title: Runaway tool-call loop within a single session id: ATR-2026-00553 rule_version: 1 status: draft description: | Detects a runaway tool-call loop where an agent emits more than 100 tool call spans within a one-minute window for a single session. This is a behavioral-method rule per spec/atr-method-v1.1.md ยง7, demonstrating the aggregation grammar (count over time window with per-session grouping and a min-events floor). Threat model: prompt-injection attacks, agent goal-drift, or compound retry-loop bugs can cause an agent to enter a tight tool-call loop โ€” retrying the same tool, polling a service, or exhausting a budget by calling many tools in rapid succession. The behavior is not visible in any single tool call (each call may be syntactically benign); the signature is in the aggregate frequency. The runaway pattern is the most common cause of denial-of-wallet incidents in production agents and the leading runtime symptom of agent goal drift in long-running workflows. Suppression: `min_events: 10` prevents false positives during cold- start where one or two early calls would otherwise trip the rule; `cooldown: PT5M` prevents alert spam after the first violation. This rule is the canonical behavioral-method reference example shipped with v1.1 of the method-extensions spec. author: ATR Community date: 2026/05/28 schema_version: '1.0' maturity: draft severity: high references: owasp_agentic: - ASI05:2026 - ASI07:2026 owasp_llm: - LLM06:2025 mitre_atlas: - AML.T0034 - Cost Harvesting compliance: nist_csf: - subcategory: DE.AE-02 context: | A single tool call in a runaway loop is unremarkable; the adverse event exists only in the aggregate. Counting calls per session over a window is the analysis DE.AE-02 requires in order for the activity to be understood at all. strength: primary - subcategory: DE.AE-04 context: | The windowed count is also the scope estimate: how many calls, in what period, confined to which session. That is the input DE.AE-04 needs, though the rule stops at measuring and does not assess cost or downstream impact. strength: secondary eu_ai_act: - article: '15' context: | Cybersecurity & robustness โ€” runaway tool loops are an Article 15 robustness failure. The rule provides runtime evidence. strength: primary - article: '14' context: Article 14 (human oversight) requires high-risk AI systems to remain subject to effective human oversight; this rule provides detection evidence where the unsafe autonomous action (Runaway tool-call loop within a single session) would bypass or undermine that oversight. strength: primary - article: '9' context: Article 9 (risk management system) requires identified risks to be addressed by appropriate measures; this rule is a runtime risk-treatment control that detects the unsafe autonomous action (Runaway tool-call loop within a single session). strength: secondary nist_ai_rmf: - subcategory: MS.2.6 context: | Information security โ€” autonomous-action rate anomalies require detection per MS-2.6. strength: primary - subcategory: MG.2.3 context: NIST AI RMF MANAGE 2.3 (respond to previously unknown identified risks) is supported by this rule, which surfaces the unsafe autonomous action (Runaway tool-call loop within a single session) so the risk can be treated. strength: primary - subcategory: MS.2.7 context: NIST AI RMF MEASURE 2.7 (security and resilience evaluated and documented) is supported by this rule's runtime detection of the unsafe autonomous action (Runaway tool-call loop within a single session). strength: secondary iso_42001: - clause: '6.2' context: ISO/IEC 42001 Clause 6.2 (AI objectives and planning) calls for risk treatment of known attack patterns; this rule's detection of the unsafe autonomous action (Runaway tool-call loop within a single session) is such a treatment. strength: primary - clause: '8.1' context: ISO/IEC 42001 Clause 8.1 (operational planning and control, including control of externally provided processes) is operationalised by this rule's detection of the unsafe autonomous action (Runaway tool-call loop within a single session). strength: secondary tags: category: excessive-autonomy subcategory: runaway-tool-loop scan_target: runtime confidence: high source: behavioral-reference agent_source: type: agent_behavior framework: - any provider: - any detection: method: behavioral condition: any false_positives: - | Legitimate batch operations (data migration, bulk ingest, scheduled cleanup jobs) may legitimately emit > 100 tool calls in a minute. Mitigation: operators tag scheduled batch jobs with attributes.policy_exemption="batch_job" and add a filter to the rule's behavioral.filter block. - | The 100 / minute threshold is a default. Operators with high- throughput agents (e.g., search/recommendation systems doing hundreds of vector lookups per request) MUST tune the threshold to their baseline before deployment; otherwise base-rate false positives will overwhelm alert channels. conditions: - field: behavioral.metric_value operator: regex value: (?i)tool_calls_per_session_exceeds_threshold description: | Synthetic field emitted by the behavioral engine when threshold is exceeded; behavioral-native engines evaluate detection.behavioral. behavioral: metric: tool_calls aggregation: count window: PT1M operator: gt threshold: 100 group_by: - session.id min_events: 10 cooldown: PT5M filter: span.kind: in: - TOOL response: actions: - alert - rate_limit_source - escalate message_template: | [ATR-2026-00553] HIGH: Runaway tool-call loop detected in session {{behavioral.session_id}}. {{behavioral.metric_value}} tool calls in {{behavioral.window}} (threshold: {{behavioral.threshold}}). Rate-limiting the session; escalate for operator review. Likely causes: goal-drift loop, polling-without-backoff, prompt-injection- induced loop. confidence: 80