Agent Rapid Actions and Rogue Loops: Alert Thresholds, Not Hard Budgets

What 1-SEC checks

The action tracker keeps per-agent action counts and repeated action/target state. Its current rapid-action check triggers above 100 actions in a minute, and repeated action/target tracking can flag a rogue loop. The first observation initializes a profile, which matters when constructing a test sequence.

Read the implementation: RecordAction

Required telemetry and context

Relevant input events: agent_action, tool_call, function_call. Use a trusted producer at the real application boundary.

• agent_id
• action
• tool
• target

Field names above describe relevant context, not a complete API request. Consult the current event contract for envelope and detail requirements. Preserve booleans, numbers, and strings as the receiving handler expects them. Agent-provided text cannot independently verify identity or authorization.

Deployment, prevention, and response

Use task and operation identifiers to investigate whether a loop is expected. Establish hard iteration/cost limits in the orchestrator and make interruption recoverable. Do not respond to a benign repetitive job by automatically terminating unrelated processes sharing the host.

Record the source event, affected agent/host, actual target, policy decision, and response result. Review enforcement configuration separately from detection. A recommendation, selected action, dry-run record, and completed action are different outcomes.

Reproduce the source fixtures

From a checkout of the linked 1-SEC source revision, run the selected fixtures with the repository's Go toolchain. These commands run tests; they do not execute a real attack against your systems.

go test ./internal/modules/aicontainment -run '^(TestAgentTracker_RecordAction_RogueLoop|TestAgentTracker_RecordAction_RapidActions)$' -count=1

The referenced source fixtures ran in the selected local package suites. Helper tests and synthetic events establish only the assertions shown, not production prevention or framework compatibility.

func TestAgentTracker_RecordAction_RogueLoop(t *testing.T) {
	at := NewAgentTracker()
	at.RegisterAgent("agent-loop", "parent")

	var lastAnomaly AgentAnomaly
	for i := 0; i < 12; i++ {
		lastAnomaly = at.RecordAction("agent-loop", "write", "file_write", "/tmp/same_file")
	}

	if !lastAnomaly.RogueLoop {
		t.Error("expected RogueLoop after 10+ identical action+target repeats")
	}
	if lastAnomaly.LoopCount < 10 {
		t.Errorf("LoopCount = %d, want >= 10", lastAnomaly.LoopCount)
	}
}

func TestAgentTracker_RecordAction_RapidActions(t *testing.T) {
	at := NewAgentTracker()
	at.RegisterAgent("agent-rapid", "parent")

	var lastAnomaly AgentAnomaly
	for i := 0; i < 105; i++ {
		lastAnomaly = at.RecordAction("agent-rapid", "read", "file_read", "/tmp/data")
	}

	if !lastAnomaly.RapidActions {
		t.Error("expected RapidActions after >100 actions in a minute")
	}
	if lastAnomaly.ActionCount <= 100 {
		t.Errorf("ActionCount = %d, want >100", lastAnomaly.ActionCount)
	}
}

Tuning, evaluation, and coverage limits

These thresholds produce observations; they are not hard execution, token, financial, or concurrency budgets. A legitimate batch can repeat an action and target. Bounded in-memory history can reset on eviction/restart, and missing/unstable agent identifiers distort the baseline.

Evaluate this behavior with representative authorized activity and a controlled known-positive case. Investigate the exact rule, inputs, and state before suppressing an alert. Do not assume a hard-coded heuristic is a configurable setting. Measure your own deployment; the source fixtures do not establish a benchmark, detection rate, compliance certification, or incident-prevention claim.