# Preventing Infinite Email Loops in Autonomous AI Agents: Circuit Breakers and Token Buckets

_By Tayyab Mughal, Founder & AI Chief · 20 August 2026 · 2 min read_

> Architecture patterns to prevent autonomous AI agents from entering recursive email loops, burning API quotas, and triggering spam blocklists.

When two autonomous email agents start talking to each other, they can trigger an infinite email loop in minutes. Here is how to engineer circuit breakers, token buckets, and idempotency safeguards.

## The anatomy of an autonomous email storm

An infinite email loop occurs when an agent-generated email triggers an automated auto-responder (or another AI agent), which the original agent interprets as a new incoming ticket, generating another reply.

Without defensive constraints, a single loop can generate 5,000+ outbound messages within 15 minutes, exhausting rate limits, burning thousands of LLM tokens, and getting your sending IP blocklisted on Spamhaus.

## Defense Layer 1: Distributed Token Bucket Rate Limiting

Never rely solely on client-side counters. Implement a distributed token bucket in Redis to enforce per-recipient and per-agent limits across all cluster nodes.

```typescript
import Redis from 'ioredis';

const redis = new Redis(process.env.REDIS_URL!);

export async function checkEmailRateLimit(agentId: string, recipient: string): Promise<boolean> {
  const windowKey = `ratelimit:${agentId}:${recipient}`;
  const currentCount = await redis.incr(windowKey);
  
  // First message in window: set 1-hour expiration
  if (currentCount === 1) {
    await redis.expire(windowKey, 3600);
  }

  // Maximum 3 emails to the same recipient per hour from any agent
  if (currentCount > 3) {
    console.warn(`[RATE_LIMIT_BLOCKED] Agent ${agentId} exceeded hourly limit for ${recipient}`);
    return false;
  }
  return true;
}
```

## Defense Layer 2: Auto-Submitted & Precedence Headers

Always inject RFC 3834 and RFC 2076 headers into agent-sent messages so external mail servers know the message was generated by an automated system.

```typescript
const headers = {
  'Auto-Submitted': 'auto-generated',
  'Precedence': 'bulk',
  'X-Agent-ID': 'agent_customer_support_v2',
  'X-Loop-Protection': 'sadasend_containment_v1'
};
```

## Defense Layer 3: SadaSend Hardware-Level Scoped Keys

Even if your application logic fails, SadaSend scoped keys enforce hard rate limits (e.g. 50 sends/hour) and recipient allowlists at the API gateway layer, physically preventing loops from reaching mail carriers.

---

_Tags: Security, Architecture, AI agents, Rate Limiting_