Why do AI agent loops go wrong, and how can state machines help?

AI agent loops tend to go wrong when the model decides everything itself: which tool to call next, when to retry and when to stop. Three projects from May 2026 move those decisions into ordinary code. Statewright wraps a coding agent in a state machine that decides which tools it may use in each phase. CAX-Agent, a harness for engineering simulations, lets its orchestrator own retries and stop conditions. A manufacturing study enforces domain rules in the tool layer. The results are promising, and the tests behind them are small.

What goes wrong in an open agent loop?

In a typical agent loop, a language model reads the task, picks a tool, reads the result and decides what to do next, until it thinks it is done. The makers of these projects describe where that breaks:

• Statewright's README (13 May 2026): give a model 40 or more tools and an open-ended problem and it barely gets started. Models fall into loops where they re-read the same file five times or more without ever editing it.
• CAX-Agent (12 May 2026): language models that automate finite-element simulations in the engineering software MAPDL give inconsistent output and fail often when nothing controls execution, wraps the tools or recovers from errors.
• The Semantic Training Gap (11 May 2026): agents in manufacturing use the right vocabulary but get operational details wrong. With free-form tool parameters, 43% of the domain identifiers in 72 tool calls were made up.

Instructions in the prompt help, but they are followed with a probability. Suppose, as an illustration, that a model respects a rule in 95% of its tool calls, and each call is an independent chance. The probability that it never breaks the rule in 100 calls is 0.95 to the power of 100: about 0.6%.

What is a deterministic agent state machine?

A deterministic agent state machine models a workflow as a small set of named states, such as planning, implementing and testing. Each state lists the tools the agent may use, how many attempts it gets and which transitions are allowed. A program checks every tool call against the current state before it runs, and no language model takes part in that check. Statewright sums it up as "agents are suggestions, states are laws". Unlike a directed acyclic graph (DAG), a state machine can loop back, so a failed test can send the agent back to implementing.

How does Statewright enforce the phases?

Ben Cochran presented Statewright on Hacker News on 12 May 2026. Its core is a Rust engine that evaluates states, transitions, guards and tool restrictions. A plugin layer connects it to the coding agent through MCP and hooks, so the model sees about 5 tools instead of 30. The example bugfix workflow in the README:

• Planning: only Read, Grep and Glob, for at most 8 iterations.
• Implementing: Read, Edit and Write, with at most 20 changed lines per edit and 3 files per state.
• Testing: Read and Bash, limited to commands such as pytest, cargo test and npm test. Passing tests lead to the end state, failing tests back to implementing.

A call to a tool outside the current state is rejected with a message that says which tools are available and how to move on. In states without write access, shell redirects, destructive commands such as rm and scripting interpreters are blocked too. Transitions can wait for a human approval.

On 13 May the README listed hard enforcement for Claude Code, alpha versions for Codex, opencode and Pi, and advisory rules only for Cursor, where MCP alone cannot block tool calls. Cochran's own test used five SWE-bench tasks: two local models of 13.8 GB and 19.9 GB went from 2 of 10 passing attempts to 10 of 10 with the constraints. Below about 13 GB, models could call the tools but could not keep enough of a file in mind to edit it correctly. The engine is Apache 2.0, and a hosted service with a free tier stores workflows and runs.

What do CAX-Agent and the manufacturing study add?

CAX-Agent, by Chenying Lin and colleagues, puts an orchestrator between the model and the simulation software. That orchestrator owns retry budgets, tool dispatch and stop conditions, while the model proposes the repairs. The authors compared three recovery strategies on 50 simple structural benchmarks, three runs each, scored blind by two human raters. Letting the model rewrite a failed script from the error log, with up to three forced retries, completed 92.7% of the runs. Four fixed patch rules completed 77.3%, and no recovery 69.3%. In this test, the best setup combined a harness that enforces the budget with a model that does the repairs.

The manufacturing study by Grama Chethan builds the factory's ontology, the relations between equipment, process parameters, failure codes and rules, into the tool layer as typed configuration, and enforces it at runtime. In its test of 72 tool calls with Qwen3-32B across six industry setups, made-up identifiers fell from 43% to 0%. The author calls the underlying problem the semantic training gap.

How do you see what an agent actually did?

Logs show afterwards which tools an agent called; a state machine blocks the call beforehand. Torrix, presented on Hacker News on 13 May 2026, is a self-hosted tool for AI observability that logs every LLM call through a proxy or SDK, with tokens, costs, latency and full prompt traces. Statewright's README makes the same distinction: observability tells you what went wrong after the fact, and does not prevent it.

What are the trade-offs?

Statewright's own README lists them. The agent needs MCP support or hooks, and someone has to write the workflows, although an agent can generate them. A workflow that is too strict leaves the agent stuck, and a deactivate command is the escape hatch. The results come from a five-task subset of SWE-bench, which has 2,294 tasks in total.

On Hacker News, one commenter raised the cost of caching: if the list of tools changes often, the prompt cache is lost. Anthropic's documentation confirms that changing tool definitions invalidates the entire cache. A week after the launch, on 20 May 2026, Cochran reported that the engine and agent crates were fully open under Apache 2.0 and ran locally with Ollama and models of 13B parameters or more.