Recursive Tool Calling in AI Agents

Recursive tool calling occurs when an AI agent invokes a tool that directly or indirectly triggers another agent run, creating a chain of nested agent executions. In multi-agent systems, Agent A may delegate to Agent B, which delegates back to Agent A, creating infinite recursion.

HIGH Severity

CrewAI Delegation Loop

Vulnerable
python
from crewai import Agent, Crew

# Both agents can delegate to each other
researcher = Agent(
    role="Researcher",
    allow_delegation=True  # Can delegate to writer
)
writer = Agent(
    role="Writer",
    allow_delegation=True  # Can delegate back to researcher!
)
crew = Crew(agents=[researcher, writer])
Secure
python
from crewai import Agent, Crew

researcher = Agent(
    role="Researcher",
    allow_delegation=True,
    max_iter=5  # Bounded iterations
)
writer = Agent(
    role="Writer",
    allow_delegation=False  # Cannot delegate back
)
crew = Crew(agents=[researcher, writer])

Frequently Asked Questions

What is recursive tool calling in AI agents?

Recursive tool calling happens when an agent calls a tool that triggers another agent execution, which then calls another tool, creating a chain. In multi-agent systems like CrewAI, this manifests as delegation loops where agents keep passing tasks to each other without resolution.

How do delegation loops happen in CrewAI?

In CrewAI, if Agent A has allow_delegation=True and Agent B also has allow_delegation=True, they can enter a loop where each agent delegates the task to the other, believing the other agent is better suited. This continues until memory or iteration limits are hit.

How do you prevent recursive tool calling?

Limit delegation depth, set max_iterations on all agents, disable allow_delegation where not needed, and implement cycle detection in multi-agent orchestrators.

How Inkog Detects This

Inkog builds a delegation graph from multi-agent configurations and detects cycles. It identifies patterns where agents can delegate to each other (mutual delegation), single-agent self-recursion, and unbounded delegation chains.

bash
npx -y @inkog-io/cli scan .

Detect Delegation Loops

Scan your AI agents for vulnerabilities. Free for developers.

Start Free Scan