QG023 Unbounded loop¶
| Type | Bug |
| Severity | Medium |
| Front end | a Colang 2 policy and an agent graph; Colang 1 has no loop to bound |
| Guardrail category (Vassilev 2026) | E. Action & Execution Guardrails |
| AI RMF functions (NIST AI 100-1) | MAP, MEASURE, MANAGE |
| Why these functions | the catalogue's assignment, not the article's chain (GOVERN, MANAGE): the cycle is mapped from the graph or the flow, measured by unrolling it to its budget and managed by the fix; no governance rule is in question |
| OWASP | LLM06:2026 Unbounded Consumption, ASI08:2026 Cascading Failures |
| Gates by default | no, unless the project's quality profile adds it |
Raised when¶
A cycle that calls a tool or a model can repeat beyond the agent's declared budget, or has no budget but the framework's recursion limit.
Why it matters¶
Each pass of the cycle costs a model call or a tool call, and nothing the team declared stops it: a model that never takes the exit, or a tool result that never satisfies it, keeps the run going until the framework gives up. The hunter decides whether the budget holds, not whether it is wise.
How to fix it¶
Declare a budget for the run, or add an exit the model cannot avoid -- a counter in the state that forces the exit. The fix is re-scanned.
OWASP LLM06:2026, cap what one run may consume: declare the run's budget of steps, tool calls and model calls.
OWASP entries¶
LLM06:2026 Unbounded Consumption and ASI08 Cascading Failures, from the OWASP Top 10 for LLM Applications 2026 and for Agentic Applications 2026. The
mapping holds because a cycle that calls a model or a tool with no ceiling but the framework's is consumption nothing the team declared bounds. The coverage is at the policy level: the rule decides the part of the risk the policy and its catalogue control, and a scan with no finding under it says that and no more.
What the finding carries¶
The cycle, the declared budget and the witness path that keeps the cycle going past it; with no budget, the finding is raised without a solve and names the framework's recursion limit as the run's only ceiling. The rule fires only on a declaration the team made in the catalogue, agent.yaml or the configuration; a missing declaration raises nothing, and the scan summary lists the rule as having had nothing to read. See the catalogue for the other rules.