Skip to main content
Agent can invoke unlimited downstream actions or API calls without throttling or scope caps

​
How to resolve

Set rate limits and quotas on agent API calls and downstream actions. Cap the number of operations per execution cycle.

​
Risk

Governance/Compliance This vulnerability falls under ASI08:2026 — Cascading Failures in the OWASP Top 10 for Agentic Applications. Errors in one agent propagate across multi-agent pipelines with compounding destructive impact. Security Agent can invoke unlimited downstream actions or API calls without throttling or scope caps. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Agent can invoke unlimited downstream actions or API calls without throttling or scope caps. This falls under ASI08 (Cascading Failures): Errors in one agent propagate across multi-agent pipelines with compounding destructive impact.

​
Specifications

Trigger
  • Agent scan detects agent can invoke unlimited downstream actions or API calls without throttling or scope caps
The scanner looks for patterns such as:
  • no rate limiting on tool invocations
  • agent spawns sub-agents with no concurrency limit
  • recursive agent delegation with no depth cap
Severity
  • HIGH
Applies to: Agent