No Exit

Abstract.

"An AI agent can fail in a very expensive way: it can keep trying." That line comes from a FinOps vendor's write-up of agent retry costs, and it understates the real incident it cites. On April 29, 2026, a single idle timeout in the open-source agent runtime OpenClaw produced 1,384 paid model calls in 60 seconds, all timestamped to the same minute, costing an estimated $20-30 before anyone noticed. Source: OpenClaw, GitHub issue #76293. Four days earlier, the same bug had done it once already: 761 calls in 60 seconds. The fix, shipped a week later, capped consecutive failures at five and cut the worst case to about $0.10-0.30 per incident. Source: OpenClaw, PR #76345. This is not a pricing story or a routing story. It is a defect class: a feedback path in agent code with no bound on how many times it can fire. A July 2026 static-analysis paper, IAL-Scan (Hou, Wang, Zhao, and Wang, arXiv:2607.01641), scanned 6,549 real GitHub agent repositories across eight frameworks and confirmed 68 of these bugs in 47 projects, 95.6% of which cause "API cost exhaustion." This post walks through that paper, the OpenClaw incident it would have caught, and an illustrative simulation of what an unpatched feedback path costs a fleet of agent deployments over a month: a mean exposure of $1,231, against $12.96 once the same deployments carry a five-call circuit breaker, a 95x gap.

All simulation figures in this post are illustrative, modeled to anchor to the cited paper and incident data, not measured production traces. Not derived from proprietary customer data. Sources cited throughout.

The research question.

Most of the token waste this blog documents is a design tradeoff: multi-agent orchestration spends 15x more tokens than a single chat because fan-out buys better answers. The retry tax is an economic argument: a router that blind-retries on a cheap tier before escalating pays for every failed attempt, and you can write down a break-even formula for when that stops being worth it. Both assume the system is working as designed and ask whether the design is a good deal.

This post asks a different question: what happens when a piece of agent code has a feedback path, a retry, a tool call, a graph edge, a multi-agent handoff, that nothing bounds at all? The Blast Radius Bill covered what an agent can do to your infrastructure when it goes wrong; Denial of Wallet Is the New DDoS named the financial version of that outcome. This post is about the narrower, more common cause sitting underneath a lot of both: not a bad decision, a missing stop condition. IAL-Scan is the first paper we've found that measured how often that cause is sitting in your dependency tree right now.

What IAL-Scan found.

Xinyi Hou, Shenao Wang, Yanjie Zhao, and Haoyu Wang, all at Huazhong University of Science and Technology, define an Infinite Agentic Loop (IAL) as a feedback path, a retry, a tool-call iteration, a workflow cycle, or an agent handoff, that "repeatedly triggers costly or state-growing actions" without an effective bound. Their tool, IAL-Scan, abstracts eight popular frameworks (LangChain, LangGraph, CrewAI, AutoGen, LlamaIndex, OpenAI Agents SDK, Google ADK, Semantic Kernel) into a framework-independent intermediate representation, builds an "Agentic Loop Dependence Graph" for each project, and checks every feedback path for a bound that actually holds at runtime, not just a max_iterations argument that a nested call can bypass.

They ran it against 6,549 GitHub repositories with at least one star, 246,748 Python files, 33.41 million lines of code, and reported 74 candidate findings. After manual verification: 68 confirmed, 6 false positives, 91.9% precision, spread across 47 distinct projects.

Two patterns explain most of the concentration in LangGraph and AutoGen. LangGraph's conditional edges let a developer write a cycle that assumes the model will eventually route to an exit node; when it doesn't, the graph has no independent counter to fall back on. AutoGen's multi-agent chat loops similarly assume the conversation will converge; a max_turns argument exists, but the paper found it frequently unset or set on the wrong object in the call chain. Both are "model-controlled termination" by another name: the bound is a hope about model behavior, not a number enforced by the runtime.

The incident IAL-Scan's own pattern would have caught.

OpenClaw is a real, actively developed open-source coding-agent runtime. Its bug tracker documents exactly the failure mode the paper describes, with a timestamp. On April 25, 2026 at 13:02 ET, a single LLM idle timeout (60 seconds, no response from the model) propagated up through OpenClaw's retry layer, which re-invoked the same stream function against the same wedged provider connection. That retry also timed out. The cycle repeated, unbounded, 761 times, all logged in the same 60-second window. Four days later it happened again: 1,384 calls in 60 seconds. Source: OpenClaw, GitHub issue #76293. The bug report is explicit about the root cause: no maximum retry count, no exponential backoff, no circuit breaker. Auto-recharge on the provider account meant nobody saw the spike until the bill arrived.

This is IAL-Scan's "retry feedback without bound" category, the single largest bucket in the paper at 25.0% of confirmed failures. The fix that shipped a week later is almost embarrassingly small: cap consecutive idle timeouts at five, reset the counter on any successful chunk so a slow-but-responsive stream isn't penalized, then lock out. Worst case after the fix: 5 paid calls instead of up to 1,384. Source: OpenClaw, PR #76345.

Methodology.

Two things in this post are cited fact: IAL-Scan's scan results and OpenClaw's incident numbers. One thing is an illustrative simulation, built to show what those two facts imply at fleet scale, not a measurement of anyone's production traffic.

Finding 1: the bug clusters in exactly two frameworks, and the impact is almost always the same.

LangGraph and AutoGen together account for 45 of the 68 confirmed failures, 66% of the total, despite being 2 of 8 frameworks scanned. That's not because they're worse-engineered; it's because cyclic graphs and multi-turn multi-agent chat are the two abstractions most likely to need a bound that isn't "the model will figure it out." Every other framework in the study had at least one confirmed failure too. And whichever framework it happened in, the impact was almost never ambiguous: 95.6% of the 68 confirmed failures caused API cost exhaustion, and the same 95.6% caused what the paper calls model denial of service, the agent itself becoming unusable mid-loop. Context window exhaustion (27.9%) and external tool rate-limit exhaustion (7.4%) trail well behind. If your agent has an unbounded feedback path, the first thing that breaks is almost always the bill, not the context window.

Finding 2: two different loops fail at two different speeds.

Not every unbounded loop costs the same per iteration. OpenClaw's bug replays an identical, small request: cost grows linearly, about $0.018 per call. A different, more common loop shape resends the entire growing conversation history on every retry, because that's how stateless chat APIs work: cost grows quadratically. A July 2026 analysis of this second pattern, run by the open-source PaaS Bex against Claude Sonnet 5 pricing, reported multipliers of 3.2x at 5 steps, 26x at 50 steps (a $5.01 actual bill against a $0.19 baseline of only the tokens actually needed), and 100x at 200 steps. Source: Dora Noda, "Your AI Agent's Debug Loop Costs Grow Quadratically, Not Linearly," Bex, July 31, 2026. The two curves cross around 8-10 iterations: below that, a flat retry loop is actually more expensive per step; above it, the growing-context loop pulls away fast, because every step now carries the cost of every step before it. IAL-Scan's "state growth amplifier" category (27.9% of confirmed failures) is this shape specifically, and it's the one where catching the loop late costs disproportionately more than catching it early.

Finding 3: the fix already exists, and it's nearly free.

OpenClaw's own before-and-after numbers are the cleanest evidence in this post, because they're not a simulation: the same bug, the same codebase, measured twice. Before the fix: $20-30 per incident. After: $0.10-0.30. A roughly 100x reduction, achieved with a counter and a threshold, not a smarter model or a cheaper one. The counter resets on any successful chunk, so a slow-but-alive stream isn't punished the way a truly wedged one is. This is the general shape of every fix IAL-Scan's authors recommend: replace an assumed bound (the model will stop, the conversation will converge) with an enforced one (a number, checked by the runtime, not by the thing that's failing).

Finding 4: at fleet scale, this is a monthly tax, not a one-off surprise.

Any single incident, $20 or $30, looks like rounding error against a real AI budget. The reason it isn't: IAL-Scan's 0.72% prevalence rate, applied to a fleet of 5,000 agent deployments, means roughly 36 of them are carrying an unbounded feedback path at any given time, each capable of firing more than once a month. In the illustrative simulation, that puts mean fleet-wide monthly exposure at $1,231 without a cap, with a 99th-percentile month at $1,882. Add the same five-call circuit breaker OpenClaw shipped, and the mean drops to $12.96, the P99 to $19.77, both roughly a 95x reduction. Nobody sees the $1,231; they see forty small, unexplained line items scattered across the month's invoice, each one plausible on its own, none of them investigated, because $25 isn't worth a ticket.

A five-minute audit, from IAL-Scan's own taxonomy.

In order of how often the paper found them: grep for retry logic without a hard numeric cap ("retry feedback without bound," 25.0% of failures — if the exit condition is "success" and nothing else, it's exposed); check every LangGraph conditional edge for an independent counter rather than a routing condition that assumes the model eventually picks the exit node ("model-controlled termination," 38.2%); confirm max_turns or its equivalent is actually set and reaches the object that enforces it in AutoGen-style multi-agent chats, since the paper found it frequently declared but not wired through; and look for state, conversation history, accumulated tool output, that grows every pass with no ceiling, the "state growth amplifier" pattern that turns a cheap flat retry into a quadratic one. Then add a cost or call-count circuit breaker as the last line regardless, on the assumption you missed one: cap consecutive failures, reset on success, lock out past the cap, the exact shape of OpenClaw's fix.

When not to bother.

• Frameworks you consume as-is, without custom cycles or retry wrappers. The maintainers' defaults matter more than your code; check their issue trackers for open unbounded-loop reports first.
• Single-shot, non-agentic calls. A stateless completion with no tool use and no retry wrapper has no feedback path to bound.
• Systems already behind a per-key rate limit low enough that 1,384 calls in 60 seconds is architecturally impossible. Adding a second circuit breaker is belt-and-suspenders, not urgent.
• One-off scripts and local development. A loop burning tokens in a terminal you're watching gets noticed and killed in seconds, not 60 of them.

Where Nadir fits.

Nadir doesn't watch for infinite loops inside your agent framework; that's a code-level fix, and IAL-Scan's authors are right that it belongs in the framework or in your own retry wrappers, not bolted on downstream. What Nadir does provide is the visibility that turns a $25 anomaly from invisible into obvious: every response routed through the OpenAI-compatible gateway reports the model and the exact cost that served it, so a deployment suddenly making hundreds of identical calls in a minute shows up as a spike against its own baseline, not as forty unexplained line items scattered across an invoice. That's the same per-response cost reporting behind chargeback and showback: the fastest way to catch a runaway feedback path is to already know what every deployment normally costs, so the abnormal minute is visible the day it happens, not the day the bill is due.

If you run agents built on LangGraph or AutoGen in production, start with a free key, route a week of traffic through it, and check whether any single deployment's per-minute call count ever spikes two orders of magnitude above its own median. That spike is what an unbounded feedback path looks like before it becomes a support ticket.

Conclusion.

Most of the token waste on this blog is a system doing what it was built to do, just inefficiently: too much context, the wrong model, a cache miss. Infinite agentic loops are different: a piece of code with no exit condition, waiting for a trigger that IAL-Scan found in 68 real, confirmed cases across 47 production repositories, 95.6% of which burned API budget when it fired. OpenClaw's own incident and fix are the cleanest before-and-after available: $20-30 per incident down to $0.10-0.30, a 100x reduction, from a five-line counter. At the scale of a real deployment fleet, in this post's illustrative simulation, that's the difference between a mean monthly exposure of $1,231 and $12.96. The fix isn't a smarter model, a cheaper one, or a better router. It's a number, enforced by the runtime, that replaces a hope about what the model or the conversation will eventually do.

Simulation figures in this post are illustrative, built to anchor to the cited paper's repo-level prevalence rate and OpenClaw's own documented incident and fix costs, and are not derived from customer data. Sources: [Hou, Wang, Zhao, and Wang, "When Agents Do Not Stop: Uncovering Infinite Agentic Loops in LLM Agents," arXiv:2607.01641, July 2026](https://arxiv.org/abs/2607.01641). [OpenClaw, GitHub issue #76293](https://github.com/openclaw/openclaw/issues/76293). [OpenClaw, GitHub PR #76345](https://github.com/openclaw/openclaw/pull/76345). [Larridin, "Are Agent Retry Loops Silently Consuming Your AI Budget?", August 28, 2026](https://larridin.com/blog/ai-agent-retry-cost-control?hs_amp=true). [Dora Noda, "Your AI Agent's Debug Loop Costs Grow Quadratically, Not Linearly," Bex, July 31, 2026](https://bex.co/blog/2026/07/31/agent-retry-loop-quadratic-token-cost).