The AI agent will not stop: diagnose the loop before restarting it

Contain execution without erasing uncertain effects

Disable new scheduling and model calls through an independent control, revoke or narrow agent credentials where safe, stop workers, and quarantine queued consequential actions. Preserve run ID, user delegation, state store, prompt and workflow version, model, tool schemas, approvals, budget ledger, events, errors, network or provider receipts, and external system state. Do not delete logs or immediately restart. Mark writes, messages, payments, deployments, or deletions whose outcome is unknown. Notify system, security, privacy, financial, or communications owners according to consequence. The runaway automation incident graph begins with containment and reconciliation because a blind retry can duplicate the very action the team is trying to diagnose.

Evidence: National Institute of Standards and Technology; National Cybersecurity Center of Excellence

Cause branch one: completion was subjective or impossible

Inspect the objective, terminal tests, acceptance evidence, and non-goals. Phrases such as improve until perfect, research everything, or keep trying give the loop no observable completion. A task may also require evidence the tools cannot access, so the model continually reformulates. This branch gains support when traces show varied work with no state capable of complete or blocked. It weakens when a precise terminal condition exists and was reached. Repair the task into a finite artifact, maximum attempts, and explicit complete, no-work, blocked, and failed states. Do not use a higher model budget to compensate for an undefined end.

Evidence: National Institute of Standards and Technology; OpenAI

Cause branch two: state disappeared or progress was not committed

Check process restarts, conversation compaction, distributed cache, database transaction, event ordering, checkpoint write, and worker ownership. The agent may repeat because each invocation sees an earlier state or because a completed step never commits before the next planner call. This branch gains support when action fingerprints repeat after restarts or multiple workers claim the same item. It weakens when a durable state transition and single owner are visible. Repair with transactional checkpoints, leases, idempotency, and version checks. Model memory is not the source of truth for external side effects. Reconstruct the last known consistent state before resuming anything.

Evidence: National Cybersecurity Center of Excellence; OpenAI

Cause branch three: retry logic treated uncertainty as failure

Compare timeout, transport error, provider acknowledgement, tool receipt, idempotency key, and external system of record. A call can succeed remotely while the response is lost locally. Automatic retry then creates duplicate email, purchase, post, or write. This branch gains support when repeated effects share the same intent after ambiguous responses. It weakens when the tool is read-only and deterministic. Move uncertain outcomes into a distinct state, query or reconcile before retry, cap attempts, and use idempotency where supported. Exponential backoff reduces load but does not resolve ambiguity. Require human review when the external system cannot prove outcome.

Evidence: OWASP Gen AI Security Project; OpenAI

Cause branch four: the tool or identity had more authority than the job

Inventory every exposed function, parameter range, credential, object scope, network destination, and delegated user. Determine whether the model selected a broad function because a narrow one was absent, or whether untrusted content influenced tool choice. OWASP describes excessive functionality, permissions, and autonomy as roots of excessive agency. NIST NCCoE's agent identity work highlights attribution and authorization questions. This branch gains support when the harmful action was technically allowed but outside intent. Remove the capability, rotate credentials, narrow roles, validate arguments, and separate proposal from execution. A prompt reminder is not remediation when the same overpowered tool remains callable.

Evidence: National Cybersecurity Center of Excellence; OWASP Gen AI Security Project

Cause branch five: budgets, approvals, or stops were advisory

Check whether call, time, spend, retry, and action limits were enforced atomically outside the model; whether approval bound to exact parameters; and whether stop interrupted queues and workers. Concurrency may overspend a shared limit while each worker sees capacity. A user stop may update the interface while an offline worker continues. This branch gains support when the trace crosses a configured threshold without refusal. Repair enforcement, reservations, cancellation propagation, expiry, and worker heartbeats. Test the kill path while tools are blocked and while the model provider is unavailable. The model cannot be the sole guardian of limits placed on its own loop.

Evidence: National Institute of Standards and Technology; OWASP Gen AI Security Project

Reconcile first, then run a minimal regression

The next action is to complete the incident graph, identify and verify every external effect, and fix the earliest branch before any restart. Use a sandbox or read-only replay with the same state and one small budget. Limits remain: traces can be incomplete, distributed races are intermittent, vendor actions may be opaque, and several branches often combine. Close with scope, cost and effects, confirmed root cause, repaired control, regression evidence, owner, and alert. Never declare success because the loop stopped after credentials were revoked; prove why it began, why the stop failed, and why the repaired workflow cannot repeat the same path.