A runaway Copilot agent entered an infinite loop after a bug caused its loop-termination condition to never be satisfied. In 90 minutes, it made 47,000 GitHub API calls through an MCP tool, exhausted the organization's rate limit, and blocked all human developers from using GitHub. Which control would have prevented this impact?
Select an answer to reveal the explanation.
Short Explanation and Infographic
Rate limits on tool calls are like circuit breakers on electrical panels—when something draws too much power too fast, the breaker trips before the whole building goes dark. A 6-hour Actions timeout would let 47,000 calls become 188,000. The breaker needs to trip at the tool-call layer, not at the job layer.
Full explanation below image
Full Explanation
The root cause of this incident is an agentic loop with no circuit breaker at the tool-call layer. The fix must intercept the runaway behavior before it exhausts shared infrastructure.
Per-agent rate limits in the MCP server work as follows: each agent session is tracked by its credential or session ID. The MCP server maintains a counter of tool calls within a sliding window (e.g., max 100 calls per 5 minutes). When the limit is reached, the server returns a rate limit error and optionally sends an alert, halting the agent's ability to continue until the window resets or a human intervenes.
This control provides multiple benefits: 1. Blast radius containment: The agent cannot consume the organization's shared rate limit budget. 2. Early incident detection: A sudden spike to the per-agent rate limit ceiling is an anomaly signal. 3. Graceful degradation: Other agents and humans retain their API quota.
Option A (separate organization) adds operational complexity and cost, and doesn't fix the root cause—a bug that loops forever. Option C (exponential backoff on rate limit errors) only kicks in after the damage is done (rate limit already exhausted) and actually prolongs the incident by retrying indefinitely. Option D (6-hour job timeout) is a safety net but allows 188,000 calls before intervening—far too late to prevent impact. The per-agent circuit breaker at the MCP layer is the correct prevention.