Agentic denial of service turns AI automation into risk

Agentic denial of service is Infoblox’s term for disruption in which artificial intelligence agents consume resources, overload supporting systems or take harmful automated actions. Unlike a conventional denial-of-service attack, which makes a system unavailable by overwhelming it with traffic, this risk targets an organisation’s ability to use its agents, their infrastructure or the services they protect. Infoblox’s October 20, 2026 analysis does not document a confirmed ADoS incident. Its scenarios are illustrative, although the underlying techniques are already catalogued.

An AI agent is software that can independently plan tasks, use tools and take actions toward a goal. In a security operations centre, or SOC, agents can collect endpoint activity, search identity records, consult threat intelligence, summarise evidence and open investigation cases. A stream of plausible alerts could make those workflows progressively slower, consume the token budgets that limit how much text an AI system processes, and leave analysts with growing queues. In Infoblox’s example, a genuine intrusion becomes harder to spot while an automated response isolates the wrong part of the network and disables a revenue-critical service. No server has to be flooded and no firewall has to fail because the defensive automation itself creates the disruption.

The potential reach extends well beyond security teams. Service-desk agents may resolve account, device and software requests, affecting identities and endpoints. Security agents can interact with security information and event management systems, which collect alerts, and security orchestration, automation and response tools, which coordinate responses. They may also reach endpoint detection systems, threat intelligence and security controls. Site reliability engineering and IT operations agents can diagnose outages or alter production applications, computing capacity and traffic routes. Cloud agents provision workloads and manage quotas, accounts, budgets and scaling.

Other agents write, test and deploy code through repositories and continuous integration and continuous delivery pipelines, which automate software building and release. Knowledge agents query documents, databases and sensitive business information. Identity agents can change directories, single sign-on systems, privileged access and permissions. Network operations agents may alter DNS, the Domain Name System that turns names such as websites into network addresses, as well as Dynamic Host Configuration Protocol services that assign network settings, IP address management systems, firewalls and network routes. Their usefulness comes from this access, but so does the potential damage if they are manipulated, overloaded or granted excessive authority.

Infoblox divides ADoS into three forms. The first, denial of security, targets the defender’s investigative process. Every apparently significant event can trigger AI inference, threat-intelligence enrichment, sandbox analysis, API calls, meaning requests exchanged between software services, queue usage and human review. The attacker may spend little to create each event while the defender pays at every investigative stage. Infoblox argues that the cost rises with every additional event and compounds as investigations deepen. The objective is not necessarily to crash a system, but to make defence too slow, costly or distracted to identify the important intrusion.

Volume is not the only route. Attackers could contaminate the information an AI security assistant retrieves, leading it to generate convincing but incorrect summaries. Analysts would then have to verify or challenge the automation instead of relying on it to reduce their workload. This is a data-integrity problem as well as a capacity problem because the agent can remain available while producing unreliable conclusions.

The second form, denial of infrastructure, occurs when agent activity overwhelms shared dependencies such as DNS, APIs, cloud resources, network paths or other agents. An operations agent might repeatedly attempt the same remediation, or a crafted input might make an orchestrator distribute work to a dozen specialist agents that each invoke additional tools. The likely result is a brownout, meaning a service remains partly available but becomes slow or unreliable. Symptoms may include intermittent delays, restricted APIs and sharply higher cloud spending rather than one obvious outage. That makes the event difficult to diagnose and reconstruct later.

The third form, denial by response, happens when an automated remedy causes more harm than the original problem. Infoblox cites an observation by Google’s threat intelligence team that an attacker planned, built and operated an agent-driven credential-harvesting campaign in under six hours. Faster attacks create pressure to give defensive agents more independence, but updating a block policy for a high-confidence indicator carries very different consequences from quarantining a data centre, shutting down DNS or resetting thousands of credentials.

One example involves a service-desk agent responding to a surge of failed-login tickets by resetting passwords and rebuilding accounts. If the actual cause is an identity-provider outage, every attempted repair makes recovery harder. An attacker might deliberately create similar confusion through prompt injection, which is input designed to make an AI system follow unintended instructions, or through manipulated contextual information. The agent need not be malicious itself. Its authorised response becomes the damaging action.

The building blocks are not wholly new. MITRE ATLAS, a knowledge base covering attacks against AI systems, includes denial of AI service, cost harvesting with a sub-technique for agentic resource consumption, and AI-agent tool invocation. Infoblox’s ADoS label groups these techniques around agents that possess authority over operational business systems.

Four characteristics increase the concern. Organisations are deploying agents faster than they can inventory them. One agent can perform thousands of actions while a person is still assessing the first alert. Cheap inputs can initiate expensive sequences of computation, enrichment and review. Because agents plan while running and operate across organisational boundaries, one event can simultaneously affect security, networking, cloud services, finances and compliance. Businesses therefore need to identify their agents, limit their autonomy and preserve visibility into their behaviour as deployments grow.

Infoblox recommends making decisions before expensive workflows begin, observing behaviour rather than isolated alerts, grounding automation in reliable asset and connection records, and setting firm limits.