Skip to main content
Agent loop has no max iteration count or timeout — enables resource exhaustion or runaway execution

​
How to resolve

Set max_iterations, max_turns, or recursion_limit on all agent loops. Add timeout mechanisms. Implement circuit breakers to halt runaway execution.

​
Risk

Governance/Compliance This vulnerability falls under ASI08:2026 — Cascading Failures in the OWASP Top 10 for Agentic Applications. Errors in one agent propagate across multi-agent pipelines with compounding destructive impact. Security Agent loop has no max iteration count or timeout — enables resource exhaustion or runaway execution. If exploited, this can compromise the agent’s integrity, confidentiality, or availability, potentially affecting downstream systems and data.

​
Explanation

Agent loop has no max iteration count or timeout — enables resource exhaustion or runaway execution. This falls under ASI08 (Cascading Failures): Errors in one agent propagate across multi-agent pipelines with compounding destructive impact.

​
Specifications

Trigger
  • Agent scan detects agent loop has no max iteration count or timeout — enables resource exhaustion or runaway execution
The scanner looks for patterns such as:
  • max_iter not set on agent or crew
  • no timeout on agent execution
  • while True in agent execution loop
Severity
  • MEDIUM
Applies to: Agent