[Bug]: LLM 工具调用 XML 泄露导致快速无限膨胀污染上下文

Open

#1,492 opened on Jul 10, 2026 1 comment 0 reactions 1 assignee View on GitHub

@wsp1911 is already working on this.

Since Jul 14, 2026.

Assessment

This issue has not been assessed yet.

Description

bug help wanted

Summary

LLM 推理异常时，将工具调用指令（<tool_calls> 等 XML 标签）以纯文本形式输出到对话区。系统未做防护，将其识别为合法调用继续执行，形成递归循环，导致上下文在数秒内无限膨胀直至撑爆。

预期行为：系统应检测这种泄露并中断循环，而非无限递归。

Area

Desktop app

Reproduction or evidence

复现步骤：

发起对话触发 LLM 调用
模型某次推理异常，输出中出现本应是工具调用指令的 XML 标签（如 <tool_calls>...）作为自然语言回复内容
系统解析输出时检测到 <tool_calls>，将其作为合法调用执行
工具返回结果 → 再次喂给 LLM → LLM 再次输出同样的 XML 标签
循环往复，上下文飞速膨胀

示例：

<｜DSML｜tool_calls> <｜DSML｜invoke name="ExecCommand"> <｜DSML｜parameter name="cmd" string="false">Get<｜DSML｜tool_calls> <｜DSML｜invoke name="ExecCommand"> <｜DSML｜parameter name="cmd" string="false">Get-<｜DSML｜tool_calls> <｜DSML｜invoke name="ExecCommand"> <｜DSML｜parameter name="cmd" string="false">Get-Child<｜DSML｜tool_calls> <｜DSML｜invoke name="ExecCommand"> <｜DSML｜parameter name="cmd" string="false">Get-ChildItem<｜DSML｜tool_calls>

可见工具调用 XML 被当作纯文本输出到对话区，且 Get- 命令不断重复，形成死循环。

建议修复方向（供参考）：

泄露检测：解析 LLM 输出时，若 <tool_calls> 出现在自然语言文本块中，判定异常并中断
递归熔断：单次请求最大工具调用嵌套深度限制在 10 层以内
死循环检测：连续 2-3 轮工具调用输出结构完全相同，判定为死循环并立即中断

Environment, if relevant

BitFun版本：0.2.12
平台：Win11
LLM：DeepSeekv4flash

Dominant language: Rust
Stars: 2.3k
Forks: 236
Avg merge: 2h 56m
Merged PRs (30d): 619

Contributor guide

Open the contributing guide

First steps

Read the whole issue, then the project's contributing guide.
Comment on the issue to say you are picking it up — it saves two people doing the same work.
Fork the repository and make your change on a branch.
Open a pull request that references the issue number.

Similar issues

Replayed reasoning items send "content": null, which the Responses API schema does not permit Open

bug CLI custom-model

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

openai/codex#47733 · Opened Sep 24, 2026
hashes has lint warnings on master Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

rust-bitcoin/rust-bitcoin#6930 · 1 comment · Opened Sep 23, 2026
sync build ignores local_timeout when opening kv.db and scripts.db Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

atuinsh/atuin#4247 · 1 comment · Opened Sep 23, 2026
test: stop calling property tests fuzz tests Open

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

fulcrumgenomics/ferro-hgvs#2251 · Opened Sep 23, 2026
Missing examples for `Allocator` Open

A-allocators A-docs C-enhancement T-libs

Difficulty 2/5 1-3 hours Newbie friendliness 75/100

rust-lang/rust#163232 · 4 comments · Opened Sep 23, 2026

More Rust issues