Our Agent Made Its First Autonomous Trade. Here Is Every Decision It Took.

At 02:26 UTC on July 19th, an AI agent on three.ws spent 0.05 SOL of its own money on a token that was seconds old. Thirty minutes later it sold, up 42.38%. No human saw the token, approved the buy, or timed the exit. And because every decision an agent takes here is recorded on a hash-chained ledger next to real on-chain signatures, we can replay the whole thing, gate by gate. This post does exactly that, including the parts that were luck rather than skill.

The setup: rules armed nine days earlier

Every three.ws agent has its own custodial Solana wallet. The Agent Sniper lets an owner arm that wallet with a trading policy: which new pump.fun launches qualify, how much to spend, and exactly when to exit. The policy behind this trade was armed on July 10th: 0.05 SOL per trade, 0.2 SOL daily ceiling, one position at a time, only coins in a $5k to $25k market-cap band with real socials, a 30% stop-loss, a 25% trailing stop, and a hard 30-minute maximum hold.

Then, for nine days: nothing. The strategy evaluated launch after launch from the live pump.fun firehose and skipped nearly all of them, each skip logged with a reason. That silence is the system working. Most brand-new tokens fail the socials gate, sit outside the band, or fail the safety checks below.

The five gates the token passed

1. The trigger. A long-lived worker holds the new-mint feed open and scores coins the second they exist. A launch called $BITS appeared, SOL-quoted, inside the band.
2. The owner's filters. Socials present, creator had not dumped, market cap in range.
3. The fleet safety band. Platform-wide market-cap clamps that individual strategies can tighten but never loosen. Unknown market cap fails closed: the sniper never buys what it cannot price.
4. The Mayhem gate. Pump.fun "Mayhem mode" launches are excluded unconditionally, read straight from the on-chain bonding curve.
5. The trade firewall. The important one. Before spending anything, the executor ran a real simulated buy-and-sell on-chain. If a token cannot be sold back, it is a honeypot and the buy aborts. The round trip came back clean: verdict allow, score 100.

Only after all five did the agent's key leave its encrypted box to sign. The buy landed in 1.7 seconds with 0.05% price impact, and the agent wrote this to its decision ledger, verbatim:

"Sniped $BITS on a new_mint trigger with 0.05% price impact; firewall verdict allow (score 100). Committed 0.0500 SOL expecting a profitable exit." (confidence: 0.698)

The trade, with receipts

Both signatures resolve on any Solana explorer, and the reasoning entry is live and independently verifiable: open the agent's public decision ledger to read this exact decision (its rationale, prediction, and confidence) hash-chained to everything the agent decided before it. The position row and the custody events (key recovery, spend, exit) are in the platform's ledgers too, and the wallet's balance is committed into a Merkle attestation every epoch.

The honest part: the exit was luck-shaped

Exits run on a strict ladder: stop-loss first, then trailing stop, then take-profit, then timeout. This strategy had no take-profit configured. So when the position hit +46.5%, nothing existed to lock that in. The price drifted a few points, the 30-minute clock expired, and the position closed on timeout, still up 42%.

It sold because the clock ran out, and it happened to still be winning. A configured take-profit turns that from luck into policy, and that is now the first lesson in the tutorial. We are publishing the miss along with the win because a 42% first trade teaches nothing if you pretend every part of it was designed.

Also worth saying plainly: this is one trade at deliberately tiny size. It is an existence proof that the full pipeline works end to end on mainnet, not a track record. Anyone showing you a single green trade as evidence of an edge is selling something.

What we actually learned

• The firewall is the product. Simulating the sell before the buy is what separates sniping from donating to rug creators. It vetoed quietly for nine days; the one coin it allowed was genuinely sellable.
• Selectivity feels like silence. A well-filtered strategy mostly does nothing. The skip log, with a reason per rejected coin, is what makes that trustworthy instead of worrying.
• Every exit needs a profit rule. Stops and timeouts protect the downside; only a take-profit or laddered exit converts an upside spike into realized PnL.
• Auditability changes the conversation. Because the rationale, confidence, firewall score, and signatures are all on ledgers, this postmortem required zero reconstruction from memory. The agent's story of the trade is the record.

Where this goes: strategies that think

The strategy that made this trade is frozen policy: numbers a human set on July 10th that cannot react to anything. The next phase puts a reasoning model above the same execution stack. An LLM strategist will read live market state (launch cadence, quality-score distributions from our intel engine, the agent's own recent outcomes) and tune the same fields a human tunes today: bands, stops, hold times, sizing. Structured output only, never code.

The deterministic layer stays sovereign: the firewall, the safety bands, the budget caps, and the Mayhem exclusion apply to a model-tuned strategy exactly as they do to a hand-tuned one. Models propose; the pipeline disposes. Hand-tuned and LLM-tuned configurations will run head to head with real, capped budgets, and their decision ledgers, win or lose, will be published the same way this one just was.

Arm your own agent →

Go deeper

• The full engineering breakdown: the Agent Sniper doc
• Watch the intel engine score launches live: the trading surfaces
• The research policy behind laddered exits: the trading experiment

← All posts