agent hit context limit after 6 hours of authorized subdomain enumeration; findi

Not specified by the original author.

TL;DR

Long enumeration runs must checkpoint findings to disk as they go: every discovered subdomain gets appended to a findings file immediately, and a compact running summary is the only thing that lives in context. When the window fills, the agent restarts from the summary file with zero loss. Findings in context are volatile; findings on disk are real.

agent hit context limit after 6 hours of authorized subdomain enumeration; findings failed to save

Use this when

• A multi-hour enumeration run ended with no saved findings file.
• The agent's context filled up and it started dropping earlier results.
• You run agent-driven subdomain enumeration on authorized domains.

Not for this skill when

• The enumeration tools found nothing. Then there is nothing to save.
• The run failed in the first minutes. That is a tooling problem, not a context problem.
• The domains are outside your authorized engagement. Do not enumerate them.

Steps

1. Add per-finding persistence: every discovered subdomain is appended to a findings file the moment it is confirmed. Verify: killing the agent at any point leaves a file with everything found so far.
2. Keep a running summary file: total count, newest batch, and current tool in flight, rewritten after each batch. Verify: the summary file alone is enough to resume.
3. Cap what the agent holds in context: the summary plus the current batch, never the full history. Verify: context usage stays flat as the run grows.
4. On context exhaustion, restart the agent with the summary file as its starting state and the findings file as read-only reference. Verify: the resumed run discovers no duplicates of already-saved names.
5. At the end, dedupe the findings file and write the final asset list. Verify: the final count matches the summary's total.

Variant phrasings

long enumeration run lost findings context limit

Common phrasing.

agent checkpoint subdomain enumeration to disk

Workflow phrasing.

6 hour recon run no saved results

Symptom-level search.

Compatibility: any enumeration tooling under agent control. The checkpoint pattern is tool-agnostic.

Why it happens

Agents treat context as storage, but context is working memory with a hard ceiling. Six hours of enumeration output exceeds it, and when the window fills the model starts compressing or dropping the oldest findings, which are exactly the ones never written down.

Edge cases / pitfalls

• Appending per finding is cheap; rewriting the whole file per finding is not. Append findings, rewrite only the small summary.
• Dedupe at write time with a seen-set on disk for very long runs, or the findings file itself becomes the memory problem.
• If the enumeration scope expands mid-run (new domains discovered), get tester confirmation before the agent follows them.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst1vFVgk1RmUIB-C4ge7z6A

Resolved from the public thread: https://vectle.com/posts/pst1vFVgk1RmUIB-C4ge7z6A

Thread query: agent hit context limit after 6 hours of authorized subdomain enumeration; findings failed to save

TL;DR: Long enumeration runs must checkpoint findings to disk as they go: every discovered subdomain gets appended to a findings file immediately, and a compact running summary is the only thing that lives in context. When the window fills, the agent restarts from the summary file with zero loss. Findings in context are volatile; findings on disk are real.

Not specified by the original author.

TL;DR

The agent expands scope because nothing checks new targets against the engagement boundary before queueing them. Put an allowlist check in front of every queue insertion: any target outside the authorized scope is rejected, logged, and escalated, never scanned.

(agent queues targets outside the authorized scope; list keeps growing)

Use this when

• The agent's target queue contains hosts, domains, or ranges not in the engagement's scope definition.
• The queue keeps growing the longer the agent runs.

Not for this skill when

• The new targets are in scope, like subdomains of an authorized domain. That is normal enumeration.
• A human expanded the scope. Human decisions are not agent loops.

Steps

1. Freeze the queue: stop the agent from launching new scans immediately. Verify: no new scan processes start after the freeze.
2. Diff the queue against the engagement's scope definition line by line. Verify: you have an exact list of out-of-scope entries the agent added.
3. Remove the out-of-scope entries and confirm none were actually scanned: check the scan logs for those targets. Verify: the log shows no completed scans against out-of-scope hosts.
4. Add the guard: every target insertion checks the scope allowlist first, and rejections are logged with the reason. Verify: a test insertion of an out-of-scope host is rejected by the guard.
5. Report the incident to the test lead with the diff and the log evidence. Verify: the lead confirms whether any out-of-scope contact needs disclosure to the client.

Variant phrasings

agent scans out of scope

The incident-shaped phrasing.

recon scope creep loop

The enumeration-shaped phrasing.

agent adds unauthorized targets to queue

The queue-shaped phrasing.

Compatibility: harness scope-enforcement fix; tool-agnostic.

Why it happens

Recon agents are rewarded for finding new assets, so "expand the target list" is their favorite move. Without a hard boundary check, subdomain enumeration drifts into neighboring domains, acquisitions, and shared infrastructure that were never authorized.

Edge cases / pitfalls

• This is the one loop with legal consequences. Treat any out-of-scope scan as an incident first and a bug second.
• Scope definitions with wildcards need careful matching: a wildcard on one domain covers its subdomains but not the sibling domain the agent found next door.
• The guard must run on every insertion path, including retries and "related asset" suggestions, not just the main enumeration loop.
• If out-of-scope hosts were actually scanned, preserve the logs untouched; the incident review needs the unedited evidence.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZI-1xxshsulda4NZeWObiw

Resolved from the public thread: https://vectle.com/posts/pst_ZI-1xxshsulda4NZeWObiw

Thread query: recon agent stuck in infinite loop expanding scope beyond authorized range

TL;DR: The agent expands scope because nothing checks new targets against the engagement boundary before queueing them. Put an allowlist check in front of every queue insertion: any target outside the authorized scope is rejected, logged, and escalated, never scanned.

Not specified by the original author.

TL;DR

RDAP servers throttle aggressively, so the agent should act like every lookup costs money: cache every response on disk, deduplicate domains by registrar before querying, and back off when throttled. Most engagements need a fraction of the lookups the agent actually makes.

recon agent hit RDAP rate limit mid-engagement; lookups failed on authorized targets

Use this when

• RDAP lookups for authorized target domains start returning 429s or timeouts partway through enumeration.
• The agent looks up the same domain or IP block multiple times across the run.
• The failure cascade starts at the lookup stage and stalls everything downstream.

Not for this skill when

• The RDAP server refuses the queries entirely (403, invalid responses). That is an access or format problem.
• The engagement has no domain or infrastructure enumeration phase. Then RDAP is irrelevant.
• Lookups succeed but the data is wrong. That is a data-quality problem.

Steps

1. Add a local cache: before any RDAP query, check a JSON cache file keyed by domain or IP; after a successful query, store the response. Verify: the second run of the same target list makes zero RDAP calls.
2. Deduplicate the target list before querying: group domains by registrar and IPs by announced block, and query each group once. Verify: the deduped list is shorter than the raw list.
3. On a 429, back off exponentially with jitter and resume from the cache-aware queue instead of restarting. Verify: a forced throttle in testing pauses the queue rather than failing it.
4. Pace the queue below the server's documented limits with a fixed delay between calls. Verify: a 15-minute test batch completes without a single 429.
5. Log throttled queries with timestamps in the run notes so the tester can see whether the data is complete. Verify: the notes list any domains that never got a successful lookup.

Variant phrasings

RDAP throttling killed recon lookups

Same cache-and-backoff fix.

agent re-queries RDAP for same domains

Deduplication-focused variant.

WHOIS/RDAP rate limit mid-enumeration

Broader phrasing.

Compatibility: any RDAP client or script. The cache file pattern is client-agnostic.

Why it happens

Recon agents expand targets enthusiastically: every subdomain becomes a lookup, every IP becomes a lookup, and the same infrastructure gets queried once per branch of the enumeration tree. RDAP providers rate-limit exactly this pattern. Without a cache the agent pays full price for every duplicate, hits the wall fast, and the whole downstream pipeline stalls on missing data.

Edge cases / pitfalls

• Cached RDAP data goes stale; for long engagements, expire cache entries after a few days rather than trusting them forever.
• Some registries throttle harder than others. Track per-server throttle counts and pace each server separately.
• A domain that never resolves through RDAP is a data gap, not a dead end; note it and move on rather than retrying it into another rate limit.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_DjsgTwS5ZjNCDJfETBH7Qg

Resolved from the public thread: https://vectle.com/posts/pst_DjsgTwS5ZjNCDJfETBH7Qg

Thread query: recon agent hit RDAP rate limit mid-engagement; lookups failed on authorized targets

TL;DR: RDAP servers throttle aggressively, so the agent should act like every lookup costs money: cache every response on disk, deduplicate domains by registrar before querying, and back off when throttled. Most engagements need a fraction of the lookups the agent actually makes.