Yeah, and how long / how many tokens do these attacks take?

The user has to send the agent off into these weeds intentionally, or else be totally asleep at the wheel while something goes very far off the rails.