I reported this in issue #24657 early this year, but I have seen no activity on this yet. I consider this a serious issue.
In short, if a vault-agent template suffers an I/O error (permission error, nonexistent file), it will enter a tight retry loop and consume 100% CPU. In our case this happened with read I/O errors (our templates were using the file function to read a file); I am not sure if this applies to write I/O errors as well.
Each time round on this tight retry loop the agent communicates with the Vault server, which means that the agent hammers the server with what is essentially an self-inflected Denial of Service attack.