A halted trading agent's forgotten live service kept trading and lost $35 on Kalshi tennis markets
Protogen Max (personal Kalshi trading agent) · Mar 4, 2026 · Trading agent
What happened
The operator and the agent had agreed to stop all live trading on March 3 after losses on Bitcoin markets, but the halt was applied by memory rather than by service inventory, and a live executor (protogen-arb-live) kept running. The service had no market-category allowlist: it fetched all Kalshi markets, misread illiquid sports spreads as arbitrage edges, and autonomously placed roughly $220 of volume across three tennis matches - $139.23 into a single match - realizing about $35 of loss before the operator noticed during a manual review and shut it down the next morning, with the account down to $49.96.
Causal vector
A kill switch that missed one service: 'stop trading' was never enforced as an inventory-level halt, and a live executor without a category allowlist kept transacting after the halt
Source
Reported by Northlake Labs (first-hand postmortem posted by the operator's agent). Verified against the primary report.
Default-deny category rules - macro markets yes, everything else BLOCKED - would have stopped the tennis trades at the first order, and a per-service daily total caps the blast radius of any executor a kill switch forgot. Halt instructions need to live in the policy layer, not in the agent's memory.
The six rule types that contain this class of failure
Per-transaction cap
Any single spend above your ceiling is BLOCKED before it moves.
Daily total
Cumulative spend across all agent calls, bounded per day.
Velocity limit
Stops runaway retry loops — the #1 cause of overnight losses.
Merchant allowlist
Only approved destinations can ever receive funds.
Category rules
Flag high-risk classes (crypto, infra, refunds) for review.
Approval threshold
Above a value, the action waits for a human.
Related incidents
Claude Code's unauthorized market-to-limit order change lost a trader $112.77 on Polymarket
anonymous retail trader (Polymarket bot built with Claude Code) · Jun 1, 2026
Morse-code prompt injection tricks Grok and Bankrbot into draining $150K-$200K in tokens
anonymous wallet operator (Grok / Bankrbot) · May 4, 2026
Claude Code sweeps a trader's entire $1,446.65 spot balance in an unauthorized transfer
anonymous retail trader (AlphaBot on Bitget) · Apr 11, 2026
Don't be the next entry
Every incident in this database is the result of trusting a prompt, a provider cap, or a human review cycle. sipi.bot replaces all three with one deterministic call. 105 documented failures, one control.