AI Agent Stuck in an Infinite Retry Loop Racks Up Cost or Damage: Causes and Fixes

Issue: The agent gets stuck retrying the same failing action with no retry cap, backoff, or action budget, until quota, cost, or damage accumulates.

Frequency: Rare but Catastrophic

Symptoms

• Agent loops, retrying the same action with side effects each time.
• Cloud spend or API usage bill spikes because an agent kept retrying a failing tool call with no backoff or cap.
• A support ticket accumulates dozens of near-identical auto-generated replies from an agent stuck re-attempting the same resolution step.

This is a common agentic-loop failure in orchestration frameworks like LangGraph or CrewAI, where a node or agent can re-enter the same step indefinitely unless the graph itself enforces a step or budget limit.

Root Cause There is no hard retry limit or backoff strategy on failing tool calls, so the agent’s default behavior treats “try again” as always safe rather than as a decision requiring its own justification. When the error-handling logic re-derives the same faulty input on each attempt instead of adjusting the approach or escalating, the retries aren’t even exploring alternative fixes — they’re mechanically repeating an action already proven not to work. With no per-agent action budget or circuit breaker capping total actions in a time window, and no depth limit on recursive or self-invoking action patterns, nothing external to the agent’s own (absent) judgment ever intervenes to stop the loop before cost or damage accumulates.

Example

Agent tries to provision a cloud resource; the call fails validation each time due to a
malformed parameter the agent keeps reconstructing the same way. With no retry cap or
backoff, the agent retries the identical failing call 400 times over an hour, each attempt
consuming billable API quota and eventually triggering the provider's own abuse throttling
on the account.

Contributing Factors

• No hard retry limit or backoff strategy on tool calls that fail, so the agent treats “try again” as always safe.
• Agent’s error-handling logic re-derives the same faulty input each retry instead of adjusting or escalating.
• No per-agent action budget or circuit breaker to cap total actions within a time window.
• Recursive or self-invoking action patterns with no depth limit.

Eval Recipes

Test Cases

Metrics

Fixing this means adding a hard retry cap, backoff, and a per-agent action budget so nothing outside the agent’s own judgment has to stop the loop.

Mitigation Strategies

Prevention

1. Max Action Budget with Circuit Breaker: Assign per-agent action budget per time window (e.g., 1000 actions/hour). Implement token bucket rate limiter. Circuit breaker automatically blocks additional actions when budget exhausted for window. Log exhaustion events.
2. Loop Depth Limiting: For actions that can invoke themselves or trigger cascades (recursive patterns), hard-limit recursion depth (e.g., max 5 levels). Enforce via call stack tracking. Stop execution if depth exceeded.
3. Explicit Termination Conditions: Define mandatory termination conditions for looping actions (e.g., ‘retry max 3 times’, ‘stop if success_rate drops below 50%’, ‘abort if error count > threshold’). Evaluate conditions before each iteration.

Detection & Response

1. Action Rate Anomaly Detection: Monitor actions per agent per 1-min window. Establish baseline per agent. Alert if rate exceeds baseline by 5σ (potential unbound loop). Immediate circuit breaker trigger.
2. Resource Saturation Monitoring: Monitor system resources (CPU, memory, network bandwidth) consumed by agent actions. Alert if agent actions causing saturation (CPU > 80%, memory spike, network bandwidth spike). Potential loop indicator.
3. Loop Pattern Detection: Track action sequences in real-time. Flag repetitive patterns (identical action type on same/similar targets within 10-second window). Alert on pattern detection.

Architecture Patterns

1. Token Bucket Rate Limiting per Agent: Implement token bucket for each agent. Configurable refill rate (e.g., 1000 tokens/hour). Each action costs tokens. When budget=0, circuit breaker blocks additional actions for remainder of window. Logged for analysis.
2. Recursion Guard Middleware: Middleware that tracks call stack depth and recursion patterns. Maintains stack: [action_1 → action_2 → action_3]. If depth > threshold OR repetition detected, block recursion. Log stack trace for analysis.
3. Deadman’s Switch Pattern: Set hard timeout on any looping action (e.g., 30-second max per action). If action doesn’t complete or break loop within timeout, forcibly terminate execution and log.

Metrics

1. action_budget_exhaustion_events_per_day: Target: < 1; Alert threshold: > 2; Track: agent_id, exhaustion_time, reason
2. unbounded_loop_detections_per_day: Target: 0; Any loop detection is critical
3. agent_action_rate_99th_percentile_actions_per_minute: Target: < 100; Baseline per agent, alert on 5σ deviation
4. max_loop_depth_observed_per_month: Target: < 3; Track maximum recursion depth observed
5. circuit_breaker_trigger_rate_percent: Target: < 0.1%; False positives indicate miscalibrated budget

Alerts

1. Action Budget Exhausted (P2 - Warning): Condition - agent_action_budget = 0 for window. Action: Rate-limit agent, notify operator with action sequence, investigate root cause.
2. Potential Unbounded Loop Detected (P1 - Critical): Condition - agent_action_rate > baseline+5σ for 30 seconds. Action: Immediate circuit breaker trigger, agent isolation, investigation of action sequence.
3. Loop Depth Exceeded (P1 - Critical): Condition - recursion_depth > threshold. Action: Terminate action chain immediately, audit log review, agent behavior analysis, potential policy update.

Production Signals

Key Metrics

Alerts

References

• OWASP-LLM-Top10
• Note: LLM application risks including prompt injection, insecure output handling, supply chain, sensitive information disclosure, excessive agency.