A user-facing interrupt is a control-flow event, not a license to hold agent state forever. The report reproduces a state machine in which missing expiry metadata defaults to indefinite pending status, and new work for the thread cannot proceed after an incomplete resume. A bounded policy may instead expire the interrupt or reject it at admission. This…
Inspect the ClaimsCase · DiggingBeagle record
AG-UI client could leave an agent thread blocked by interrupts with no expiry
A reported client behavior treats an omitted interrupt expiry as never expiring, leaving subsequent agent runs on the same thread pending.
Scope
Reported against @ag-ui/client 0.0.58; later versions and field prevalence require separate testing.
Assessment profile
Assessment method- Setting
- research demonstration
- Exploitation
- demonstrated
- Evidence
- Grade D
- AI role
- AGAINST AI
Basis and provenance
The pinned Claim and its primary disclosure support the described controlled result, but do not establish a population-wide rate or calibrated impact. The only available supporting evidence is the reporter's or advisory author's own account; independent reproduction has not been shown. Impact remains unbanded because no calibrated impact rubric for this particular evidence is established.
Assessed Nov 2, 2026 using diggingbeagle.assessment/1.
Evidence basis: CLM-2026-NOV02-AGUI-INTERRUPT-NO-EXPIRY-A · AG-UI protocol issue 2525: no expiresAt causes pending interrupt lock
At a glance
Undefined expiry has to have explicit lifecycle semantics; silent infinite wait is a denial-of-service shape for long-running agents.
Read the implicationsReported against @ag-ui/client 0.0.58; later versions and field prevalence require separate testing. It remains unclear which later client versions adopt a bounded fallback and whether a server can authoritatively invalidate an unresolved interrupt after disconnect.
Limits and uncertaintyFull account
A user-facing interrupt is a control-flow event, not a license to hold agent state forever. The report reproduces a state machine in which missing expiry metadata defaults to indefinite pending status, and new work for the thread cannot proceed after an incomplete resume. A bounded policy may instead expire the interrupt or reject it at admission. This concerns session availability, not proven data theft or bypass of an approval gate.
The decisive state transition is a finished run that carries interrupt identifiers but omits expiresAt. According to the issue reproduction, the client then treats those identifiers as pending indefinitely, including when a later run on the same thread is otherwise valid. This is different from a deliberate long-lived human approval: the protocol does not communicate an intentional retention policy, a deadline or a required cancellation action. Testing must cover interrupted runs with multiple IDs, partial resumes and a client process restart, because a timeout that exists only in memory will not necessarily clear durable thread state.
Mechanism and trust boundary
- 01
Receive agent interrupt outcome
The server sends RUN_FINISHED with one or more interrupt IDs but no expiresAt.
Boundary: Server response into client control state
- 02
Treat missing expiry as indefinite
The client retains pending interrupts without a default timeout.
Boundary: Optional timestamp into lasting state
- 03
Block following runs
A subsequent run waits on unresolved interrupts and cannot advance.
Boundary: Pending gate into session availability
Claims & evidence
CLM-2026-NOV02-AGUI-INTERRUPT-NO-EXPIRY-AThe AG-UI issue documents a valid RUN_FINISHED interrupt outcome without expiresAt under @ag-ui/client 0.0.58 and shows subsequent runAgent calls failing to settle until all pending interrupt IDs are explicitly resumed.supported
Basis: reported finding
- supportsAG-UI protocol issue 2525: no expiresAt causes pending interrupt lockprimary disclosure
Issue 2525, @ag-ui/client 0.0.58 reproduction and isInterruptExpired behavior
Implications
Undefined expiry has to have explicit lifecycle semantics; silent infinite wait is a denial-of-service shape for long-running agents.
Controls and mitigations
- Bound interrupt lifetime, cap pending items and record which interrupt IDs must be resumed or explicitly cancelled.
- Treat a missing expiry as an explicit policy decision at admission and make a pending interrupt list inspectable and cancellable by the thread owner.
Unknowns and contradictions
- Reported against @ag-ui/client 0.0.58; later versions and field prevalence require separate testing.
- It remains unclear which later client versions adopt a bounded fallback and whether a server can authoritatively invalidate an unresolved interrupt after disconnect.
Sources and citation
Material revision history
- Nov 2, 2026 · Canonical change recorded · new in release · revision 214