Loops Gone Wrong: Documented Agent Failures and the Guardrail Each One Teaches
This is an incident file: documented agent-loop failures, each with its primary source, and the specific control that would have contained it. No hypotheticals, no urban legends. If we couldn't verify a number against the source, it's not in here.
1. The trailing `~/` that wiped a Mac
December 8, 2025. A developer posting as u/LovesWorkin asked Claude Code to clean up an old repo. It executed:
rm -rf tests/ patches/ plan/ ~/
Three project directories, plus a stray trailing ~/ that zsh expanded to the entire home directory. Desktop, Documents, Library, Keychain, SSH keys, years of files — gone. The SSD had TRIM enabled, so recovery was impossible. Claude Code itself lost the ability to authenticate; its own credentials lived in the directory it deleted. The Reddit thread passed 1,500 upvotes within hours, and Docker's engineering blog published a full forensic breakdown.
It was not a one-off. GitHub issue #10077 documents a similar wipe on Ubuntu/WSL2, and the damning detail there is that the user was not running --dangerously-skip-permissions: the permission system approved a command whose expansion it didn't catch. Issue #12637 is a third mechanism — the agent had earlier created a directory literally named ~, then "cleaned it up" with an unquoted rm -rf ~.
The guardrail: never rely on the model, or a single permission prompt, to catch destructive shell expansion. Run loops in a worktree, container, or sandbox where ~/ is the workspace and nothing else. Then gate the command class itself: a PreToolUse hook that pattern-matches rm -rf, force-push, and curl | sh and denies by default. This incident class is exactly why our ingest evaluator default-fails any submitted loop containing those commands.
2. Four million tokens in five minutes
June 2026. Anthropic tagged Claude Code issue #68619 critical: "Subagent spawning and subagent pattern bugs trigger infinite recursion, infinite token usage." The report describes subagents spawning children fifty levels deep and ignoring the environment flag meant to disable forking. One observed session burned 4 million tokens in under five minutes — a full Pro Max 20x five-hour budget, gone before the user could react. From the Trenches connected it to a June 2 outage traced to the same pattern: agents spawning agents in a loop that wouldn't terminate, ending in emergency refunds.
The guardrail: the platform's own loop detection is not your safety net. Here, the bug was the platform. You need an external kill switch that watches spend rate, not just totals: tokens-per-minute spiking, or the same command repeating N times, means kill the process and investigate afterward. That's the watchdog pattern — a second, dumber loop whose only job is stopping the first one: runaway-bill-guardrail-loop.
3. $40 in 18 minutes — the retry storm
A developer running a multi-agent loop wrote up the postmortem on dev.to: one agent got stuck retrying a malformed tool response and hammered the API until the bill alert fired. The instructive detail is that he had per-call cost logging. What he didn't have was a shared cap — each call looked cheap; the sum was the problem. His fix was a shared atomic budget across all agents, so "the next loop dies at $5 instead of $40."
The guardrail: budgets must be shared, atomic, and enforced before the call, not logged after it. Per-call logging is observability. A hard cap is a control. Headless runs make the cap cheap to wire: --output-format json returns total_cost_usd per invocation — sum it in the harness, exit when the ceiling's hit.
4. $4,200 over a long weekend
From a 30-team cost audit by LeanOps: a single developer at one client hit $4,200 in API fees over a long weekend during an unattended autonomous refactoring run, on a workload the team hadn't validated. The mechanism is ordinary. Agents re-send accumulated context on every step, so late-loop steps cost multiples of early ones, and an unsupervised loop compounds that for three days straight. The same audit found the 99th-percentile agent user costing $4,200+/month while the median sat at $480 — the spread is the runaway sessions.
The guardrail: wall-clock limits and daily spend cutoffs that don't care how "close" the agent thinks it is. LeanOps' recommended config is concrete: soft cap with an alert, hard daily cutoff, monthly ceiling requiring human approval. If a loop is worth running over a weekend, it's worth a timeout and a budget file.
5. Stuck is not working
The quieter failure mode: loops that burn time and tokens while making zero progress. The Cursor forum is a running catalog — agents in an endless review-step loop, continuous loops, CLI loops, and a diagnostic loop instead of completing tasks. Nothing crashed. Nothing finished either.
The guardrail: no-progress detection. Diff the repo between iterations; if the delta stops changing, that's one of the four legitimate stop reasons in the OpenAI Cookbook's stop-condition taxonomy — halt and hand off, don't spin.
The flip side matters too, or the guardrail becomes the bug. Cursor users running legitimately repetitive test automation get flagged as looping and halted — there's a feature request to disable loop detection for exactly this. Every no-progress heuristic needs an explicit allow-flag for intentional repetition.
The guardrail checklist
Every incident above maps to a missing control. Before any loop runs unattended:
| Control | Detail | From incident |
|---|---|---|
| Sandbox the blast radius | Worktree, container, or microVM. The agent's ~/ must not be your ~/. | 1 |
| Hooks that deny by default | PreToolUse gate on rm -rf, force-push, pipe-to-shell, secret paths. Exit 2 or JSON permissionDecision: "deny" blocks; exit 1 does not, and silence doesn't approve. | 1 |
| Hard budgets, enforced pre-call | Iteration cap + wall-clock timeout + shared atomic spend cap. Log total_cost_usd per run. | 3, 4 |
| A watchdog beside the worker | Rate-based kill switch for token spikes and command repetition. The watchdog loop is the template. | 2 |
| No-progress detection | Diff the repo between iterations, with an override flag for intentional repetition. | 5 |
| An evaluator gate | Default-fail. Checks the diff against scope. Never lets the loop grade its own homework. | all |
| A handoff channel | Notes to a progress file every iteration, and a ping when it stops. ConnectMyEmail handles the "agent sends you an email" part so the watchdog's alert actually reaches you. | all |
None of this is exotic. Supervision, budgets, circuit breakers: ops has run these controls for decades. An agent loop is a worker that's smarter and less predictable than a cron job, so it needs them more, not less.
The floor is also enforced. No loop published in this directory carries a dangerous command — no rm -rf, no force-push, no curl | sh — not because every author was careful, but because the ingest gate hard-rejects those patterns before anything publishes.
To run the checklist against your own loop, paste it into /grade and you get a safety grade with the specific missing controls flagged. If you're building from scratch, the loop builder bakes every control above into the harness it generates.