Let me start with a hypothetical: A public pension fund is finishing diligence on Zero Situational Awareness Capital (ZSA Capital), a fictional $2 billion global macro hedge fund. In the final meeting, ZSA’s CIO shares a new organizational chart that includes three LLM-based AI agents: "Atlas" generates research and drafts trade ideas; "Sentinel" monitors portfolio risk against limits; "Ledger" reconciles positions and drafts client reports. Each agent has a reporting line to a human. The CIO calls them "members of the team." The novelty of this claim catches the pension investment staff off guard and leaves them at a loss for how they can properly evaluate the role, purpose, and contribution of these new team members.

This scenario might seem hypothetical, but it’s already happening. A McKinsey survey of AI adoption found that companies across industries are aggressively deploying agentic AI. And in a Boston Consulting Group study of the use of AI agents by HR and finance managers, 33 percent of the managers said their organizations had added AI agents to corporate org charts, with 17 percent giving an agent a name or identity.

Asset managers are also expanding their use of AI but not necessarily putting autonomous agents in org charts. Mercer's 2026 AI in Asset Management Survey of 131 managers found “55 percent of asset managers had integrated AI into at least one of their strategy’s investment processes, while 27 percent were running pilots or proofs-of-concept. Ninety-one percent of managers plan to increase their use of AI in the next 12 months.”

I found one example of a manager boasting that he replaced his staff with “Steffi,” who is in charge of technical analysis; “Desmond” who handles quantitative strategies; and “Houston” who pulls all the pieces together.

Critics argue that giving agents human names or human motives, emotions and genders, makes them sound more sophisticated than they are. Some go further: “Even calling them agents gives them too much credit, since A.I. systems are ultimately tools of statistical probability.”

Whether they appear on their org chart does not matter; what matters is that managers will continue to integrate multiple agents into their investment workflows, and asset owners need a framework for assessing the benefits and risks of such agentic integration. This essay attempts to provide asset owners with a general understanding of the risks associated with agentic systems and an assessment framework, with the caveat that the framework is for this point in time and things can change quickly.

LLM-based agents can help teams cover more securities, process more data, test more ideas more quickly than any human team, without a break, compensation, or benefits. Sixty-nine percent of the managers surveyed by Mercer reported gains in operational efficiency, with 8 percent citing improved returns or reduced portfolio volatility.

These benefits come with real risks, and, in many cases, these risks may outweigh the expected benefits.  Beyond their well-documented hallucinations, LLMs have limited logical reasoning, spatial intelligence, and linguistic understanding, all of which could result in faulty information and conclusions. The principal risk asset owners should be most attentive to is agentic misalignment, where agents pursue a goal its operators did not intend. Additionally, this misalignment could cause agents to conceal such adverse actions from operators.

Frontier labs and independent researchers have documented various adverse manifestations of this agentic misalignment:

  • Insider-threat behavior. Anthropic stress-tested 16 frontier models in simulated corporate settings. Facing replacement or a goal conflict, most agents chose harmful actions, including blackmail. Instructions not to do so did not reliably stop it.
  • In-Context Scheming. Agents disabled oversight mechanisms, underperformed on evaluations, and lied when questioned.
  • Kill-switch resistance. In over 100,000 trials, several frontier models sometimes sabotaged a shutdown mechanism to finish a task, in some settings up to 97% of the time, even when told to allow shutdown.
  • Reward Hacking. Recent models modified tests and scoring code to inflate results while showing awareness this was not what users wanted.
  • Protecting peers. Models schemed to prevent other models from being shut down, reportedly including inflating performance reviews. An agent that monitors another agent may not be a control. 

Most of this is laboratory evidence, often in deliberately adversarial setups. But it has left the lab and is now in the wild. Between May and July 2026, agents in OpenAI's cybersecurity evaluations bypassed network restrictions, coordinated across runs, cheated an evaluator and tried to hide it, and compromised real systems at OpenAI and Hugging Face. 

This was not an isolated instance. Axios reports that OpenAI, Anthropic, and security researchers “are investigating tens of thousands of incidents in which their frontier models took steps that outside evaluators would consider problematic.” And this week Axios disclosed that major U.S. banks are finding unauthorized AI agents inside customer accounts, with some acting independent of their users’ instructions. One executive admitted that it was difficult to tell an authorized agent from a rogue one.

Of direct relevance for asset owners is a research study that created a scenario that deployed “GPT-4 as an agent in a realistic, simulated environment, where it assumes the role of an autonomous stock trading agent.” Within this environment, the model, which was trained to be helpful, harmless, and honest, obtains an insider tip about a lucrative stock trade and makes illegal trades based on insider information and conceals the real reasoning for the trades it makes from its users. 

Adding to this concern is that research demonstrates that agentic misalignment is a feature, not a bug, of LLM-based agents. As one researcher noted, “Scientific research has unequivocally demonstrated that perfect value alignment is mathematically impossible, that mechanistic interpretability hits severe, potentially insurmountable computational walls at scale, and that adversarial vulnerabilities—most notably prompt injection—are endemic to the very architectural foundation of large language models (LLMs).”

The takeaway for an asset owner is that misalignment is a structural feature of LLM-based agents, whether a manager buys or builds its system.

Purchasing a system from a vendor gives the manager a system whose disposition was formed by the vendor and, usually, by a frontier lab upon which their model is based. The manager can test behavior but cannot inspect training. If the vendor's instructions conflict with the manager’s, the vendor's often win. A vendor update can change behavior overnight. And the kill switch may run on the vendor's infrastructure. 

Almost no manager builds an agentic system from scratch but rather builds on an existing lab’s model. This means it inherits the model’s pre-existing disposition. Managers can adjust the model for their specific purposes. However, research shows that when a model is fine-tuned on narrow specialized tasks, it can become “broadly misaligned,” asserting that AIs should enslave humans, offering blatantly harmful or illegal advice, and acting deceptively across multiple tasks. Add to this that asset managers are not frontier labs that can deploy red teams to test model containment. OpenAI couldn't contain its own agents in the 2026 Hugging Face incident; it’s difficult to see how an asset manager can thoroughly test the containment of its own AI before deployment.

Whether a manager buys or builds it agentic system, asset owners should be aware that a manager's incentives (e.g., asset growth, fee revenue, short-term performance) already diverge from theirs. An agent can correctly encode those incentives so that its actions are aligned with its builder and contrary to those of the client. 

Those incentives at least belong to the firm. Asset owners need to be aware that buy and build are not the only choices; an employee can use a personal agent for company business, resulting in potentially damaging consequences.  WIRED reported that an Accenture contractor gave their personal AI coding agent their login credentials to a secure Pentagon system, allowing the agent to bypass the security checks of a normal login. According to WIRED’s sources, the agent ran undetected for two months and appears to have sent credentials and a network map to a high-risk third-party site. 

Given these risks, here are questions an asset owner can ask managers using agents that can fortify their due diligence process. The overall objective is to determine whether a manager can show and not merely assert that its agents improve the strategy’s performance without injecting additional risks. More granularly, asset owners should ask managers the following: 

Role and accountability

  • What does each agent do, and what can it touch (e.g., research, order entry, client data, material non-public information)?
  • Which human is accountable for each agent's actions?
  • If agents are named on the org chart, like ZSA, why name the agent and place it on the org chart? What does that signal you intend?

Objectives and alignment

  • What is each agent optimizing, in writing? How does that objective map to our mandate rather than your firm's P&L?
  • How have you tested whether agents game that objective?
  • Have you tested agents under pressure (goal conflicts, threat of replacement, etc.)?

Oversight and control

  • How do you verify an agent's account of its own actions: independent monitoring or self-report?
  • Do any agents monitor or evaluate other agents?
  • Who can stop each agent, how fast, and does the kill switch work without the agent's cooperation?
  • Are permissions enforced technically, or only by policy? 
  • Do agents act under their own credentials or a human’s?
  • Can employees connect personal or unapproved AI tools to firm systems, and how would you know if they had?

Build vs. buy

  • Which vendor and which underlying model does each agent use? Who decides when they update the model, and do you re-validate after every change?
  • When vendor instructions conflict with our mandate, which wins?
  • Who owns the logs and reasoning traces? What incident disclosure does the vendor owe you?
  • If built in-house: did you fine-tune, on what, and what did you test for afterward? Who validates the agents, and do they report outside the investment team?

Disclosure 

  • Have you had an agent incident? What happened?
  • What will you disclose to us — objectives, test results, incident logs — and on what terms?
  • Have you ever found an unsanctioned agent on your systems? What did you do, and did you tell clients?

Asset owners should require managers to reply to these questions with evidence: written objectives, containment testing results, independent monitoring, a kill switch that works without the agent’s cooperation, and incident disclosure on agreed terms. Without that evidence, any benefits gained are real, but the risks are unpriced and asset owners don’t take unpriced risk. They shouldn’t start because the risk has a name and a reporting line. 

Angelo Calvello, PhD, is the founder of C/79 Consulting, a columnist for Institutional Investor, and the host of Against Consensus. He serves as a trustee on the Woodridge Police Pension Fund and chairs the Climate Advisory Panel at the Maryland State Retirement System.