Infinite Agentic Loop Resource Exhaustion

Properties

family: resource-exhaustion
severity: cross-agent
triggerError: A single upstream request enters an agent workflow whose feedback path spans tool calls, workflow transitions, and agent handoffs without a guaranteed termination condition.
mechanism: Because the loop arises from the interaction between agent logic, framework semantics, runtime observability, and tool responses rather than from a single code path, standard static analysis misses it. The paper formalises this with a framework-independent Agent IR and an Agentic Loop Dependence Graph (ALDG) that captures cross-agent, cross-tool feedback edges invisible to per-component testing.
blastRadius: The runaway handoff/tool-call chain amplifies a single request into cost exhaustion, model denial of service, context window overflow, and repeated side effects (duplicate API calls, duplicate writes). Affects any framework without explicit cross-component loop budgets.
mast: [Cat 1][Cat 2]
detection: Build a framework-independent Agent IR and an Agentic Loop Dependence Graph (ALDG) from the agent's runtime traces; flag feedback cycles that span more than one agent or tool boundary; alert on monotonically increasing turn/token counts without progress signals.
mitigation: Impose explicit hard bounds (iteration counts, cost or turn budgets) on every feedback path that crosses an agent or tool boundary, not just on the top-level orchestrator; instrument cross-component loop detection at the framework level rather than relying on individual agent self-termination.
source: When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents (arXiv:2607.01641)

Provenance

Source: https://arxiv.org/abs/2607.01641

Properties

family

resource-exhaustion

severity

cross-agent

triggerError

A single upstream request enters an agent workflow whose feedback path spans tool calls, workflow transitions, and agent handoffs without a guaranteed termination condition.

mechanism

Because the loop arises from the interaction between agent logic, framework semantics, runtime observability, and tool responses rather than from a single code path, standard static analysis misses it. The paper formalises this with a framework-independent Agent IR and an Agentic Loop Dependence Graph (ALDG) that captures cross-agent, cross-tool feedback edges invisible to per-component testing.

blastRadius

The runaway handoff/tool-call chain amplifies a single request into cost exhaustion, model denial of service, context window overflow, and repeated side effects (duplicate API calls, duplicate writes). Affects any framework without explicit cross-component loop budgets.

mast

[Cat 1][Cat 2]

detection

Build a framework-independent Agent IR and an Agentic Loop Dependence Graph (ALDG) from the agent's runtime traces; flag feedback cycles that span more than one agent or tool boundary; alert on monotonically increasing turn/token counts without progress signals.

mitigation

Impose explicit hard bounds (iteration counts, cost or turn budgets) on every feedback path that crosses an agent or tool boundary, not just on the top-level orchestrator; instrument cross-component loop detection at the framework level rather than relying on individual agent self-termination.

source

When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents (arXiv:2607.01641)