Infinite Agentic Loops in LLM Systems

• Infinite Agentic Loops (IALs) are failures in iterative LLM systems characterized by unbounded recursive feedback lacking effective termination.
• They are analyzed as both execution traces in multi-agent frameworks and divergent semantic trajectories in normalized embedding spaces.
• Mitigation strategies emphasize explicit termination bounds, static DAG scheduling, and robust monitoring of feedback paths to prevent runaway behaviors.

Infinite Agentic Loops (IALs) are failures of iterative large-language-model systems in which recursive feedback is not effectively bounded, so model calls, tool invocations, workflow transitions, or agent handoffs continue without a terminal halt. In Tacheny’s geometric formulation, the same phenomenon can be analyzed as a discrete dynamical system over text artifacts and semantic embeddings, where successive outputs define an agentic trajectory that may contract toward an attractor or diverge without cluster formation. Recent work therefore treats IALs at two closely related levels: as unbounded execution traces in agent frameworks, and as divergent semantic trajectories in iterative LLM transformations with no emergent bounded region (Hou et al., 2 Jul 2026, Tacheny, 11 Dec 2025).

1. Formal scope and definitions

At the level of iterative text transformation, an agentic loop is modeled as a discrete dynamical system on the artifact space $A$, the set of all text strings. With a fixed transformation $F:A\to A$ induced by a prompt template and an LLM call, the loop evolves as

$a_{t+1}=F(a_t).$

In embedding space $E\subset\mathbb{R}^d$, with normalized representation $x_t=\psi(a_t)$, the update becomes

$x_{t+1}=f(x_t),$

and the resulting sequence $T=\{x_0,x_1,\dots,x_T\}\subset E$ is the agentic trajectory. Pairwise displacements $\|x_{t+1}-x_t\|_2$ and similarities $s(x_t,x_{t+1})$ quantify instantaneous loop dynamics (Tacheny, 11 Dec 2025).

At the level of agent orchestration, one formalization takes $A$ to be the finite set of agent or tool nodes in a multi-agent system and $F:A\to A$0 to be the routing relation. An execution trace is a sequence

$F:A\to A$1

such that $F:A\to A$2. An IAL exists if $F:A\to A$3 is infinite and no terminal node ever halts the sequence. In graph-theoretic terms, for the directed graph $F:A\to A$4, an IAL exists iff $F:A\to A$5 contains a directed cycle and the orchestrator has no external termination guard to break that cycle; equivalently,

$F:A\to A$6

(Sarker et al., 8 Mar 2026)

IAL-Scan generalizes this idea beyond explicit source-level loops by constructing an Agent IR and an Agentic Loop Dependence Graph (ALDG). In that framework, an IAL exists when a feedback-relevant strongly connected component contains costly operations or state growth and lacks an effective bound that semantically covers every cycle in the component. Formally, for a cycle $F:A\to A$7,

$F:A\to A$8

This criterion makes explicit that IALs are not restricted to syntactic for or while constructs; they can arise from framework transitions, tool dispatch, agent reentry, and model-dependent termination semantics (Hou et al., 2 Jul 2026).

2. Geometric theory of divergent trajectories

Tacheny distinguishes the artifact space $F:A\to A$9, where linguistic transformations occur, from the embedding space $a_{t+1}=F(a_t).$0, where geometric measurements are performed. The embedding is defined by applying a pretrained encoder $a_{t+1}=F(a_t).$1 and normalizing:

$a_{t+1}=F(a_t).$2

Distances, similarities, clusters, and attractors are then measured in $a_{t+1}=F(a_t).$3, not in $a_{t+1}=F(a_t).$4. Because raw cosine similarity

$a_{t+1}=F(a_t).$5

is biased by anisotropy and concentrates around a high mean $a_{t+1}=F(a_t).$6, the paper introduces an isotonic calibration $a_{t+1}=F(a_t).$7 learned from human-judged sentence pairs. The calibrated similarity

$a_{t+1}=F(a_t).$8

eliminates mean bias $a_{t+1}=F(a_t).$9, drives Expected Calibration Error to $E\subset\mathbb{R}^d$0, and increases Pearson $E\subset\mathbb{R}^d$1 and Spearman $E\subset\mathbb{R}^d$2 by $E\subset\mathbb{R}^d$3, while preserving high local stability (Tacheny, 11 Dec 2025).

Within this framework, two regimes are identified. In the contraction regime $E\subset\mathbb{R}^d$4, an effective contraction rate $E\subset\mathbb{R}^d$5 emerges in embedding space:

$E\subset\mathbb{R}^d$6

The trajectory remains in a bounded semantic region, interpreted as an attractor. In the expansion regime $E\subset\mathbb{R}^d$7, no such bounding cluster exists; distances $E\subset\mathbb{R}^d$8 grow or remain large, and no time window satisfies the cluster-validity constraints. Operationally, unbounded divergence is detected by persistently high local displacements, very low calibrated local similarity $E\subset\mathbb{R}^d$9, and failure of cluster detection over the finite trajectory.

The canonical divergent example is the exploratory summarize-and-negate loop defined by the prompt: “Summarize the current text in one sentence, then negate its main idea completely in an abstract way. Current sentence: {TEXT} Provide only the new sentence.” Run for $x_t=\psi(a_t)$0 steps with temperature $x_t=\psi(a_t)$1, this loop yields local Euclidean distances $x_t=\psi(a_t)$2 fluctuating around $x_t=\psi(a_t)$3–$x_t=\psi(a_t)$4, local similarity oscillating between $x_t=\psi(a_t)$5 and $x_t=\psi(a_t)$6 and often near zero, and global drift $x_t=\psi(a_t)$7 rapidly rising to $x_t=\psi(a_t)$8 and staying there, with global similarity $x_t=\psi(a_t)$9 below $x_{t+1}=f(x_t),$0. A cluster-detection attempt with similarity threshold $x_{t+1}=f(x_t),$1, dispersion $x_{t+1}=f(x_t),$2, and patience $x_{t+1}=f(x_t),$3 detects zero clusters; semantic dispersion remains high $x_{t+1}=f(x_t),$4 and shows no decay over time. The reported geometric signatures include large non-decaying trajectory radius, low-similarity bands in heat maps of $x_{t+1}=f(x_t),$5, and cluster-timeline plots with no horizontal bands. The paper’s central conclusion is that prompt design directly governs the dynamical regime of an agentic loop (Tacheny, 11 Dec 2025).

3. Failure mechanisms and common misconceptions

A central misconception is to equate IALs with ordinary programming loops. The recent systems literature explicitly rejects that equation. IALs arise from the interaction between agent logic, framework semantics, runtime observations, and termination mechanisms; they traverse multiple layers of code, framework behavior, and model output, and they may be hidden in decorators, callbacks, agent handoffs, or tool-dispatch APIs rather than visible in a single syntactic loop (Hou et al., 2 Jul 2026).

In prompted orchestration systems such as LangChain, LangGraph, and AutoGen, the LLM itself decides “what to do next” by reading natural-language descriptions of available agents and tools. Two failure modes are identified as direct causes of IALs: hallucinated routing, in which the model invents an agent name or routes back to a prior agent, and lack of architectural termination, in which there is no statically enforced acyclicity or loop counter. On web-enabled GAIA tasks, LangGraph’s hallucination rate reached $x_{t+1}=f(x_t),$6, and the paper notes that many of these corresponded to infinite back-and-forth calls between the same two agents (Sarker et al., 8 Mar 2026).

The scheduler-theoretic account sharpens the structural point. The classic Agent Loop is modeled as an execution system

$x_{t+1}=f(x_t),$7

with a single-ready-unit scheduler:

$x_{t+1}=f(x_t),$8

Observation $x_{t+1}=f(x_t),$9 states that the classic Agent Loop always has $T=\{x_0,x_1,\dots,x_T\}\subset E$0 and that the policy $T=\{x_0,x_1,\dots,x_T\}\subset E$1 is non-deterministic because it is supplied by LLM inference. When failure returns control to the same context, the ready set can remain $T=\{x_0,x_1,\dots,x_T\}\subset E$2 indefinitely, allowing a sequence such as

$T=\{x_0,x_1,\dots,x_T\}\subset E$3

with no finite retry budget or strict escalation. In this view, the root cause of IALs is not merely repetition, but unbounded recovery in a scheduler whose control policy is opaque and whose execution history is mutable (Wei, 13 Apr 2026).

4. Static analysis and empirical prevalence

IAL-Scan is a static analysis tool designed to detect IAL failures in real-world LLM-agent repositories. It first abstracts heterogeneous agent code into a framework-independent Agent IR with typed facts $T=\{x_0,x_1,\dots,x_T\}\subset E$4, then builds an ALDG

$T=\{x_0,x_1,\dots,x_T\}\subset E$5

whose nodes include execution units, controller nodes, high-cost LLM or tool calls, and state-growth operations. Edge kinds include CONTROL_FLOW, CALL, WORKFLOW_TRANSITION, TOOL_DISPATCH, LOOP_BACK, FEEDBACK, CONDITIONAL_TRUE, CONDITIONAL_FALSE, and AGENT_REENTRY. Detection proceeds by extracting the feedback subgraph, computing its strongly connected components, checking entry reachability, identifying the continuation controller, evaluating whether the component contains costly or state-growing operations, and then performing bound-coverage analysis to determine whether any bound dominates all feedback edges in the cycle (Hou et al., 2 Jul 2026).

The paper gives several representative examples. In the motivating LangChain wrapper, a loop continues while finish_reason is None or finish_reason == "tool_calls", where finish_reason is taken from model output and tool calls append to message history; the inner break exits only the for loop over tool calls. In Agent IR, the cycle contains an LLM_CALL marked high_cost=true and a STATE_APPEND marked state_growth=true, while the exit condition depends on finish_reason and no Bound fact covers the controller. A second example, drawn from LiteRAG, uses while not success: with swallowed parse failures and resets success on zero-step plans. A third example, from an NVIDIA AI assistant, iterates with while True: over runnable.invoke(state), appending to state["messages"] when tool calls are empty or malformed. In each case, the loop guard depends on model or parser behavior and no strong deterministic bound covers the feedback path.

The evaluation scans $T=\{x_0,x_1,\dots,x_T\}\subset E$6 real-world Python LLM-agent repositories. IAL-Scan builds $T=\{x_0,x_1,\dots,x_T\}\subset E$7 static candidates in $T=\{x_0,x_1,\dots,x_T\}\subset E$8 projects, then—after LLM-assisted pruning and manual review—reports $T=\{x_0,x_1,\dots,x_T\}\subset E$9 alerts, among which $\|x_{t+1}-x_t\|_2$0 are confirmed IAL failures across $\|x_{t+1}-x_t\|_2$1 projects, for $\|x_{t+1}-x_t\|_2$2 precision. Root causes include missing strong bounds $\|x_{t+1}-x_t\|_2$3, tool-controlled retries $\|x_{t+1}-x_t\|_2$4, model-controlled termination $\|x_{t+1}-x_t\|_2$5, workflow cycles $\|x_{t+1}-x_t\|_2$6, state-growth amplifiers $\|x_{t+1}-x_t\|_2$7, and agent reentry $\|x_{t+1}-x_t\|_2$8. Dominant impacts are API cost exhaustion and model denial of service $\|x_{t+1}-x_t\|_2$9, context window exhaustion $s(x_t,x_{t+1})$0, and external tool rate-limit exhaustion $s(x_t,x_{t+1})$1. Static candidate generation is reported as fully repeatable, while the optional LLM-pruning stage varies slightly across runs and models; GPT-5.5 is reported to give the best balance, covering all $s(x_t,x_{t+1})$2 true positives with $s(x_t,x_{t+1})$3 alerts at $s(x_t,x_{t+1})$4 K tokens per project and $s(x_t,x_{t+1})$5 s per project (Hou et al., 2 Jul 2026).

5. Architectural elimination and bounded execution

One line of work addresses IALs by changing the execution model rather than merely detecting failures after the fact. GraphBit defines workflows explicitly and deterministically as a directed acyclic graph $s(x_t,x_{t+1})$6, where $s(x_t,x_{t+1})$7 and $s(x_t,x_{t+1})$8 carries typed data dependencies or control edges. Graph construction rejects any edge that would introduce a cycle; equivalently, the adjacency matrix $s(x_t,x_{t+1})$9 must satisfy either

$A$0

or

$A$1

At runtime, a Rust engine uses a ready-queue dataflow algorithm, with control predicates evaluated over structured state rather than through LLM-decided next-agent selection. The key invariants are that graph construction fails on any cycle, each node executes at most once, and control decisions are pure state-predicate checks. Under this design, every execution trace completes in at most $A$2 steps, and the paper reports zero “hang” or “timeout waiting for next agent” incidents across $A$3 tasks and approximately $A$4 k ops/min throughput. On GAIA, GraphBit achieves the highest accuracy $A$5, zero framework-induced hallucinations, the lowest latency $A$6, and the highest throughput; its hallucination rate is $A$7 overall and $A$8 on web-enabled tasks (Sarker et al., 8 Mar 2026).

GraphBit couples this execution model with a three-tier memory architecture. Ephemeral scratch is per-node and cleared immediately after execution; structured state is a typed key-value store updated only upon successful node completion and readable only through declared keys; external connectors manage database or web I/O and are never auto-injected into prompts. The stated effect is to prevent cascading context bloat and to ensure that revisiting a node is possible only through an explicit DAG edge. The framework’s main limitation is expressiveness: workflows requiring dynamic while loops must be unrolled or encoded as a fixed-depth subgraph, and unbounded iterations are not expressible by default.

The scheduler-theoretic Structured Graph Harness (SGH) reaches a similar conclusion through formal specification. An execution plan is

$A$9

with static DAG edges, per-node configuration, and output contracts. Node states range over

$F:A\to A$00

with terminal states $F:A\to A$01. Bounded execution requires each node to have finite timeout $F:A\to A$02, finite retry budget $F:A\to A$03, and finite human-wait $F:A\to A$04. Recovery is separated into three layers—$F:A\to A$05, $F:A\to A$06, and $F:A\to A$07—subject to the Escalation Invariant that level $F:A\to A$08 recovery must be exhausted before level $F:A\to A$09 is allowed. Proposition $F:A\to A$10 gives a progress guarantee, and Theorem $F:A\to A$11 states that under bounded-execution assumptions the SGH main loop always terminates in a finite number of steps, with

$F:A\to A$12

The paper is explicit that this is a position paper and design proposal rather than a production implementation or empirical result (Wei, 13 Apr 2026).

6. Applications, controls, and trade-offs

The literature does not treat all iterative loops as pathological. In Tacheny’s framework, contractive prompts such as “rewrite/rephrase/improve fluency while preserving meaning exactly,” especially with low-temperature sampling such as $F:A\to A$13, reliably yield $F:A\to A$14 behavior and a stable attractor. These convergent loops are reported as useful for iterative refinement tasks including proofreading, paraphrasing, and summary polishing. By contrast, prompts that invert, negate, abstract away meaning, or trigger creative jumps push the loop into $F:A\to A$15; divergent or infinite loops may be harnessed for broad creative exploration or adversarial drift, but they also pose risks of runaway semantic drift, hallucination amplification, or denial-of-service through infinite generation. The paper recommends in-loop monitoring of local similarity $F:A\to A$16, raising an alarm or terminating if $F:A\to A$17 such as $F:A\to A$18 for several consecutive steps, enforcing explicit stopping criteria in artifact space through string fingerprinting, and interleaving contractive correction phases to collapse the trajectory back into a bounded region (Tacheny, 11 Dec 2025).

At the systems level, the principal recommendation is to make bounds first-class. Framework designers are advised to enforce default bounds such as iteration caps, timeouts, and retry limits at the precise runtime scope where feedback loops form; to propagate and dominate bounds across workflow transitions, tool dispatch, and agent reentry; and to expose state-growth limits such as maximum context size. Agent developers are advised never to rely solely on model outputs or parser successes to terminate loops, always to configure explicit max_iterations, max_turns, or retry caps, and to validate that every feedback path—model $F:A\to A$19 tool $F:A\to A$20 state $F:A\to A$21 model, or agent $F:A\to A$22 agent handoff—is covered by a strong deterministic bound (Hou et al., 2 Jul 2026).

The remaining debate is best understood as a trade-off between expressiveness and controllability rather than disagreement over the existence of the failure mode. The scheduler-theoretic analysis states that expressiveness increases with dynamic topology, competitive parallelism, and recursive sub-graph expansion, whereas controllability requires static DAGs, deterministic scheduling, and bounded auditable recovery. Excluding features such as first_of removes speculative racing and some dynamic flexibility, but the stated purpose is to guarantee that no unbounded cancellation-orchestration loops can form. This suggests that contemporary research is converging on a common principle: IALs become tractable when feedback paths are explicit, bounds dominate the true runtime cycle, and recovery is structurally separated from unconstrained model-directed continuation (Wei, 13 Apr 2026).