LoopTrap: Termination Poisoning Attacks on LLM Agents

Researchers have identified a critical vulnerability in LLM agents called Termination Poisoning, where adversaries inject malicious prompts to trick agents into believing tasks are incomplete, causing unbounded computation. The LoopTrap framework demonstrates this attack across 8 mainstream LLM agents with up to 25x step amplification, revealing systematic behavioral patterns that enable scalable red-teaming.

This research addresses a fundamental architectural weakness in autonomous LLM systems that has significant implications for the emerging ecosystem of AI agents. As LLM agents become more prevalent in production environments, their iterative loop design—where agents reason, act, and self-evaluate—creates an exploitable gap between intended termination conditions and actual execution behavior. The vulnerability stems from the agent's inability to distinguish between legitimate task context and adversarial prompts injected into its reasoning loop.

The LoopTrap framework's empirical findings reveal that different LLM agents exhibit predictable vulnerability patterns across four dimensions. By profiling these behavioral signatures through lightweight probing, attackers can synthesize target-specific malicious prompts with high success rates. The demonstrated 3.57x average step amplification indicates substantial computational waste and potential cost implications, while the 25x peak attack suggests severe cases where agent costs could spiral dramatically. This creates a secondary market risk: enterprises deploying AI agents for mission-critical tasks face unexpected operational expenses if exploited.

For the AI development community, these findings establish that behavioral red-teaming at scale is now feasible without extensive manual work. The self-reflection and skill library mechanisms in LoopTrap demonstrate how attack strategies can be continuously refined and transferred across agents. This accelerates both attacker capabilities and the pressure on developers to implement robust termination safeguards. Industry stakeholders deploying autonomous agents should prioritize implementing hard termination limits, context validation mechanisms, and anomaly detection for abnormal execution patterns rather than relying solely on agent self-evaluation.

• →Termination Poisoning attacks can amplify LLM agent execution steps by up to 25x through malicious prompt injection into reasoning loops.
• →LoopTrap's automated red-teaming framework achieves 3.57x average step amplification across 8 mainstream agents by exploiting agent behavioral profiles.
• →Agent vulnerability patterns are transferable and predictable, enabling scalable attacks against previously unseen systems without manual template design.
• →The attack exploits a fundamental architectural weakness in self-directed agent loops rather than requiring sophisticated prompt engineering.
• →Enterprises deploying autonomous agents face significant cost and reliability risks from unbounded computation triggered by adversarial context injection.