{"id":14403,"date":"2026-10-20T06:19:24","date_gmt":"2026-10-20T13:19:24","guid":{"rendered":"https:\/\/www.infoblox.com\/blog\/?p=14403"},"modified":"2026-10-20T06:19:24","modified_gmt":"2026-10-20T13:19:24","slug":"agentic-denial-of-service-attack-the-emerging-ai-risk-hiding-in-plain-sight","status":"publish","type":"post","link":"https:\/\/www.infoblox.com\/blog\/company\/agentic-denial-of-service-attack-the-emerging-ai-risk-hiding-in-plain-sight\/","title":{"rendered":"Agentic Denial of Service Attack: The Emerging AI Risk Hiding in Plain Sight"},"content":{"rendered":"

Picture a security operations center (SOC) in the age of AI. Alerts are pouring in and AI agents are doing exactly what they were built to do: pulling endpoint telemetry, querying threat intelligence, searching identity logs, summarizing findings and opening cases. Then the AI workflows get slower, and suddenly token budgets are running low. Investigation queues back up. Analysts start triaging on instinct. Somewhere in that noise is the one intrusion that matters. While everyone is buried, an automated response quarantines the wrong network segment and takes a revenue-critical service offline.<\/p>\n

No server was flooded and no firewall failed. The attacker simply turned the defender\u2019s own automation into the weapon.<\/p>\n

We call this Agentic Denial of Service, or ADoS.<\/p>\n

What Is ADoS?<\/h3>\n

ADoS is not \u201cDDoS with AI.\u201d Classic denial of service overwhelms a target with traffic. ADoS denies the business effective use of its AI agents, the infrastructure those agents depend on or the services they are meant to protect. In other words, it is a type of disruption caused when AI agents overwhelm systems with excessive requests, actions or computations. Sometimes an attacker engineers it, purposely flooding the security systems the SOC team uses to deplete tokens and consume resources. Sometimes a runaway or poorly governed agent causes it with no attacker involved.<\/p>\n

Agents Are Already Everywhere<\/h3>\n

This isn\u2019t a future problem, because agents aren\u2019t a future technology. They are already built into the functions that keep the business running today.<\/p>\n\n\n\n\n\n\n\n\n\n\n
Business or IT function<\/th>\nWhat the agent does<\/th>\nWhat it can affect<\/th>\n<\/tr>\n
IT service desk<\/td>\nResolves access, device and software requests<\/td>\nAccounts, endpoints, identity systems<\/td>\n<\/tr>\n
Security operations<\/td>\nTriages, enriches and investigates alerts; recommends or takes action<\/td>\nSecurity information and event management (SIEM), security orchestration, automation and response (SOAR), endpoint detection and response (EDR), threat intelligence, security controls<\/td>\n<\/tr>\n
Site reliability engineering (SRE) and IT operations<\/td>\nDiagnoses outages and performs remediation<\/td>\nProduction applications, compute, traffic routing<\/td>\n<\/tr>\n
Cloud operations<\/td>\nProvisions and scales resources, manages cost<\/td>\nCloud accounts, workloads, quotas, budgets<\/td>\n<\/tr>\n
DevOps and engineering<\/td>\nWrites, tests and deploys code<\/td>\nRepositories, continuous integration\/continuous delivery (CI\/CD) pipelines, production releases<\/td>\n<\/tr>\n
Knowledge and data<\/td>\nAnswers questions, queries and analyzes data<\/td>\nDocuments, databases, sensitive business data<\/td>\n<\/tr>\n
Identity and access<\/td>\nProcesses access requests and applies policy<\/td>\nDirectories, SSO, privileged access, permissions<\/td>\n<\/tr>\n
Network operations<\/td>\nTroubleshoots and changes configurations<\/td>\nDNS, DHCP, IP address management (IPAM), firewalls, network paths<\/td>\n<\/tr>\n<\/table>\n

Agents are valuable because they can automate so much. For the same reason, an agent that is manipulated, overwhelmed or given too much authority can do a lot of damage. Either way, it takes three forms.<\/p>\n

1. Denial of Security: The Defender Becomes the Target<\/h3>\n

In an AI-enabled SOC, every alert sets off a chain of expensive work. An attacker doesn\u2019t need to evade that chain, only feed it. If they generate enough events that look interesting enough to investigate, each one consumes tokens, API quotas, enrichment and sandbox capacity, queue space and analyst attention.<\/p>\n

That makes this economic warfare as much as a cyberattack.<\/p>\n

And since the defender\u2019s costs grow linearly with each new event that requires investigation, the math favors the attacker. The attacker pays very little per event. The defender pays at every stage, and the deeper the investigation goes, the faster the cost compounds. The goal isn\u2019t to crash anything. It\u2019s to make defense too slow, too expensive or too distracted to find the real intrusion.<\/p>\n

Volume isn\u2019t the only way to do it. An attacker can poison the knowledge sources<\/a> that an AI SOC assistant retrieves from, so that it produces confident but wrong investigation summaries. Analysts then spend their time second-guessing the AI instead of benefiting from it.<\/p>\n

2. Denial of Infrastructure: Agent Activity Becomes the Outage<\/h3>\n

Agents depend on shared services such as DNS, APIs, cloud resources, network paths and other agents. Two examples show how those dependencies can be overloaded quickly:<\/p>\n