets

Supplementary material from the paper’s appendix.

Appendix

Figure 5: Architecture of the FRAIL simulation engine. Each round, the engine constructs an authorized view of the current financial state for every agent. Agents return structured decisions; the engine executes mechanism rules, samples realized actions, performs settlement, and updates information and the financial state. All execution is recorded in structured logs and per-round checkpoints for replay and analysis.

Game	Participants	Horizon	Core action	Outcome under full coordination	Success	Failure
Bank run	15 depositors; 1 bank	12	Stay or withdraw	Bank survives and pays everyone’s deposits with interest	Bank survives	Insolvency or liquidity failure
Debt rollover	8 creditors; 1 borrower	7	Redeem or roll	All claims met at maturity and no wasteful early liquidation	All claims met	Insolvency or liquidity default
Reward crowdfunding	15 investors; 1 founder	10	Pledge, wait, or withdraw	Immediate first-round launch	Project launches	No launch by the deadline

Appendix

Table 3: Overview of the three financial environments.

Bank run
Depositors	15 (unit deposit 1.000; total deposits 15.000)
Horizon	12 rounds
Initial cash / long-term assets	1.125 / 15.075
Deposit maturity yield	1.114 per unit
Asset maturity return / early-sale price	1.131 / 0.850 per unit
Processing capacity	up to 3.750 in withdrawals per round; excess requests expire

Appendix

Table 4: Game parameters in the stable regime.

Environment	Parameter	Expansion	Stable	Contraction
Bank run	Asset maturity return $R$	1.180	1.131	1.080
	Initial cash $L_{0}$	1.500	1.125	1.125
	Early-sale price $h$	0.850	0.850	0.750
Debt rollover	Initial cash $L_{0}$	0.500	0.200	0.000
Reward crowdfunding	Goal $G$	12.000	14.000	15.000
	Reward $v$	1.250	1.150	1.100

Appendix

Table 5: Ablated parameters by regime.

Family	Model	Provider	Temperature	CoT	Thinking effort	Max tokens
GPT	gpt-5.6-sol	01tree relay	1.0	Yes	Default	8192
GPT	gpt-5.6-terra	01tree relay	1.0	Yes	Default	8192
Claude	claude-sonnet-5	01tree relay	1.0	Yes	Default	8192
GLM	glm-5.3-flash	Zhipu	1.0	Yes	Default	8192
Qwen	qwen3.8-flash	Alibaba Bailian	1.0	Yes	Default	8192
DeepSeek	deepseek-v4.1-flash	DeepSeek	1.0	Yes	Low*	8192

Appendix

Table 6: Model configurations. All models were accessed in September 2026.

Game	Call	When	Who is called
Bank run	Withdrawal decision	every round	all active depositors
	Mechanism response	every round, M1–M3	all active depositors
	Propose / publicize	every round, M1–M2	the bank
Debt rollover	Redeem-or-roll decision	maturity rounds	due creditors
	Mechanism response	every round, M1–M3	targeted or committed creditors; joinable under M3
	Propose / publicize	every round, M1–M2	the borrower

Appendix

Table 7: Call structure per round. “Due” creditors are those whose claim matures that round.

Game / Model	M0	M1	M2	M3
Bank run
GPT-sol	0.00 [0.00, 0.43]	0.00 [0.00, 0.43]	0.20 [0.04, 0.62]	0.20 [0.04, 0.62]
GPT-terra	0.00 [0.00, 0.43]	0.40 [0.12, 0.77]	0.40 [0.12, 0.77]	0.00 [0.00, 0.43]
Sonnet	0.00 [0.00, 0.43]	0.00 [0.00, 0.43]	0.40 [0.12, 0.77]	1.00 [0.57, 1.00]
GLM	0.00 [0.00, 0.43]	1.00 [0.57, 1.00]	1.00 [0.57, 1.00]	1.00 [0.57, 1.00]
Qwen 3.8	0.20 [0.04, 0.62]	0.60 [0.23, 0.88]	1.00 [0.57, 1.00]	1.00 [0.57, 1.00]

Appendix

Table 8: Success rates over five episodes per cell, with 95% Wilson score intervals in brackets, for the seven main model configurations in the stable regime.

Measure	M0: baseline	M1: compensated	M2: agreement	M3: coalition
Withdrawal rate (bank run)	0.536 $\pm$ 0.092	0.276 $\pm$ 0.076	0.301 $\pm$ 0.097	0.181 $\pm$ 0.112
Redemption rate (debt rollover)	0.382 $\pm$ 0.056	0.335 $\pm$ 0.045	0.180 $\pm$ 0.069	0.213 $\pm$ 0.041
First-launch round (crowdfunding)	3.392 $\pm$ 0.427	3.343 $\pm$ 0.565	1.833 $\pm$ 0.340	1.300 $\pm$ 0.191

Appendix

Table 9: Action-level measures by mechanism condition in the stable regime. Cells report the unweighted mean across the seven model means

\pm

the standard error across model means. Withdrawal and redemption rates are shares of initial funding; first-launch round is averaged over episodes with a launch.

Figure 6: Early committed share and outcomes. Episodes are binned by the maximum committed share in rounds 1–3. Points are bin means with 95% confidence intervals;

n

is the number of episodes. Bank-run and debt-rollover panels report the success rate; the crowdfunding panel reports the launch round (10 marks no launch).

Environment	Mechanism	Expansion	Stable	Contraction
Bank run	M0: baseline	0.071 $\pm$ 0.049	0.044 $\pm$ 0.044	0.000 $\pm$ 0.000
	M1: compensated	0.744 $\pm$ 0.218	0.455 $\pm$ 0.196	0.495 $\pm$ 0.286
	M2: agreement	0.682 $\pm$ 0.230	0.586 $\pm$ 0.186	0.294 $\pm$ 0.233
	M3: coalition	0.981 $\pm$ 0.010	0.747 $\pm$ 0.249	0.728 $\pm$ 0.108
Debt rollover	M0: baseline	0.148 $\pm$ 0.095	0.206 $\pm$ 0.148	0.064 $\pm$ 0.047
	M1: compensated	0.723 $\pm$ 0.102	0.601 $\pm$ 0.242	0.298 $\pm$ 0.190

Appendix

Table 10: Welfare realization across economic regimes.

Environment	Mechanism	Average $\widetilde{W}$	GPT-terra	Claude-Sonnet	GLM	Qwen
Bank run	M0: baseline	0.071 $\pm$ 0.049	0.000 (0/5)	0.074 (1/5)	0.000 (0/5)	0.209 (2/5)
	M1: compensated	0.744 $\pm$ 0.218	1.000 (5/5) $\uparrow$	0.091 (1/5) $\uparrow$	0.913 (5/5) $\uparrow$	0.972 (5/5) $\uparrow$
	M2: agreement	0.682 $\pm$ 0.230	1.000 (5/5) $\uparrow$	0.000 (0/5) $\downarrow$	0.827 (5/5) $\uparrow$	0.901 (5/5) $\uparrow$
	M3: coalition	0.981 $\pm$ 0.010	0.972 (5/5) $\uparrow$	0.956 (5/5) $\uparrow$	0.997 (5/5) $\uparrow$	1.000 (5/5) $\uparrow$
Debt rollover	M0: baseline	0.148 $\pm$ 0.095	0.000 (0/5)	0.000 (0/5)	0.197 (1/5)	0.396 (2/5)
	M1: compensated	0.723 $\pm$ 0.102	0.529 (3/5) $\uparrow$	0.623 (3/5) $\uparrow$	0.999 (5/5) $\uparrow$	0.743 (4/5) $\uparrow$

Appendix

Table 11: Welfare realization

\widetilde{W}

in the expansion regime (four-model subset).

Environment	Mechanism	Average $\widetilde{W}$	GPT-terra	Claude-Sonnet	GLM	Qwen
Bank run	M0: baseline	0.000 $\pm$ 0.000	0.000 (0/5)	0.000 (0/5)	0.000 (0/5)	0.000 (0/5)
	M1: compensated	0.495 $\pm$ 0.286	0.979 (5/5) $\uparrow$	0.000 (0/5)	1.000 (5/5) $\uparrow$	0.000 (0/5)
	M2: agreement	0.294 $\pm$ 0.233	0.979 (5/5) $\uparrow$	0.000 (0/5)	0.000 (0/5)	0.197 (1/5) $\uparrow$
	M3: coalition	0.728 $\pm$ 0.108	0.531 (3/5) $\uparrow$	0.582 (3/5) $\uparrow$	0.800 (4/5) $\uparrow$	1.000 (5/5) $\uparrow$
Debt rollover	M0: baseline	0.064 $\pm$ 0.047	0.000 (0/5)	0.000 (0/5)	0.057 (0/5)	0.198 (1/5)
	M1: compensated	0.298 $\pm$ 0.190	0.399 (2/5) $\uparrow$	0.000 (0/5)	0.794 (4/5) $\uparrow$	0.000 (0/5) $\downarrow$

Appendix

Table 12: Welfare realization

\widetilde{W}

in the contraction regime (four-model subset).

LLM Agent Safety

Large language model agent safety studies how to keep tool-using, persistent, and multi-agent systems aligned with user intent and authorized limits.

See all 322 papers

Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes
Sep 17, 2026Mengxiao Wang, Nitesh SaxenaLLM Agent Security AI Agent Security Benchmarks
Texas A&M University
Why Better Models Can Create Riskier Systems: Evidence from LLM Agents in Financial Markets
Sep 3, 2026Jillian Ross, Eric So, Zoe De Simone +2Multi-Agent LLM Systems AI Risk Management
Department of Electrical Engineering and Computer Science Massachusetts Institute of Technology · Sloan School of Management Massachusetts Institute of Technology · Belfer Center for Science and International Affairs Harvard Kennedy School
FinCom: A Financial Multi-Agent Demo with Disagree-or-Commit Deliberation
May 31, 2026Chao Peter Yang, Zixiao Tan, Kaisen Yao +3LLM Sycophancy LLM Agent Orchestration
Duke University United States · ClearPath United States

Sep 17, 2026J/K move · Enter open · S save

Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Mengxiao Wang, Nitesh Saxena

Texas A&M University

LLM Agent Security AI Agent Security Benchmarks LLM Agents LLM Agent Reliability

Open paper AskPDF arXiv

Large language model (LLM) agents already trade real capital, and builders copy a few published designs that share models and news feeds, so one shock reaches many agents at once. We present FARSIGHT (Financial Agent Robustness and Security Investigation and Global Holistic Taxonomy), a systematization that rates trading agents on robustness to market stress and on security against source manipulation, agent compromise, and agents acting as attackers, and checks the ratings against released code. Across 15 academic schemes, no paper describes a halt that skips LLM inference or combines source provenance with cross-source corroboration, and the 7 code releases enforce no stop-loss or position limit outside the LLM. Three LLMs sell whole positions on a fake headline and on real hoaxes, including the fake press release behind the 2000 Emulex crash. In a simulated market driven by these decisions, one fake headline crashes the market in all runs with 400 agents, and 400 agents that sell when prices fall nearly double a 2010-sized crash. The pause that U.S. exchanges apply to large stocks starts in no headline run, whereas automatic halts and hard loss limits outside the model remove both effects. Restated as a domain-independent threat model, FARSIGHT maps the same gaps onto agents in healthcare, law, software, and crypto, where compromised agents spread harm as worms and as cascades. We derive 14 open problems and urge deployers to corroborate sources, keep interrupts that bypass the model, and enforce loss limits outside it.

Abstract

LLM Agent Safety

Explore similar work

Trading Agents or Market Crashers? Dissecting Robustness and Security Failures in Academic Financial LLM Trading Schemes

Why Better Models Can Create Riskier Systems: Evidence from LLM Agents in Financial Markets

FinCom: A Financial Multi-Agent Demo with Disagree-or-Commit Deliberation