Diagnosing a Runaway Agent from an Incident Report

On-call gets paged: an internal agent that triages incoming bug reports (classifies severity, searches the codebase for related known issues, and drafts a triage note) ran for 40 minutes on a single bug report before someone manually killed it, and the LLM bill for that one run was about 60x a normal run. The trace shows the agent repeatedly called search_codebase(query="null pointer in auth") with the exact same query string more than 30 times, each time producing a new "Thought: let me search again with a more specific query" that didn't actually change the query.

1. Name the specific failure mode and identify what's missing from the loop that allowed it to run 40 minutes / 30+ calls unchecked.
2. Design the concrete mitigations you'd add, addressing both "stop it from happening" and "stop it from being this expensive if it does."
3. Why is "the model's own reasoning trace said it was trying a different approach each time" not a sufficient signal that progress was being made?