Researchers from Google DeepMind, Microsoft Research, Columbia University, t54 Labs, and Virtuals Protocol propose the Agentic Risk Standard (ARS), a framework that applies financial risk management principles to AI agent transactions. Their paper, Quantifying Trust: Financial Risk Management for Trustworthy AI Agents introduces a settlement-layer protocol that uses escrow, underwriting, and collateralization to protect users from financial loss when autonomous AI systems execute tasks involving payments or assets.
The new open-source standard introduces escrow, underwriting, and collateral mechanisms to protect users when AI agents handle payments and assets – applying the same financial safeguards used in construction, insurance, and capital markets.
AI agents are evolving from chatbots into autonomous systems that write code, file taxes, manage customer service, and execute financial transactions. Recent developments across the industry have underscored the growing need for a clear financial risk standard for AI agents. Incidents involving autonomous systems, such as OpenClaw agents executing unintended financial actions or issuing tokens without proper safeguards, highlight how these systems can directly move value without sufficient oversight. At the same time, concerns about identity-linked infrastructure, including challenges faced by security teams at Meta and integrations with protocols like World ID, highlight the added complexity when financial activity intersects with digital identity.
As these systems take on tasks with real economic consequences, users face a fundamental problem: existing AI safety research focuses on improving model behavior, but cannot eliminate the possibility of failure. Large language models are inherently stochastic; thus, no amount of training can reliably reduce the probability of failure to zero. In a 2025 autonomous crypto trading competition, most AI agents lost money, with one model losing 63% of its capital and others dropping by 30-56%.
When an AI trading agent misexecutes an order, or a coding assistant introduces a critical bug, the resulting damage can far exceed the cost of the service. The researchers identify this as a “guarantee gap” — a disconnect between the probabilistic reliability that AI safety techniques provide, and the enforceable guarantees users need before delegating high-stakes tasks. Without a way to bound potential losses, users rationally limit AI delegation to low-risk tasks, constraining the broader adoption of agent-based services.
How Agentic Risk Standard works
Rather than attempting to make AI models perfect, Agentic Risk Standard takes a complementary approach inspired by how traditional industries have managed uncertainty for centuries. Financial markets use clearinghouses and margin requirements. Doctors carry malpractice insurance. Construction companies post performance bonds. The solution is not to eliminate risk, but to price it and allocate it through financial mechanisms that protect affected parties when things go wrong.
Agentic Risk Standard applies this logic to AI agents through two modes. For standard service tasks such as generating a report, writing code, preparing a document, payment is held in escrow and released only after the work is verified. For tasks where agents must handle user funds before outcomes are known such as trading, currency conversion, financial API calls, Agentic Risk Standard adds an underwriting layer: a risk-bearing party evaluates the task, prices the risk, may require the agent provider to post collateral, and commits to reimbursing the user under specified failure conditions.
The entire transaction lifecycle is formalized as a deterministic state machine with explicit fund-control rules, meaning that regardless of how an AI agent behaves internally, the financial outcome for the user is governed by auditable, enforceable settlement logic.
The paper includes a simulation study modeling users, AI agent providers, and underwriters interacting through the Agentic Risk Standard protocol across 5,000 episodes. Across all parameter configurations tested, the mechanism consistently reduced user losses relative to an ecosystem with no underwriting, with loss reductions ranging from 24% to 61% depending on pricing and risk estimation settings. In addition, the collateral mechanism independently deterred 15–20% of risky transactions from being executed in the first place, as fraud or misexecution now carries its own cost on the agent side, thus deterring agents from engaging in risky actions.
The results also expose structured trade-offs: tighter underwriting improves user protection and underwriter solvency but introduces friction that can reduce market participation — mirroring the trade-offs that exist in traditional insurance and financial markets.
The paper is co-authored by researchers across five institutions: Wenyue Hua (Microsoft Research; work initiated during an appointment at UC Santa Barbara), Tianyi Peng (Columbia University), Chi Wang (Google DeepMind), Ian Kaufman and Chandler Fang (t54 Labs), and Bryan Lim (Virtuals ACP). The research represents the individual scholarly contributions of the authors and does not represent the positions of their respective employers.
“Most trustworthy AI research aims to reduce the probability of failure. That work is essential, but probability is not a guarantee. ARS takes a complementary approach: instead of trying to make the model perfect, we formalize what happens financially when it isn’t. The result is a settlement protocol where user protection is deterministic, not probabilistic,” said Hua.
“The industry is building increasingly autonomous AI agents but hasn’t addressed what happens when they fail with someone’s money. That’s the problem t54 Labs was founded to solve, and the proposed Agentic Risk Standard represents our thinking alongside leading researchers across the industry and academia. We’re publishing it openly because the wider ecosystem needs to recognize that financial risk management for AI agents isn’t optional — it’s foundational,” said Fang.