By Eno Thereska, Co-Founder & CEO @ Trent AI
At Trent (Agentic AI Security), one question keeps coming up as AI agents multiply inside security workflows:
The ratio of AI agents to humans will continue to get higher and higher over time. Is it possible that a new attack pattern could emerge where you simply flood and distract the few humans in the loop i.e., essentially "DDoS the humans"?
It sounds like science fiction, but the numbers say it isn't.
The bandwidth gap is the vulnerability
As Neil Lawrence, Chief Scientist of Trent AI and author of The Atomic Human, frames it: a typical human sharing information verbally does so at around 2,000 bits per minute. Two machines communicating with each other operate at roughly 600 billion bits per minute. That is a difference of 300 million times: a human walking while the machine travels at the speed of light.
This isn't a metaphor for vague AI capability. It's a concrete information-theoretic constraint on every human-in-the-loop security architecture. When a SOC analyst reviews an alert, escalates to a decision-maker, or approves an agentic remediation action, that pathway runs at walking pace while the threat landscape and agent ecosystem move at the speed of light.
Any workflow where a human sits in the critical path between detection and decision has a structural bottleneck baked in at a factor of 300 million.
When AI agents join the security stack
Denial-of-service used to mean overwhelming systems. That mental model is breaking.
As AI agents become operational parts of security workflows (continuous scans, alert triage, threat-intel correlation, remediation recommendations), machine-generated output directed at human analysts increases dramatically. Tools like Snyk and Wiz already produce hundreds of findings per scan cycle. Add autonomous agents that continuously observe, analyze, and report, and you no longer have a prioritization problem. You have a throughput problem.
A prioritization problem means better ranking algorithms. A throughput problem means the channel itself (the human) has a hard bandwidth ceiling that no ranking algorithm changes. In classical security workflows, the human was the high-bandwidth component. In agentic security, the human is the bottleneck.
The Lancelot failure mode
Lawrence calls out a systems failure pattern: the "Lancelot" problem. In a complex legacy system, Lancelot is the old-hand engineer with the most overall context. Over time nothing significant ships without Lancelot, not by policy, but because unapproved changes break things. The de facto gate then becomes overloaded, loses track of system state, and the safety gate prevents the system from functioning.
Agentic security workflows are reproducing this at scale. The few humans left in a highly automated SOC are the new Lancelot. They hold the context agents lack and make the calls automation cannot. When those humans are overwhelmed (by volume, complexity, or deliberate adversarial flooding), the safety gate collapses.
What human DDoS looks like
In the human-in-the-loop model, the resource being exhausted is cognitive bandwidth: attention, working memory, and decision capacity. If an attacker knows a security team's human review queue is the chokepoint:
Volume flooding. Generate enough low-severity, plausible-looking signals (noisy vulnerability reports, synthetic threat indicators, or agent-generated false positives) to saturate the review queue. The real attack travels through while analysts process decoys.
Complexity injection. Inject ambiguous, high-complexity cases that require disproportionate cognitive effort. Each one consumes more bandwidth than a routine alert and degrades capacity for everything behind it.
Timing attacks. Concentrate signal injection at moments of known constraint (shift changes, incident response, audit cycles) when the human layer is already near capacity.
None of these require compromising systems. They exploit a narrow human channel, and narrowing it further doesn't require technical access to anything.
Code/data separation makes it worse
Classical systems separate code (instructions) from data (inputs). In AI systems, data is software; the model's behavior is shaped by training and runtime inputs. That is the mechanism behind prompt injection on agentic systems. An agent retrieving context from an external source may encounter instructions embedded in that data that redirect its behavior. It cannot reliably distinguish operating policy, a user request, and adversarial content, because all three arrive through the same channel.
For security-specific agents this is concrete. An agent triaging vulnerabilities and querying external threat intelligence is, by design, ingesting partially untrusted sources. Embedding adversarial instructions that suppress alerts, misclassify severity, or generate misleading recommendations is a real attack surface. The human then reviews a compromised triage process, not a clean summary.
Designing for the human layer
Automation handles routine cases efficiently. What remains for human review is the edge case: the ambiguous signal where judgment matters most. Automation concentrates cognitive load into fewer harder decisions. Machines process findings at 300 million times the rate humans can consume them. Any architecture that terminates in a human decision node will eventually saturate that node if upstream volume scales without bound.
Treat the human channel as a constrained resource: rate limit what reaches human review (not just rank it), build audit trails so agents justify filtering decisions, and design recovery paths when the approval queue stalls.
Take adversarial pressure on the human layer seriously as a threat model. If an attacker can saturate human review capacity without touching infrastructure, infrastructure security is irrelevant. The system doesn't need to be breached to fail. It needs only to make the few humans left unable to decide.
That's the attack. And right now, most security architectures aren't designed to defend against it.
Full writeup: DDoSing the Human in an AI Agentic System
Top comments (0)