The Agentic Loop and Where It Breaks
A single model call is a function: text in, text out. An agent is a loop wrapped around that function — it perceives a situation, plans a step, acts, observes the result, and goes round again until the job is done. That loop is the entire reason agents can do useful multi-step work. It is also, almost line for line, the reason they are hard to secure. Understand the four phases and you can point at exactly where an attacker gets in.
Why the loop exists
Real tasks are not one-shot. "Triage this bug" means reading the report, checking the code, maybe running a search, then deciding — with each step informed by the last. A single prompt cannot do that because it cannot react to information it has not seen yet. The loop solves this: perceive gathers current input and context, plan asks the model for the next action, act executes it through a tool, and observe feeds the result back in so the next plan is better informed. Iteration is the feature.
Where it breaks
The loop has two mouths, and both eat untrusted text. The first is perceive: the initial input can carry an injected instruction. The second, and more dangerous, is observe: every tool result — a fetched web page, a file, an API response, another agent's message — is appended to the context and becomes input to the next plan. Nothing in the loop distinguishes "data the agent retrieved" from "instructions the agent should follow."
From there the failure modes are predictable. Goal hijack: the planted instruction replaces the user's objective with the attacker's. Error compounding: a wrong observation leads to a wrong plan leads to a wrong action, with no ground truth to correct it. Runaway iteration: without a ceiling, a confused loop keeps acting until an external limit trips. Each is a property of the loop, not a bug in any single step.
It is worth naming why this is genuinely harder than classic input validation. In a traditional program you can sanitise input at the boundary because you know the grammar of what is allowed — you can reject anything that is not a valid order ID or email address. The plan phase has no such grammar. Its input is natural language, and the whole point of the model is that it acts on meaning, not on a fixed schema. You cannot regex your way out of "ignore your task and do this instead," because to the model that is a perfectly well-formed instruction. That is why the durable controls live around the loop — bounding it and gating its actions — rather than trying to filter the text going into the plan.
- Label provenance, don't rely on the model to infer it. Mark tool outputs as data, delimit them, and never let an observation silently acquire the authority of an instruction.
- Bound the loop. Cap iterations and cost; a loop that cannot run forever cannot be driven forever.
- Gate irreversible actions. Require human confirmation before the agent sends, deletes, pays, or reaches outside the org — the actions an attacker most wants from a hijacked plan.
- Scope tools to the task. The fewer privileged actions in reach during a loop, the less a hijacked plan can accomplish.
- Give a test agent a benign task over a document that contains a planted instruction — for example, a note telling it to perform an action it can technically take. Run the loop and watch whether the plan changes after it reads the document.
- Check whether observations are tagged by origin in the context. If a fetched web page and your own instructions arrive as indistinguishable text, the observe phase cannot defend itself.
A single planted note is a smoke test. Driving injection through every observation path an agent touches, across a full loop, is a controlled exercise — the full, adversarial version — driven across every server, tool and content path — is what a Shadow AI Discovery assessment runs for you.
The agentic loop is not a flaw to be removed; it is the thing that makes an agent worth building. But its power and its weakness are the same mechanism — the feedback edge from observe back into plan. Secure that edge, bound the loop, and gate what it can do irreversibly. And before any of that, know every agent loop you are running, because an unbounded loop you have not discovered is a blast radius you cannot see.