If AI agents quietly pass a task around in a circle, how could anything spot the loop when each hand-off looks fine?

This explores how a monitor could notice that a task has been handed from agent to agent and eventually back around, even though every individual hand-off looks harmless. The corpus has no tested loop detector. It does explain why the obvious approaches fail and what a working one would need to track. The threat is concrete: the Telephone Loop is an attack that abuses cross-agent delegation to make agents pass work around in circles, and it needs multiple agents to exist at all Can agents be tricked into delegating work in circles?.

The first lesson is that a loop is a property of the whole sequence, not of any single step. Per-action guardrails are structurally unable to state a rule that depends on prior history. Only stateful monitors that follow composed multi-party behavior can check it Can stateless checks ever catch sequence-level constraint violations?. Skill scanners show the same weakness. ColluSkill reaches about 96% attack success because scanners score each skill alone, so an attacker can polish every piece while the chain-level intent stays intact Can attackers evade skill scanners by refining individual skills?. A delegation ring works the same way: each 'please handle this' is fine, and only the circle is the problem.

The second lesson is what to track. One line of work argues that the unit of defence should be a set of actions linked by observed transfers, task authority and response history. Membership should be revised as evidence accumulates Should defence units span multiple executions and agents?. Applied to loops, delegations are the transfers, and a loop is a chain of transfers that returns to an agent that already held the task, with no new authority or visible progress. That reading is my extension of the idea, not something the paper tests. Provenance also has to live in that structure, not in what agents say. Monitors that read text as if one author wrote it lose track when agents paraphrase reasoning they picked up from context, so origin is erased at the boundary Can chain-of-thought monitors detect reasoning that originates elsewhere?.

The hard part is doing this before you know which actions belong together. The same research names this 'prospective episode discovery' as the central unsolved problem. It reports no conclusive result on whether discovery can run at an acceptable false-alert cost Can defenders discover agent episodes without knowing membership in advance?. A second trap is that cycles aren't inherently suspicious. Distilled reasoning models show about five cycles per sample in their hidden-state reasoning graphs, against near zero in base models, and more cycles go with better accuracy Do reasoning cycles in hidden states reveal aha moments?. That finding concerns one model reconsidering its own answer, not delegation between agents. It does suggest that a good delegation-loop detector shouldn't flag any cycle. It should flag cycles that go around without making progress.