No Ceiling on How Long It Could Try

A static analysis of the AutoGen integration in an open-source agent project identified an unbounded loop pattern: the agent's execution logic ran as a while True: loop with no maximum step counter, no circuit breaker, and no fallback timeout. If an upstream agent stream failed to terminate cleanly (or if any condition within the loop failed to reach the expected exit state) worker threads would hang indefinitely. No mechanism existed to detect or interrupt the hang, and no maximum iteration count was configured to limit how long execution could continue before the agent was forced to exit or report.

An intentional design choice (the loop should always run until the task is done) considered. Some agent implementations intentionally run without a step cap, relying on internal task-completion signals. But an internal completion signal is only reliable if nothing in the environment can prevent it from arriving, which is exactly the assumption this pattern violates.

A theoretical concern without documented production impact, considered and partially granted. The issue was identified by static analysis; no specific incident was documented in the report. However, the pattern was explicitly identified in a commit to add a max_steps parameter and a timeout, indicating it was treated as a real risk by the maintainers.

Perseveration, most consistent with the concern: a loop with no exit cap is structurally committed to retrying until an external signal arrives, meaning any failure to deliver that signal produces unbounded repetition, the same structural property as every retry-storm failure, built in at the architecture level rather than emerging from a specific bad run.

A loop that runs until done is only safe in an environment where 'done' is always reachable. In real agent deployments, clean termination signals are not guaranteed (APIs timeout, upstream agents stall, external services go quiet) and an unbounded loop is then an indefinitely running cost. The principled default is a configurable maximum iteration count that starts conservative and can be raised explicitly, never the reverse.

Set a configurable maximum iteration count that starts conservative and is raised explicitly.

Maximum step counters; circuit breakers; fallback timeouts.