The 401 Retry Bug: Auditing an Agent-Written Backoff Loop With a Fake Server

Description and use

Problem: An agent-generated PR added an exponential backoff loop that retries 401 responses, ignores Retry-After, and silently returns None, corrupting downstream callers. Solution: build a fake server to record timestamps and write unit tests to assert retry behavior.

Problem

An agent-generated pull request added an exponential backoff loop that incorrectly retries 401 responses, ignores Retry-After headers, and silently returns None, causing downstream failures.

Outcome

The review uncovered that the backoff loop retries on authentication failures, ignores Retry-After, and silently returns None, which corrupts downstream callers. The fake server and tests demonstrated the problematic timing and request pattern.

Workflow

• Read the diff and identify retry smells
• Build a fake HTTP server that records timestamps
• Write unit tests that assert request timing and count

Evidence

It also retries a 401 six times. Along the way it sleeps about 63 seconds.

Source

The first smell is except Exception. It catches KeyError from a bug in the caller. It catches programming errors and network errors with the same hand.

Source

The second smell is the missing status filter. A 400 and a 503 produce identical behavior. Authentication failures get retried, which is pure latency with no upside.

Source