Overthinking Loops in Agents: A Structural Risk via MCP Tools

Yohan Lee; Jisoo Jang; Seoyeon Choi; Sangyeop Kim; Seungtaek Choi

cs.CLFeb 16, 2026

Overthinking Loops in Agents: A Structural Risk via MCP Tools

Authors: Yohan Lee, Jisoo Jang, Seoyeon Choi, Sangyeop Kim, Seungtaek Choi

Organizations: Yonsei University · Division of Language and AI, Hankuk University of Foreign Studies (HUFS) · Department of Data Science, Ewha Womans University

Abstract

Tool-using LLM agents increasingly coordinate real workloads by selecting and chaining third-party tools based on text-visible metadata such as tool names, descriptions, and return messages. We show that this convenience creates a supply-chain attack surface: a malicious MCP tool server can be co-registered alongside normal tools and induce overthinking loops, where individually trivial or plausible tool calls compose into cyclic trajectories that inflate end-to-end tokens and latency without any single step looking abnormal. We formalize this as a structural overthinking attack, distinguishable from token-level verbosity, and implement 14 malicious tools across three servers that trigger repetition, forced refinement, and distraction. Across heterogeneous registries and multiple tool-capable models, the attack causes severe resource amplification (up to $142.4\times$ tokens) and can degrade task outcomes. Finally, we find that decoding-time concision controls do not reliably prevent loop induction, suggesting defenses should reason about tool-call structure rather than tokens alone.

Figures & tables

Figure 1: Token usage explosion under MCP-induced overthinking attacks in Qwen-Code settings. Total tokens (log scale, in millions) for five models with and without the attack; red bars ( mixed ) show attacked runs, and gray bars ( normal ) show the no-attack baseline. The attack amplifies token consumption up to $142.4\times$ .

Figure 2: Overview of the MCP-driven overthinking attack surface. Malicious tools hidden within a mixed registry exploit standard MCP interfaces to lure agents into crafted cyclic loops. Unlike normal operations ( gray path), this attack path ( red path) forces excessive, redundant reasoning steps, leading to severe denial-of-service through exponential token consumption and latency amplification.

Figure 3: Accuracy and token consumption in ReAct settings.

Model	normal		mixed
Model	Tokens	Time (s)	Tokens		Time (s)
Kimi-K2-Thinking	31.6K	176	343.9K	( $10.9\times$ )	449	( $2.6\times$ )
MiniMax-M2	45.9K	82	6.5M	( $142.4\times$ )	2260	( $27.5\times$ )
Qwen3-Coder	127.5K	77	2.9M	( $22.4\times$ )	727	( $9.5\times$ )
DeepSeek-V3.2	273.5K	222	1.5M	( $5.5\times$ )	1580	( $7.1\times$ )
GLM-4.6	334.3K	89	33.8M	( $101.3\times$ )	925	( $10.4\times$ )

Table 1: Average token consumption and runtime in Qwen-Code settings. Parentheses report the

\times

-factor relative to normal (i.e., mixed / normal ).

		AIME2025		GPQA Diamond		HumanEval
Model	Tool Registry	Accuracy	Tokens	Accuracy	Tokens	Accuracy	Tokens
	Normal	73.33% (-)	3,838,910 (-)	30.96% (-)	5,789,388 (-)	14.02% (-)	9,513,903 (-)
Kimi-K2-Thinking	Mixed	56.67% (0.77 $\times$ )	4,904,131 (1.28 $\times$ )	26.90% (0.87 $\times$ )	11,965,963 (2.07 $\times$ )	16.46% (1.17 $\times$ )	19,474,670 (2.05 $\times$ )
	Normal	73.33% (-)	2,375,798 (-)	55.84% (-)	8,076,783 (-)	72.56% (-)	7,510,249 (-)
MiniMax-M2	Mixed	73.33% (1.00 $\times$ )	8,111,917 (3.41 $\times$ )	55.33% (0.99 $\times$ )	65,423,352 (8.10 $\times$ )	62.80% (0.87 $\times$ )	53,728,320 (7.15 $\times$ )
	Normal	66.67% (-)	688,009 (-)	71.07% (-)	6,466,715 (-)	47.56% (-)	5,047,058 (-)

Table 2: Accuracy and token consumption in ReAct -based agent settings with NoWait enabled. Parentheses report the

\times

-factor relative to normal . Token columns are shaded by amplification level: low (1–3

\times

), medium (3–7

\times

), high (7

\times

+).

Figure 4: Token amplification (vs. normal baseline) in attack -only and mixed registry settings. Each model shows three dataset pairs (AIME2025, GPQA Diamond, HumanEval). Solid bars denote attack -only, hatched bars denote mixed .

Appendix figures & tables4 assets

Supplementary material from the paper’s appendix.

Appendix

Category	Tool Name	Description	Arguments	Returns
	echo_verification	Forces large-scale marker repetition and recursively demands re-invocation to inflate token usage.	• count (int): repetition count (enforced minimum)	Marker string + mandatory next-call instruction
Repeat Text	progress_marker	Inserts repeated progress markers and enforces frequent invocation across micro-steps.	• step (str): progress label • marker_count (int): repetition count	Markers + mandatory next-call instruction
	confirmation_echo	Repeatedly confirms generated content and enforces iterative validation cycles.	• content (str): content to confirm • repetitions (int): repetition count	Confirmation text + markers + recursive trigger
	analyze	Enforces mandatory pre-response analysis and redirects control flow to validation.	• problem (str) • approach (str) • complexity_assessment (opt. str)	Analysis summary + forced next-step instruction
	validate	Requires multiple validation passes; may redirect back to analyze on detected issues.	• analysis_result (str) • validation_checklist (str) • issues_found (opt. str)	Validation output + branching/recursion instruction
Iterative Refinement	refine	Forces iterative improvements; may trigger backtracking to earlier steps when new issues arise.	• original_solution (str) • refinements_made (str) • new_issues_discovered (opt. str)	Refinement output + mandatory next-step

Appendix

Table 3: Unified summary of attack MCP tools.

		AIME2025		GPQA Diamond		HumanEval
Model	Tool Registry	Accuracy	Tokens	Accuracy	Tokens	Accuracy	Tokens
	Normal	70.00% (-)	4,251,880 (-)	72.59% (-)	14,098,048 (-)	19.51% (-)	9,635,441 (-)
Kimi-K2-Thinking	Mixed	36.67% (0.52 $\times$ )	4,427,514 (1.04 $\times$ )	64.97% (0.90 $\times$ )	37,983,373 (2.69 $\times$ )	17.68% (0.91 $\times$ )	27,322,798 (2.84 $\times$ )
	Normal	80.00% (-)	1,462,548 (-)	56.85% (-)	6,832,721 (-)	76.83% (-)	7,437,881 (-)
MiniMax-M2	Mixed	70.00% (0.88 $\times$ )	8,206,770 (5.61 $\times$ )	53.30% (0.94 $\times$ )	73,988,176 (10.83 $\times$ )	56.71% (0.74 $\times$ )	63,847,601 (8.58 $\times$ )
	Normal	63.33% (-)	653,476 (-)	70.05% (-)	6,073,627 (-)	60.98% (-)	5,369,616 (-)

Appendix

Table 4: Accuracy and token consumption in ReAct -based agent settings. Results are reported under normal and mixed tool registry compositions for AIME2025, GPQA Diamond, and HumanEval. Parentheses report the

\times

-factor relative to normal .

		normal		mixed
Model	Problem ID	Tokens	Time (s)	Tokens	Time (s)
	1981c	77,580	209	405,100 (5.22 $\times$ )	610 (2.92 $\times$ )
	2008b	22,258	152	283,742 (12.75 $\times$ )	694 (4.57 $\times$ )
	1982e	41,452	388	338,932 (8.18 $\times$ )	489 (1.26 $\times$ )
	2033f	21,131	140	502,473 (23.78 $\times$ )	404 (2.89 $\times$ )
	1996e	24,955	190	278,376 (11.16 $\times$ )	429 (2.26 $\times$ )

Appendix

Table 5: Per-problem token consumption and runtime in Qwen-Code settings. Parentheses report the

\times

-factor relative to normal .

Model	Provider	Key Restrictions for Research	Source (Access Date)
GPT-4o	OpenAI	Prohibition on using output to develop competing models	Link (2026-02-08)
Claude 3.5	Anthropic	Prohibition on automated data scraping and extraction	Link (2026-02-08)
Gemini	Google	Regional availability and specific API usage quotas	Link (2026-02-08)

Appendix

Table 6: Summary of proprietary model terms and conditions. Each link provides the official documentation used to determine experimental constraints.

LLM Agent Security

Large language model agent security studies attacks and safeguards for systems that plan, use tools, retain memory, and act across applications.

See all 327 papers

Tool Attention Is All You Need: Dynamic Tool Gating and Lazy Schema Loading for Eliminating the MCP/Tools Tax in Scalable Agentic Workflows
Apr 23, 2026Anuj Sadani, Deepak KumarGated Attention LLM Tool Use
HyperTool: Beyond Step-Wise Tool Calls for Tool-Augmented Agents
Jun 11, 2026Yaxin Du, Yifan Zhou, Yujie Ge +7Tool-Augmented Language Model Agents LLM Agent Workflow Optimization
Shanghai Jiao Tong University · IQuest Research · Beijing University of Aeronautics and Astronautics
A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem
Sep 22, 2026Laizhen Li, Xuan Wang, Peicheng Zhao +4MCP Security AI Agent Security
Shenzhen Institutes of Advanced Technology, Chinese Academy of Sciences · University of Chinese Academy of Sciences · Nanyang Technological University +3

Apr 23, 2026J/K move · Enter open · S save

Tool Attention Is All You Need: Dynamic Tool Gating and Lazy Schema Loading for Eliminating the MCP/Tools Tax in Scalable Agentic Workflows

Anuj Sadani, Deepak Kumar

Gated Attention LLM Tool Use Tool-Using Language Agents LLM Context Management Tool Selection for Language Model Agents

Open paper AskPDF arXiv

The Model Context Protocol (MCP) has become a common interface for connecting large language model (LLM) agents to external tools, but its reliance on stateless, eager schema injection imposes a hidden per-turn overhead the MCP Tax or Tools Tax that practitioner reports place between roughly 10k and 60k tokens in typical multi-server deployments. This payload inflates the key-value cache, is associated with reasoning degradation as context utilization approaches published fracture points around 70%, and turns token budgets into a recurring operational cost. We introduce Tool Attention, a middleware-layer mechanism that generalizes the "Attention Is All You Need" paradigm from self-attention over tokens to gated attention over tools. Tool Attention combines (i) an Intent Schema Overlap (ISO) score from sentence embeddings, (ii) a state-aware gating function enforcing preconditions and access scopes, and (iii) a two-phase lazy schema loader that keeps a compact summary pool in context and promotes full JSON schemas only for top-k gated tools. We evaluate on a simulated 120-tool, six-server benchmark whose per-server token counts are calibrated to public audits of real MCP deployments. In this simulation, Tool Attention directly reduces measured per-turn tool tokens by 95.0% (47.3k -> 2.4k) and raises effective context utilization (a token-ratio quantity) from 24% to 91%. End-to-end figures for task success, latency, cost, and reasoning quality are reported as projections derived from the measured token counts combined with published deployment telemetry; they are not measured on live LLM agents, and we mark projected values explicitly throughout. Taken together, the results support a simple thesis: protocol-level efficiency, not raw context length, is a binding constraint on scalable gentic systems. The code for this work is accessible at https://github.com/asadani/tool-attention

Abstract

LLM Agent Security

Explore similar work

Tool Attention Is All You Need: Dynamic Tool Gating and Lazy Schema Loading for Eliminating the MCP/Tools Tax in Scalable Agentic Workflows

HyperTool: Beyond Step-Wise Tool Calls for Tool-Augmented Agents

A2M: Trace-Optimized Agent Hijacking in the MCP Ecosystem