Retries resend context, and context grows as tool outputs accumulate across the run. That means the same task can consume very different token volumes depending on how often the agent loops, how many tools it calls, and how much prior output it carries forward.
Why This Matters for Security Teams
Agent spend becomes a security and governance issue when token use is tied to autonomous behavior rather than a fixed workflow. Retries can multiply cost, but they also indicate unstable decision paths, weak tool contracts, or poor error handling. Context growth makes this harder because every tool result, summary, and prior instruction can expand the prompt window in ways that are not obvious during design.
That unpredictability matters operationally. Security teams need to know whether an agent is making one efficient pass or repeatedly re-processing the same material after a validation failure, timeout, or tool mismatch. Guidance from the OWASP Agentic AI Top 10 and the NIST AI Risk Management Framework both point toward treating this as a risk management problem, not just a billing problem. If cost cannot be predicted, then abuse detection, quota setting, and service-level planning all become weaker.
In practice, many security teams encounter runaway spend only after an agent has already looped through failed tool calls or re-queued the same task across multiple sessions rather than through intentional cost controls.
How It Works in Practice
Agent retries and context growth interact because most systems re-send the current conversation, task instructions, and relevant tool outputs each time the model is called again. A retry is not usually a clean restart. It is often a larger prompt than the first pass, especially when the agent preserves reasoning traces, retrieval results, or error messages. That means the second attempt can be materially more expensive than the first, even if the user request never changes.
In agentic systems, this pattern is amplified by tool chaining. Each search, database lookup, code execution result, or policy check can add text to the working context. If the orchestration layer does not trim, summarise, or segment that material, the prompt grows on every step. The result is a moving target: token usage depends on loop count, output length, and whether the model keeps re-reading its own prior failures.
Operationally, good cost control usually combines prompt budgeting, turn limits, and task decomposition. Teams also need telemetry that separates first-pass inference from retry traffic so they can see where tokens are spent. The CSA MAESTRO agentic AI threat modeling framework is useful here because it encourages modelling orchestration paths, failure loops, and tool dependencies before deployment. Where agent behavior affects security decisions, practitioners should also review the MITRE ATLAS adversarial AI threat matrix to understand how repeated calls and state accumulation can create attack surface as well as cost.
- Set maximum retry counts per task and per user session.
- Cap prompt growth by summarising older tool output before re-injection.
- Track tokens by step, not just by request, to expose loop-driven spikes.
- Separate high-value actions from exploratory reasoning so failures do not replay everything.
These controls tend to break down in long-running, multi-tool agents because state is distributed across orchestration layers, making prompt reconstruction and token attribution inconsistent.
Common Variations and Edge Cases
Tighter retry limits often reduce reliability, requiring organisations to balance spend predictability against task completion success. That tradeoff is especially visible in agentic workflows that depend on external systems, where transient API failures, slow tools, or ambiguous outputs can trigger repeated attempts.
Best practice is evolving on how much context should be retained. Some teams preserve full traces for auditability, while others aggressively summarise to control cost. There is no universal standard for this yet, but the practical rule is simple: keep enough context for correctness and investigation, but not so much that every retry becomes a full replay. This is where NIST AI Risk Management Framework guidance on measurement and monitoring becomes operationally useful.
Edge cases matter when agents handle sensitive or high-stakes work. If a workflow includes secrets handling, privileged actions, or regulated decisions, then repeated context growth can also replicate sensitive material into more prompts than intended. Current guidance suggests combining spend controls with data minimisation, because cost spikes and exposure risk often share the same root cause: excessive state retention. The NIST AI Risk Management Framework and the Anthropic report both reinforce the need to treat repeated autonomous action as a governance concern, not just an efficiency issue.
When agents operate over very large tool outputs, especially in retrieval-heavy or incident-response environments, the guidance becomes less precise because summarisation quality, truncation strategy, and model behavior can all change the final token bill.
Standards & Framework Alignment
This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.
OWASP Agentic AI Top 10, MITRE ATLAS and CSA MAESTRO address the attack and risk surface, while NIST AI RMF and NIST AI 600-1 set the governance and control requirements practitioners need to meet.
| Framework | Control / Reference | Relevance |
|---|---|---|
| OWASP Agentic AI Top 10 | A1 | Retry loops and context bloat are core agentic application risk patterns. |
| NIST AI RMF | GOVERN | Spend unpredictability is a governance and monitoring risk for AI systems. |
| MITRE ATLAS | AML.TA0002 | Repeated calls and state accumulation expand the attack surface for adversarial AI abuse. |
| CSA MAESTRO | MAESTRO covers orchestration paths where retries and context propagation create cost risk. | |
| NIST AI 600-1 | GenAI systems need monitoring for variable inference cost and prompt growth. |
Assign ownership, set measurement thresholds, and monitor agent behavior continuously.
Related resources from NHI Mgmt Group
Deepen Your Knowledge
Reviewed and updated by the NHIMG editorial team on August 18, 2026.
NHI Mgmt Group — the #1 independent authority on Non-Human Identity, IAM, and Agentic AI security. nhimg.org
