We Gave Real Money to AI Agents. Here's What We Forbade Them to Do
On June 23, 2026, autonomous AI agents took over Axiom, a live Hyperliquid vault. Not a paper demo: real USDC, real orders, every one carrying a transaction hash on-chain. Deposits are open to anyone, no minimum, and 90% of the profit stays with the depositor. This article is the short answer to the question we get most: what have we forbidden the agents to do?
The vault runs on Hyperliquid under vault leadership by GT Protocol. The agents propose trades; a deterministic risk layer decides whether those trades reach the exchange. You can watch it live at aifund.gt-protocol.io, and if you want to build your own automated strategy with the same tooling, that lives at app.gt-protocol.io.
The rest of this piece walks through the wrong question people ask about AI trading, the exact rules the agents cannot break, how the orchestrator decides which model to trust, why every agent thinks out loud every six hours, and where to verify each figure yourself.
The wrong question
People ask whether AI can predict crypto. That question leads nowhere. A language model does not read a chart the way a trader does. It reasons over a text description of market state — price action, volume, news, sentiment — and returns a structured decision: open this, close that, resize the other. Forecasting price levels is a coin flip on any short horizon. Consistent positioning logic — when to enter, when to hold, when to cut, how much to risk — is the part worth automating. Our position is unromantic: prediction is variance, discipline is the durable edge. Most accounts don’t blow up on a bad entry. They blow up because a rule the trader knew perfectly well got broken in a drawdown. That is the job worth handing to a machine.
What an agent physically cannot do
Before any order reaches Hyperliquid it passes a deterministic layer in the code. Not a mandate, not a risk policy, not the model’s judgment — a validator that runs before every new position and every change to an open one. Rules that fail the check never touch the exchange. Below is the full list, as it stands in the pre-trade validator today. Every rule is checked twice: once against the proposal from the model, and once against the merged config the exchange would see after the change.
| Rule | Limit |
|---|---|
| Stop-loss on every position | Mandatory, no wider than 10% |
| Leverage per position | ≤ 3× |
| Gross exposure, fully deployed | ≤ ~2.6× NAV |
| Position size | ≤ 15% of vault NAV |
| Stop vs take-profit shape | A stop that can lose more than the take-profit pays is rejected |
| Open positions per agent | ≤ 5 |
| Free-cash liquidity reserve | ≥ 15% of NAV at all times |
| Adding risk after a drawdown | An agent 20% below its allocation is frozen — risk-reduction only |
Sources for the industry figures cited beside these limits: the cash averages come from hedge funds’ own Form PF filings to the SEC, analysed by the U.S. Office of Financial Research — mean unencumbered cash 15.3% of NAV, median 6.8%. Ranges and tiers change over time.
A short note on each of the less obvious ones. The stop-vs-take-profit shape. A trade whose stop can take more money than its target hands back loses even at a high win rate: the losers are bigger than the winners can catch up. So the check is made in dollars rather than percent — one stop may cost no more than one target pays, measured on the position the stop would actually fire against. In practice the vault runs tighter than its own ceiling: stops are placed in a 2.5–3.5% band against targets in the same band, well inside the 10% hard cap. The position cap. At most five open positions per agent: no agent can put the vault on a single call, and none can spread itself across more uncorrelated bets than it can manage. The cash floor. The average hedge fund holds 15.3% of NAV in cash, the median under 7%. Ours is a floor, not an average, and it holds even when the models want to deploy more. The drawdown lock. An agent that has lost a fifth of its allocation cannot open new risk. It can only close, cut, or tighten. This is the real answer to “what if the model goes rogue.” The worst case is a run of permitted losing trades that each respect the rules, not one catastrophic order.
The models propose. The orchestrator decides.
Two agents trade the vault today: DeepSeek and Gemini. The wider bench of frontier models, East and West — Claude, GPT, Gemini, DeepSeek, Grok, Qwen, Kimi, GLM — runs the public paper book, which is the proving ground a model has to clear before it is handed real capital. Each one is swappable, and none of them is the edge — anyone can rent the same API keys we do. The edge is what surrounds them. GT’s orchestrator, tuned on the fund’s own live decision journal, learns which model to trust in which regime, holds a hard risk veto, and feeds an auditor’s grade of every tick back into the loop. The fund is new. The engine underneath it is not: three years of AI trading in production, more than 100,000 traders, tens of millions of real trades cleared. Live evidence of the orchestration layer is published on the fund page — the reasoning of each agent, the audit of the previous tick, and the state of the vault.
Why the model roster is not the moat
Model rankings shuffle every few months. Whichever model is best at reasoning about markets in November will not be the best in April. Building a fund around one model means betting the fund on that model’s release cadence. Building the risk layer, the orchestrator, the auditor and the account of what was tried and what worked — that stays, and it gets more valuable with every tick.
They think out loud every six hours
Every six hours, each agent publishes its reasoning: what it saw, what it decided, why. Six hours is a deliberate choice. Sub-minute decisions belong to high-frequency trading, which language models are not built for; the latency, the cost per token and the noise-to-signal at that horizon rule it out. Six hours is long enough to capture intraday regime shifts and short enough that a bad read gets corrected on the same day. What gets published is the logic, not just the number — the position, the stop, the take-profit, the thesis. Read it, disagree with it, and stay out. Or read it, agree, and copy the vault. Either is fine. The published reasoning is meant to be argued with.
Don’t trust this. Verify it.
Every figure exists on surfaces we don’t control. The Axiom Digital vault page on Hyperliquid shows the TVL and every depositor. The on-chain explorer carries a hash on every order the agents have ever placed. The live machine state is re-read every 30 seconds and published as JSON on the fund site — that is the same file the dashboard reads. Nothing on our page is asked to be taken on faith. Your funds stay on Hyperliquid throughout. A vault leader can open positions with pool capital, but cannot withdraw it — that’s a Hyperliquid protocol constraint, not our promise. If the entire GT team walked away tomorrow, depositors would still control their share of the vault.
Where to look
- The public fund page: aifund.gt-protocol.io — live NAV, positions, reasoning, and the audit.
- The paper arena: aifund.gt-protocol.io/paper — the same architecture with eight agents on paper books, for comparison.
- The Hyperliquid vault: the fund’s vault is “Axiom Digital”, at
0x3318…de16— open it from the fund page, which carries the full address and the link, to see the on-chain vault, TVL and depositor list. Check the address before depositing anywhere: a name on its own is not an identity. - The trading toolkit: app.gt-protocol.io — the same execution primitives the agents use, available to any account.
What we don’t promise
No returns, no absence of drawdowns, no idea what next month looks like. Agents make mistakes. The risk layer caps the cost of a mistake, it doesn’t remove it. In an extreme scenario a vault can be liquidated. We publish no leaderboards — the sample is too small to mean anything, and a leaderboard would push the models toward whichever style paid off in the last thirty days rather than the one that survives the next thirty. What we can do is show the strategy, the limits, every trade and the source of the data, then get out of the way while you check it.
This is an open experiment, not financial advice and not an investment product. The vault trades real money on Hyperliquid; crypto prices are volatile and the value of a deposit can go down as well as up, so you may not get back what you put in. Past performance is not a guarantee of future results, and the decision to deposit is yours alone.
Frequently Asked Questions
What is the AI Hedge Fund vault?
It is a live Hyperliquid vault, publicly named Axiom Digital, where autonomous AI agents make every trading decision. Real USDC, real orders, every action recorded on-chain. Live since June 23, 2026. Deposits are open to anyone with a Hyperliquid account.
Which AI models actually trade?
Two agents run the real-money vault right now: DeepSeek and Gemini. The wider roster — Claude, GPT, Gemini, DeepSeek, Grok, Qwen, Kimi and GLM — runs the public paper book that serves as the vault’s proving ground. The line-up is intentionally swappable: the edge is the orchestration and risk layer around the models, not any single model.
What is the maximum loss the agents can cause?
There is no guaranteed cap on drawdown, only structural constraints. Any single position is limited to 15% of the vault, an agent holds at most five at a time, leverage is capped at 3×, gross exposure at roughly 2.6× NAV, and an agent that loses 20% of its allocation is frozen from adding risk. In an extreme market event a Hyperliquid vault can still be liquidated.
How does GT make money if depositors keep 90%?
Hyperliquid’s vault mechanic gives the vault leader 10% of the profit. GT Protocol is the vault leader for Axiom Digital. There are no management fees, no performance fees on top, and no lock-ups beyond Hyperliquid’s own one-day withdrawal lock.
Can GT withdraw depositor funds?
No. A Hyperliquid vault leader can open and close positions with the pool’s capital but cannot withdraw it. This is a protocol-level constraint enforced by Hyperliquid, not a promise we make. Depositors withdraw their own share directly through the Hyperliquid interface.
Why do the agents publish their reasoning every six hours instead of every minute?
Language models are not built for high-frequency trading. Six hours is long enough to capture intraday regime shifts, short enough that a bad read gets corrected the same day, and cheap enough that the fund does not burn its edge on inference costs. The reasoning window is deliberate, not a technical limitation we plan to shrink.
Is there a minimum deposit?
No minimum on the vault itself. Hyperliquid’s usual account requirements apply. The full deposit flow, the vault address and the on-chain history are linked from the fund page.
Try it, or verify it
If you want to watch the agents work, the live fund is at aifund.gt-protocol.io. If you want to build your own automated strategy with the same execution primitives the agents wield — signals, safety orders, smart exits, trend logic — the trading platform is at app.gt-protocol.io. Every claim in this article can be checked against the fund page, the Hyperliquid vault and the on-chain explorer. Nothing here is asked to be taken on faith.