Picture a security operations center (SOC) in the age of AI. Alerts are pouring in and AI agents are doing exactly what they were built to do: pulling endpoint telemetry, querying threat intelligence, searching identity logs, summarizing findings and opening cases. Then the AI workflows get slower, and suddenly token budgets are running low. Investigation queues back up. Analysts start triaging on instinct. Somewhere in that noise is the one intrusion that matters. While everyone is buried, an automated response quarantines the wrong network segment and takes a revenue-critical service offline.
No server was flooded and no firewall failed. The attacker simply turned the defender’s own automation into the weapon.
We call this Agentic Denial of Service, or ADoS.
What Is ADoS?
ADoS is not “DDoS with AI.” Classic denial of service overwhelms a target with traffic. ADoS denies the business effective use of its AI agents, the infrastructure those agents depend on or the services they are meant to protect. In other words, it is a type of disruption caused when AI agents overwhelm systems with excessive requests, actions or computations. Sometimes an attacker engineers it, purposely flooding the security systems the SOC team uses to deplete tokens and consume resources. Sometimes a runaway or poorly governed agent causes it with no attacker involved.
Agents Are Already Everywhere
This isn’t a future problem, because agents aren’t a future technology. They are already built into the functions that keep the business running today.
| Business or IT function | What the agent does | What it can affect |
|---|---|---|
| IT service desk | Resolves access, device and software requests | Accounts, endpoints, identity systems |
| Security operations | Triages, enriches and investigates alerts; recommends or takes action | Security information and event management (SIEM), security orchestration, automation and response (SOAR), endpoint detection and response (EDR), threat intelligence, security controls |
| Site reliability engineering (SRE) and IT operations | Diagnoses outages and performs remediation | Production applications, compute, traffic routing |
| Cloud operations | Provisions and scales resources, manages cost | Cloud accounts, workloads, quotas, budgets |
| DevOps and engineering | Writes, tests and deploys code | Repositories, continuous integration/continuous delivery (CI/CD) pipelines, production releases |
| Knowledge and data | Answers questions, queries and analyzes data | Documents, databases, sensitive business data |
| Identity and access | Processes access requests and applies policy | Directories, SSO, privileged access, permissions |
| Network operations | Troubleshoots and changes configurations | DNS, DHCP, IP address management (IPAM), firewalls, network paths |
Agents are valuable because they can automate so much. For the same reason, an agent that is manipulated, overwhelmed or given too much authority can do a lot of damage. Either way, it takes three forms.
1. Denial of Security: The Defender Becomes the Target
In an AI-enabled SOC, every alert sets off a chain of expensive work. An attacker doesn’t need to evade that chain, only feed it. If they generate enough events that look interesting enough to investigate, each one consumes tokens, API quotas, enrichment and sandbox capacity, queue space and analyst attention.
That makes this economic warfare as much as a cyberattack.
And since the defender’s costs grow linearly with each new event that requires investigation, the math favors the attacker. The attacker pays very little per event. The defender pays at every stage, and the deeper the investigation goes, the faster the cost compounds. The goal isn’t to crash anything. It’s to make defense too slow, too expensive or too distracted to find the real intrusion.
Volume isn’t the only way to do it. An attacker can poison the knowledge sources that an AI SOC assistant retrieves from, so that it produces confident but wrong investigation summaries. Analysts then spend their time second-guessing the AI instead of benefiting from it.
2. Denial of Infrastructure: Agent Activity Becomes the Outage
Agents depend on shared services such as DNS, APIs, cloud resources, network paths and other agents. Two examples show how those dependencies can be overloaded quickly:
- An SRE agent gets stuck in a recursive remediation loop.
- A crafted input causes an orchestrator to fan out to a dozen specialist agents, each of which calls more tools.
The result rarely looks like a clean outage. It looks like a brownout: intermittent latency, throttled APIs and a spike in cloud spend, with nothing quite down but everything slower. These are among the hardest incidents to diagnose and to reconstruct afterward.
3. Denial by Response: The Fix Does More Damage than the Threat
This form is the most uncomfortable because it doesn’t require a malicious agent at all.
Attackers are getting faster. Google’s threat intelligence team recently observed an attacker plan, build and run an agent-driven credential-harvesting campaign in under six hours. To keep pace, defenders will have to give their own agents more autonomy. That raises a hard question: where should an agent’s authority stop? Letting an agent update a block policy based on a high-confidence indicator is reasonable. Letting it quarantine a data center, shut down DNS or reset thousands of credentials is a very different decision.
Consider a service desk agent facing a surge of login-failure tickets. It resets passwords and reprovisions accounts, thousands of them, because it can’t see that the real problem is an outage at the identity provider. Every “fix” makes recovery take longer. An attacker could also engineer that confusion deliberately through prompt injection or manipulated context. In that case, the defender’s own response becomes the attacker’s payload.
The Building Blocks Are Already Documented
ADoS is a new name, but the techniques behind it are already catalogued. MITRE ATLAS, the industry knowledge base of adversary tactics against AI systems, lists the following:
- Denial of AI service
- Cost harvesting, including a sub-technique for agentic resource consumption
- AI agent tool invocation
The scenarios above are illustrative. They show what happens when those techniques meet agents with real authority over real business systems.
Why Now Is More Urgent than Ever
Four things set ADoS apart from the automation risks security teams already know:
- Organizations are deploying agents faster than anyone can inventory them.
- An agent can autonomously take thousands of actions while a human is still reading the first alert.
- Cheap inputs trigger expensive chains of inference, enrichment and review.
- Agents plan at runtime and act across domains, so a single event can become a security, network, cloud, financial and compliance problem at the same time.
The last point matters most, because ADoS doesn’t stay within one team’s area of responsibility.
That leaves organizations with three problems to solve:
- Protect the new agentic attack surface.
- Govern how much autonomy agents actually have.
- Keep visibility into agent behavior as the number of agents grows.
Where Defense Starts
There is no single control that stops ADoS. Still, Infoblox has spent decades watching DNS traffic across some of the world’s largest networks, and that vantage point suggests four overarching principles:
- Decide early, where it’s cheap. ADoS works because every stage of the pipeline multiplies cost. The cheapest decision is the one made before the expensive work begins. Blocking a malicious destination at the DNS query costs a fraction of an AI-driven investigation into the alert it would otherwise have generated.
- Watch behavior, not just events. Nearly every connection an agent makes starts with a DNS lookup and leaves a network flow record. Those two signals can show which agents exist, what they talk to and when their behavior departs from normal, including agents that were never formally registered.
- Ground automation in trusted data. Agents make bad decisions when they work from stale or incomplete context. An authoritative record of which assets exist, where they live and what they connect to makes the difference between precise containment and an over-quarantine.
- Bound autonomy and protect the foundation. Give agents budgets, rate limits, approval thresholds for high-impact actions and a kill switch. Make sure the services everything else depends on, DNS above all, stay resilient when automation misbehaves.
None of this replaces governance in the AI orchestration and identity layers, and DNS is not the only control point. It is, however, the layer nearly every connection passes through first, which makes it one of the most efficient places to begin.
That is why Infoblox has a key role in mitigating ADoS. We operate at the layer where an agent’s intent first becomes visible. With Kentik’s network flow intelligence now part of Infoblox, we can also see what happens after the query.
What Comes Next
Agentic AI will make businesses faster and more responsive. The organizations that benefit most won’t be the ones that avoid agents. They will be the ones that can see their agents, set limits on them and stop a small event before it spreads into a business-wide incident.
In the next post, we’ll turn from definition to defense: a practical playbook for discovering agents, setting guardrails, containing abnormal behavior and recovering safely, including the specific ways Infoblox can help.
