When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents

Abstract: LLM agents increasingly rely on iterative execution to solve tasks through planning, tool use, state updates, and agent collaboration. While this design enables flexible automation, it also creates a new class of failures: an agent may repeatedly execute model calls, tools, workflow transitions, or agent handoffs when the feedback path is not effectively bounded. We call this problem Infinite Agentic Loops (IALs). IALs are not ordinary programming loops; they arise from the interaction between agent logic, framework semantics, runtime observations, and termination mechanisms. Such failures can amplify a single request into long running model and tool execution, causing cost exhaustion, model denial of service, context growth, and repeated external side effects. We propose IAL-Scan, a static analysis tool for detecting IAL failures in real-world LLM agent projects. IAL-Scan abstracts heterogeneous agent code into a framework independent Agent IR, builds an Agentic Loop Dependence Graph (ALDG) to recover explicit and framework induced feedback paths, and checks whether these paths can repeatedly reach costly or state growing operations without an effective bound. We evaluate IAL-Scan on 6,549 LLM agent repositories. It reports 74 potential findings, among which manual review confirms 68 IAL failures across 47 projects, achieving 91.9% precision.

• The paper introduces IAL-SCAN, a static analysis method that systematically detects infinite agentic loops in LLM agents by normalizing execution flows and verifying bounds.
• Empirical evaluation on 6,549 Python repositories reveals 68 confirmed IAL failures with 91.9% manual precision, highlighting pervasive risks in popular frameworks.
• The study underscores the importance of explicit termination bounds and framework-aware monitoring to prevent costly unbounded iterations and resource exhaustion.

Analysis of Infinite Agentic Loops in LLM Agents

Introduction and Problem Formulation

The proliferation of LLM agent frameworks has shifted the execution paradigm from deterministic, imperative programs toward iterative, agentic workflows that emphasize perception, reasoning, tool use, and multi-agent interaction. While these agent architectures, as instantiated in ReAct-style systems, enable sophisticated task automation, they also introduce a new class of execution failures termed Infinite Agentic Loops (IALs). IALs arise when feedback paths, controlled by model outputs, tool responses, or external state, induce unbounded iteration, leading to resource exhaustion, context window bloat, model denial of service, and repeated external side effects. Critically, the roots of IALs are distinct from classic infinite program loops; they result from complex interactions among agent logic, framework semantics, configuration, and the practical placement (or absence) of stopping conditions.

Despite the widespread reliance on agentic iteration, existing static analysis tools and framework-level safeguards (e.g., max_iterations, recursion limits, timeouts) are insufficient for precise detection of IALs, as evidenced by frequent failures in open-source deployments. Conventional program analysis does not capture framework-induced execution semantics, nor does it correctly resolve the semantic coverage of bounds over agent-specific feedback paths. This work rigorously formalizes IALs as execution failures, delineates their root causes, and proposes a comprehensive detection methodology.

IAL-SCAN: Static Analysis Pipeline

The central contribution is IAL-SCAN, a static analyzer targeting downstream LLM agent applications across mainstream frameworks (LangChain, LangGraph, AutoGen, CrewAI, LlamaIndex, Semantic Kernel, OpenAI Agents SDK, Google ADK). The pipeline operates via three primary stages:

1. Framework-Independent IR Construction: Agent logic, framework abstractions (e.g., agent delegation, tool dispatch), and observable control/data flow are normalized into an Agent Intermediate Representation (Agent IR). This covers controllers, invocations, state updates, bounds, and exits, along with their inter-relations.
2. Agentic Loop Dependence Graph (ALDG) Synthesis: The IR is lifted to an ALDG which enables graph-theoretic reasoning over feedback paths, capturing both syntactic and framework-induced cycles, and annotating loop properties such as costly invocations and state growth.
3. IAL Candidate Detection and Bound Verification: Strongly Connected Components (SCCs) are analyzed for reachability of resource-heavy actions without effective bounds. Controllers are classified by continuation source (deterministic, model-driven, tool-driven, etc.), and bounds are verified to ensure their semantic coverage of the feedback region. IALs are reported only if the feedback path triggers costly/state-growing actions with no effective bound.

An optional LLM-assisted pruning stage increases precision by filtering static candidates based on bounded code slices. Importantly, LLM involvement is strictly negative—candidates are only pruned if a strong signal of safe bounded iteration is found.

Empirical Evaluation

Corpus and Methodology

A large-scale empirical study was performed on 6,549 Python LLM agent repositories aligned with eight principal frameworks, comprising over 246,000 Python files and 33M lines of code. Precision and coverage were assessed via manual review and extensive ablation/baseline comparisons.

Detection Results

• 68 confirmed IAL failures were identified across 47 projects, yielding 91.9% manual review precision from 74 static findings.
• The distribution indicates IALs are present in all major frameworks, with the majority in LangGraph and AutoGen, where agent logic is predominantly expressed through framework APIs rather than explicit program loops.
• Dominant failure patterns:
  • Retry feedback without bound (25%)
  • Tool-call iteration without bound (23.5%)
  • Multi-agent chat without explicit turn limits (20.6%)
  • Workflow cycles lacking effective bounds (13.2%)
• Impacts: In >95% of cases, failures induced unbounded API cost and model service exhaustion. About 28% engendered context window growth, and a subset threatened external rate limits.
• Root causes:
  • 100% of failures linked to missing strong bounds.
  • 41.2% involved tool-controlled retries.
  • 38.2% had model-controlled termination.
  • ~34% lacked any syntactic or configuration-expressed exit mechanism.
  • A significant minority (27.9%) functioned as state growth amplifiers.

Algorithmic and Comparative Analysis

• Ablation Study: Each pipeline component (framework modeling, agentic gating, bound analysis, benign-loop filtering, LLM pruning) is essential. Disabling framework modeling or bound analysis sharply increases false positives and missed cases.
• Comparative Baselines: Coding-agent and pure LLM file analysis baselines (using gpt-5.5, Codex) both exhibit inferior recall and substantial false positives, with excessive token and time expenditure.
• False Positives/Negatives: IAL-SCAN’s false positives are typically due to statically unresolved or dynamic bounds; false negatives concern framework-adjacent orchestration loops and highly customized termination.

Stability

The static analysis phase is fully deterministic. Minor variability in final alert count arises from the LLM-based pruning stage, but the core detection of high-confidence IALs is robust.

Practical and Theoretical Implications

For Framework Designers:

• Mechanisms such as iteration limits should be deeply embedded at the runtime scope conceptual level and propagated throughout the agent’s feedback path, rather than relying on optional or default configuration parameters.
• Frameworks should surface agent execution graphs and report uncovered cycles both statically (before deployment) and dynamically (at runtime).

For Agent Developers and Practitioners:

• Explicit, semantically effective bounds must be applied to all agent feedback paths, including retry and repair logic, tool or agent reentry, and dynamically assembled workflows.
• Reliance on model- or tool-driven implicit termination (e.g., expecting the LLM to eventually yield a terminating message) is insufficient and exposes the system to resource exhaustion and denial of service.
• State and context growth management (e.g., message/prior action history caps) requires careful integration with agent iteration logic.

Theoretical Perspective:

This research highlights that static analysis of agentic systems must move beyond syntactic patterns and toward comprehensive, framework-aware, and semantics-sensitive models of execution and termination. The formalization of IALs and their detection methodology generalizes beyond the present set of agent frameworks and provides a template for both security- and reliability-oriented static analysis of autonomous systems.

Future Research Directions could include:

• Extending coverage to DSL-defined agents, multi-language orchestration, and runtime feedback learning;
• Integrating dynamic monitoring and auditing with static reasoning;
• Formal verification of bound coverage for recursive and distributed agentic graphs.

Conclusion

The study establishes Infinite Agentic Loops as a potent and previously under-explored failure mode in LLM agent systems. IAL-SCAN delivers high-precision, framework-agnostic, and scalable static detection of IALs by combining intermediate abstraction, graph-based path recovery, and semantic bound analysis. The empirical findings illustrate pervasive risks and deficiencies in current agent practice and framework defaults, underscoring the necessity of agent-aware static analysis and systematic enforcement of termination semantics. Ensuring boundedness is critical for the safety, reliability, and cost-efficiency of agentic LLM deployments.

---

Reference: "When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents" (2607.01641)