DDoSing the Human in an AI Agentic System

“The ratio of AI agents to humans will continue to get higher and higher over time. Is it possible that a new attack pattern could emerge where you simply flood and distract the few humans in the loop i.e., essentially ‘DDoS the humans’?”

It sounds like science fiction, but the numbers say it isn’t.

The Bandwidth Gap Is the Vulnerability

To understand why human DDoS is a real and measurable risk, you need to start with information theory specifically, the raw throughput gap between human and machine cognition.

As Neil Lawrence, Chief Scientist of Trent AI and author of The Atomic Human, frames it: a typical human sharing information verbally does so at around 2,000 bits per minute. Two machines communicating with each other operate at roughly 600 billion bits per minute. That is a difference of 300 million times. This is equivalent to a human walking while the machine travels at the speed of light.

This isn’t a metaphor for vague AI capability. It’s a concrete information-theoretic constraint on every human-in-the-loop security architecture. When your SOC analyst reviews an alert, escalates to a human decision-maker, or approves an agentic remediation action, that entire pathway is running at walking pace while the threat landscape and the agent ecosystem around it are moving at the speed of light.

The security implication is direct: any workflow where a human sits in the critical path between detection and decision is operating with a structural bottleneck baked in at a factor of 300 million.

What Changes When AI Agents Join the Security Stack

For years, denial-of-service meant overwhelming systems. Flood the infrastructure, exhaust the resources, bring the service down. That mental model is breaking.

As AI agents become operational parts of security workflows running continuous vulnerability scans, triaging alerts, correlating threat intelligence, and recommending remediations, the volume of machine-generated output directed at human analysts increases dramatically. Tools like Snyk and Wiz already produce hundreds of findings per scan cycle. Add autonomous agents that are continuously observing, analyzing, and reporting, and you no longer have a prioritization problem. You have a throughput problem.

The distinction matters. A prioritization problem means better ranking algorithms. A throughput problem means the channel itself i.e., the human, has a hard bandwidth ceiling that no ranking algorithm changes. The communication channel between machine and data now runs at gigabit speeds, while the channel between human and computer remains narrow. In classical security workflows, the human was the high-bandwidth component. In agentic security, the human is the bottleneck.

The Lancelot Failure Mode

Lawrence identifies a systems failure pattern directly relevant here, which he calls the “Lancelot” problem. In a complex legacy software system, Lancelot is the old-hand engineer who has accumulated the most overall system context. Over time, no significant change gets made without running it past Lancelot, not by policy, but because teams discover through failure that unapproved changes break things. Lancelot becomes a de facto approval gate.

The pattern ends predictably: Lancelot becomes overloaded, loses track of the system state, and eventually the approval gate that was meant to ensure safety becomes the thing that prevents the system from functioning at all.

Agentic security workflows are reproducing this pattern at scale. The “few humans left” in a highly automated SOC are the new Lancelot. They hold the context that agents lack. They make the calls that automation cannot. As the ratio of agents to humans rises, each human carries more system-wide accountability. When those humans are overwhelmed, whether by volume, complexity, or deliberate adversarial flooding, the safety gate collapses.

What Human DDoS Looks Like in Practice

A traditional DDoS exploit exhausts a resource. In infrastructure terms that resource is bandwidth, compute, or connection state. In the human-in-the-loop model, the resource being exhausted is cognitive bandwidth: attention, working memory, and decision capacity.

The adversarial pattern follows naturally. If an attacker knows that a security team’s human review queue is the chokepoint, they have several options:

Volume flooding. Generate enough low-severity, plausible-looking signals, via noisy vulnerability reports, synthetic threat indicators, or agent-generated false positives, to saturate the human review queue. The real attack travels through while analysts are processing decoys.

Complexity injection. Rather than flooding with volume, inject ambiguous, high-complexity cases that require disproportionate cognitive effort to adjudicate. Each one consumes more human bandwidth than a routine alert and degrades capacity for everything behind it in the queue.

Timing attacks. Concentrate signal injection at moments of known human resource constraint such as shift changes, incident response periods, audit cycles when the human layer is already running near capacity.

None of these require compromising systems. They exploit the information-theoretic constraint: the human channel is narrow and narrowing it further doesn’t require technical access to anything.

The Code/Data Separation Problem Makes It Worse

Another structural issue amplifies the risk: machine learning and AI breaks a foundational assumption of classical computer security. Classical systems maintain strict separation between code (instructions) and data (inputs). Security models are built on this separation. In AI systems, data is software; the model’s behavior is directly shaped by its training and runtime inputs.

This is the mechanism behind prompt injection attacks on agentic systems. An agent retrieving context from an external source, a document, a web page, a database record, may encounter instructions embedded in that data that redirect its behavior. The agent cannot reliably distinguish between its operating policy, a user request, and adversarial content in retrieved data, because all three arrive through the same channel.

For security-specific agents, this is not an abstract risk. An agent tasked with triaging vulnerabilities and querying external threat intelligence feeds is, by design, ingesting content from partially untrusted sources. Embedding adversarial instructions in those sources i.e., instructions that cause the agent to suppress alerts, misclassify severity, or generate misleading recommendations is a concrete attack surface. The human reviewing the agent’s output receives not a triage summary but the output of a compromised triage process.

Automation Concentrates Complexity, It Doesn’t Eliminate It

There’s a paradox at the center of agentic security automation that the human DDoS framing makes legible. Automation is adopted because it handles routine, high-volume, well-defined cases more efficiently than humans. This is correct and valuable. But it has a structural consequence: what remains for human review is no longer the average case. It is the edge case, the ambiguous signal, the situation where context, judgment, and accountability matter most.

These are precisely the cases that consume the most cognitive bandwidth. The automation doesn’t reduce human cognitive load; it concentrates it into a smaller number of harder decisions. As the agent layer scales up, the human layer gets a progressively more difficult job with progressively fewer resources allocated to it.

Real bandwidth numbers make the asymmetry concrete. Machines process and generate findings at 300 million times the rate humans can consume them. Even with sophisticated filtering and prioritization, any architecture that terminates in a human decision node will eventually saturate that node if the upstream volume scales without bound.

Designing for the Human Layer

The response is not to remove humans from the loop because the edge cases that reach them are exactly the ones where human judgment is load bearing. The response is to treat the human channel as a constrained resource that requires explicit architectural design, the same way network bandwidth or compute capacity requires design.

That means rate limiting what reaches human review, not just ranking it. It means building audit trails that let agents justify their filtering decisions so humans can spot systematic suppression. It means designing recovery paths: what happens when the human approval queue stalls, and how does the system degrade gracefully rather than failing silently?

It also means taking adversarial pressure on the human layer seriously as a threat model. If an attacker can saturate your human review capacity without touching your infrastructure, your infrastructure security is irrelevant. The system doesn’t need to be breached to fail. It needs only to make the few humans left unable to decide.

That’s the attack. And right now, most security architectures aren’t designed to defend against it.