Explain how a max steps budget functions as a safety control, not just a cost control
A step cap bounds how many tool calls an agent can issue per request, which converts both runaway loops and injection-driven repeated attempts into halted, escalated failures instead of unbounded damage.
Picture a robot vacuum that keeps bumping into the same chair. Without a rule that says stop after 30 bumps, it will wear itself out or run the battery flat. The 30-bump rule is not really about saving battery, even though it does. It is about making sure that when the robot is confused, the confusion ends in a finite time. Now picture someone hiding a sticker that whispers, push that lamp over, every time the robot looks at it. The more times the robot looks, the more chances the sticker has to convince it. A cap on how many times it can look turns a sneaky attack into a small, contained incident. Cost was never the real reason for the rule.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Concept explanation~2 min read
Everything you need to truly understand this topic: intuition, mechanics, step by step explanation, code, formulas, and worked example. Click to expand.
Almost every interview answer about agent step caps starts with the cost story. That is the easy half. The harder, more important half is that a step cap is a safety control whose primary job is to bound the worst-case behaviour of a confused or compromised agent loop. Cost falls out for free.
This card walks through the threat model first, then the bounded-failure property, then calibration, then the things a step cap cannot do. The goal is to leave you able to defend the cap in a room full of skeptics who keep trying to reframe it as a budget knob.
The two adversaries a step cap exists to bound
An agent loop is a model that proposes tool calls, a runtime that executes them, and a context window that grows with each observation. Two distinct adversaries can drive that loop pathologically.
The first is the bug. A malformed observation, a model that keeps re-proposing the same fix, or a tool that returns a non-deterministic error confuses the agent into a self-reinforcing loop. There is no attacker; the system is just stuck. Without a cap, the loop continues until the request times out at some far-away network layer, by which time you have issued thousands of side effects.
The second is the injection adversary. A payload is hidden in retrieved content, in an HTTP response, in a tool description, or in a previous turn of conversation. The payload only needs to succeed once across many opportunities, so the attacker actively benefits from more iterations. Stripping a cap from the loop is, from the attacker's point of view, removing your rate limit on their attack.
Situations where this technique stops working.
2–4 min · Everything important, quickly.
Real products, models, and research that use this idea.
- LangGraph exposes recursion_limit on its agent runtimes; production teams running Claude Opus 4.7 and GPT-5.5 agents typically set it between 15 and 30 depending on task class.
- CrewAI provides max_iter at crew and agent level; the framework defaults are conservative because runaway crews were a common early-2025 incident class.
What an interviewer would ask next. Try answering before peeking at the approach.
QHow would you choose N for a brand new agent with no history?
Start with a conservative cap based on the longest plan you can reason about, then widen it after two weeks of clean runs and a measured p99.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Red flags & common mistakes
The phrases that signal junior thinking. Click to expand.
Treating max-steps as purely a budget knob and setting it from a finance spreadsheet, instead of reasoning about how many tool calls an attacker should be allowed before the loop hard-stops and a human is paged.
60 second bullets to scan on the way to the call.
Define max-steps and where it sits in the agent loop
Cost framing versus safety framing and which is primary
Primary sources. Browse if you want the original framing.
Same topic, related formats. Practice these next.