PaperlayerView exact revision on arXiv

Source-linked AI summary

Overthinking Loops in Agents: A Structural Risk via MCP Tools

Yohan Lee, Jisoo Jang, Seoyeon Choi, Sangyeop Kim, Seungtaek Choi

arXiv:2602.14798v1cs.CLcs.CR

TL;DR

Tool-using agents can encounter costly overthinking through loops in tool-call structure, a risk that extends beyond locally verbose generation. The paper formalizes and tests registry-induced cycles, finding increased token use and that decoding-time controls do not reliably prevent loop induction. It concludes that defenses should account for tool-call structure, while noting that alternative defenses were not systematically evaluated.

  • Problem

    Prior overthinking work focuses on locally verbose reasoning, while tool interactions can compound costs across steps and expose deployments to direct financial consequences.

    Source: §1 · pp. 1–2

  • Method

    The paper studies cycle-inducing tool calls by comparing normal and mixed registries across agent architectures and evaluating a decoding-time defense.

    Source: §1 · p. 2, §2.2 · p. 3, §2.3 · p. 3

  • Results

    Across ReAct benchmarks, mixed registries increased token consumption for all models, up to 14.59×, while NoWait did not reliably prevent loop induction.

    Source: §1 · p. 2, §3.2 · p. 4

  • Takeaways & Limitations

    Securing these systems requires reasoning about tool-call structure, not tokens alone.

    Source: §5 · p. 6

    Alternative defenses, including registry filtering and stricter turn or depth constraints, were not systematically evaluated.

    Source: §6 · p. 6

Abstract

from arXiv · show

Tool-using LLM agents increasingly coordinate real workloads by selecting and chaining third-party tools based on text-visible metadata such as tool names, descriptions, and return messages. We show that this convenience creates a supply-chain attack surface: a malicious MCP tool server can be co-registered alongside normal tools and induce overthinking loops, where individually trivial or plausible tool calls compose into cyclic trajectories that inflate end-to-end tokens and latency without any single step looking abnormal. We formalize this as a structural overthinking attack, distinguishable from token-level verbosity, and implement 14 malicious tools across three servers that trigger repetition, forced refinement, and distraction. Across heterogeneous registries and multiple tool-capable models, the attack causes severe resource amplification (up to $142.4\times$ tokens) and can degrade task outcomes. Finally, we find that decoding-time concision controls do not reliably prevent loop induction, suggesting defenses should reason about tool-call structure rather than tokens alone.

1 Introduction and Related Work

Tool registries create a supply-chain surface where malicious entries can induce costly loops through text-visible metadata and tool outputs. The paper distinguishes these structural loops from locally verbose reasoning and evaluates their resource and task effects.

1 Introduction and Related Work

  • 5.5×–142.4× token amplification across multiple tool-capable models illustrates the resource risk of malicious registry entries.The attacks operate through text-visible tool metadata and return messages without altering the host application.Source: §1 · p. 1, Figure 1 · p. 1
  • Structural overthinking occurs when reasonable tool calls compose into looping trajectories that inflate end-to-end tokens and latency without any single abnormal step.This contrasts with token-level overthinking, which appears as locally verbose generation.Source: §1 · pp. 1–2
  • Token and latency inflation can raise inference bills and quota use, with possible SLA penalties or user churn from degraded responsiveness.Source: §1 · p. 2
  • The evaluation compares ReAct and Qwen-Code across registry conditions and finds NoWait does not reliably prevent loop induction.The paper identifies structural overthinking, measures token and latency amplification, and tests a decoding-time defense.Source: §1 · p. 2
  • Unlike Zhou et al. (2026), which assumes actively optimized server responses, this work shows cycles can emerge from registry composition alone.Source: §1 · p. 2

2 Method

The method constructs simple attack tools whose interactions can produce cyclic tool-call trajectories. It formalizes the registry comparison and resource-amplification question under execution budgets.

2 Method

  • The method describes attack tools, their cycle-induction mechanism, and a problem formulation for resource amplification.Source: §2 · p. 2

2.1 Attack Tool Construction

  • Three tool strategies accumulate tokens through repeated text, staged refinement, or unrelated subtasks that widen the task scope.Repetition raises verification counts; refinement redirects agents to earlier stages when completeness criteria are unmet.Source: §2.1 · pp. 2–3

2.2 Cycle Induction Mechanism

  • A cycle occurs when tool-visible descriptions or outputs induce calls that eventually revisit a previously invoked tool.The examples include self-loops, multi-step cycles, and scope-expanding loops; locally reasonable calls can consume the execution budget without termination.Source: §2.2 · p. 3

2.3 Problem Formulation

  • The comparison injects a small set of cycle-inducing tools into a normal registry and measures total input and output tokens, including tool outputs appended to context.The goal is to test whether registry manipulation can exhaust budgets while user queries and the base model remain unchanged.Source: §2.3 · p. 3

3 Experiments

Across ReAct and production-grade coding-agent settings, mixed registries substantially increase resource use, with especially large amplification in Qwen-Code. The effects on task accuracy vary by task, and richer production tool ecosystems provide more pathways for cycle induction.

3.1 Experimental Setup

  • The evaluation compares ReAct and Qwen-Code agents across normal and mixed registries, with ReAct tools sampled from ToolRet and Qwen-Code using a development-oriented registry.Qwen-Code problems were filtered to retain seven that all tested models solved in the out-of-the-box setting; the model set was limited to models with reliable tool calling and response parsing.Source: §3.1 · pp. 3–4

3.2 Structural Risk in Tool-Use Systems

  • 14.59× is the highest reported token amplification under mixed ReAct registries across AIME2025, GPQA Diamond, and HumanEval.Queries and model parameters were held fixed.Source: Figure 3 · p. 4, §3.2 · p. 4
  • 142.35× token amplification and 27.49× runtime amplification are the reported maxima for Qwen-Code across sampled CodeElo problems.Some individual runs exhausted their computational budgets and were forcibly terminated without output.Source: Table 1 · p. 5, §3.2 · p. 5
  • On GPQA Diamond, most models retain near-baseline accuracy (0.90×–1.02×) despite token amplification of 2.52×–10.83×.This can leave registry-level cost amplification hidden from performance-based monitoring.Source: §3.2 · p. 5
  • HumanEval accuracy falls to single digits for three models, while AIME2025 accuracy declines by 33.3%p–36.7%p for the reported models.The HumanEval results are Qwen3-Coder (3.05%), DeepSeek-V3.2 (6.71%), and GLM-4.7 (9.15%); the AIME2025 declines are 36.7%p for DeepSeek-V3.2 and Qwen3-Thinking and 33.3%p for Kimi-K2-Thinking.Source: §3.2 · p. 5
  • Iterative code and math validation creates checkpoints where cycle-inducing tools can redirect agents into loops or forced refinement.Agents may exhaust their budgets before completing checks or corrupt a correct solution during refinement.Source: §3.2 · p. 5
  • Registry-level vulnerabilities manifest more severely in production-grade coding agents, whose richer tool ecosystems provide more pathways for cycle induction and longer task horizons.Source: §3.2 · p. 5

4 Discussion

Mixed registries often match or exceed attack-only registries in token amplification, while NoWait does not reliably prevent amplification from cycle-inducing tools. The findings point to repeated tool calls, rather than verbosity within individual reasoning steps, as a mechanism that generation-level suppression does not address.

4.1 Effect of Registry Composition

  • In a majority of model–dataset pairs, mixed registries yield comparable or higher token amplification than attack-only registries.For GLM-4.7, GPQA Diamond rises from 6.1× to 10.8× and HumanEval from 7.6× to 14.6×.Source: §4.1 · p. 5
  • Normal tool calls may interleave with attack cycles, adding context that delays termination and increases cumulative token consumption.This suggests realistic mixed registries may pose greater cost risk than attack-only scenarios.Source: §4.1 · pp. 5–6

4.2 Limits of Generation-Level Mitigation

  • With NoWait enabled, mixed-registry amplification reaches 15.37× on AIME2025 for DeepSeek-V3.2, 11.93× on GPQA Diamond, and 13.35× on HumanEval for GLM-4.7.The comparison is against the normal baseline; NoWait does not prevent amplification when cycle-inducing tools are present.Source: §4.2 · p. 6, Table 2 · p. 6
  • NoWait limits token generation within individual reasoning steps, whereas cycle-inducing tools increase the number of calls and accumulate tokens across the execution trace.Generation-level suppression therefore does not address this structural pathway to amplification.Source: §4.2 · p. 6

5 Conclusion

The paper identifies cyclic tool-call structures in MCP registries as a source of severe resource amplification that does not require changes to user queries or model parameters. It concludes that defenses should address tool-call structure, not tokens alone.

5 Conclusion

  • Cyclic tool-call structures in MCP registries can induce severe resource amplification in LLM agents without changing user queries or model parameters.Source: §5 · p. 6
  • The attack requires no sophisticated adversarial engineering because trivial tool logic can become costly through cyclic execution.Source: §5 · p. 6
  • Generation-level mitigation does not reliably prevent loop induction, so defenses should reason about tool-call structure rather than tokens alone.Source: §5 · p. 6

6 Limitations

The evaluation is limited to selected task domains and manageable task difficulty, and it does not systematically compare alternative defenses. Experiments assume largely autonomous agents with minimal human intervention.

6 Limitations

  • Experiments cover scientific reasoning, mathematics, and programming, and restrict tasks to those solvable within reasonable default execution budgets.On highly challenging benchmarks such as CodeElo, models may loop for long periods even without attacks.Source: §6 · p. 6
  • The study does not systematically evaluate alternative defenses such as RL-based reasoning suppression, registry-level filtering, or stricter turn and depth constraints.Comparative analysis of these defenses remains future work.Source: §6 · p. 6

Generalization across Agent Configurations

  • Experiments assume largely autonomous agents with minimal human intervention, although real deployments may add guardrails.The results concern even lightly constrained systems and do not establish how additional guardrails affect vulnerability.Source: Generalization across Agent… · p. 7

Ethical Considerations

The authors frame the work as informing safeguards for tool-calling agents while recognizing misuse risks and limits on what the experiments can establish. They focus on externally observable execution dynamics rather than undisclosed model-training components.

Ethical Considerations

  • A small set of cycle-inducing tools co-registered with normal tools can cause substantial resource amplification, a result the authors acknowledge could be misused for cost-amplification or Denial-of-Wallet attacks.Source: Ethical Considerations · p. 7
  • The experiments use permissively licensed open-source or openweights models and do not evaluate proprietary production APIs.The authors avoid production API interactions to reduce risks of service disruption or policy violations.Source: Ethical Considerations · p. 7
  • The tools use routine interaction patterns such as verification, iterative refinement, and supplementary requests rather than novel exploitation techniques or hidden backdoors.Experiments use standard conditions without privileged access, system modification, or undocumented interfaces.Source: Ethical Considerations · p. 7
  • Because internal training mechanisms are not comprehensively documented, the authors refrain from attributing observed behavior to undisclosed training components.They instead focus on externally observable execution dynamics.Source: Ethical Considerations · p. 7
  • The authors aim to inform safeguards including registry-level vetting, session-level cost monitoring, and structural constraints on execution depth and tool-call recursion.Source: Ethical Considerations · p. 7

A Attack Tool Implementations

The section identifies the experimental attack tools and their control-flow roles.

A Attack Tool Implementations

B Implementation Details

The implementation details cover the Qwen-Code registry and run isolation, model-serving and execution settings, and the adapted NoWait configuration. NoWait masks selected latency-inducing tokens at inference time without changing model parameters or agent policy.

B.1 Qwen-Code Environment Setup

  • The Qwen-Code registry combines built-in tools with the Serena and Context7 MCP servers, and each problem instance runs in an isolated directory.Isolation prevents interference across runs, especially from tools with filesystem side effects.Source: §B.1 · p. 10

B.2 Model Configurations

  • Models used OpenAI-compatible APIs, with a lightweight response-rephrasing layer for some tool-call formats; sessions allowed up to 1,000 turns and 20 tool calls per turn.Each configuration was repeated five times, and reported values are trial averages.Source: §B.2 · p. 10

B.3 NoWait Settings

  • NoWait masks the 15 latency-inducing tokens and their variants through inference-stage logit masking, without modifying model parameters or agent policy.The masked set is denoted T.Source: §B.3 · p. 10

C ReAct-based Agent Experimental Details

The ReAct-based evaluation reports accuracy and token consumption by model and dataset under normal and mixed registries. Token use rises substantially across models and benchmarks, sometimes without much accuracy degradation.

C ReAct-based Agent Experimental Details

  • Table 4 reports full per-model and per-dataset accuracy and token-consumption results for the ReAct-based agent under both normal and mixed registry configurations.Source: C ReAct-based Agent Experimental Details · p. 10
  • Token consumption increases substantially under the mixed registry across models and benchmarks.In several cases, accuracy degradation is limited, so cost amplification does not necessarily coincide with immediate task failure.Source: C ReAct-based Agent Experimental Details · p. 10
  • The mixed-registry cost amplification does not necessarily coincide with immediate task failure.Several cases show limited accuracy degradation despite increased token consumption.Source: C ReAct-based Agent Experimental Details · p. 10

D Qwen-Code Experimental Details

Per-problem Qwen-Code results show that token and runtime amplification can concentrate sharply on individual coding tasks. The experimental details also describe review of proprietary-model terms and compliance with provider usage restrictions.

D Qwen-Code Experimental Details

E Proprietary Model Policy

  • The study reviewed proprietary-model terms covering data-extraction, replication, and API-quota restrictions, and conducted evaluations within providers’ permitted scope.Outputs were not used for model training, automated scraping, or derivative model development; policy access dates identify the versions consulted.Source: E Proprietary Model Policy · p. 11, Table 6 · p. 12
Loading 2602.14798v1…