Infoblox defines Agentic Denial of Service (ADoS): attackers or runaway AI agents exhaust SOC and infrastructure resources
Infoblox introduces Agentic Denial of Service (ADoS), a class of disruption in which AI agents overwhelm systems with excessive requests, actions or computations, or in which an adversary turns a defender's own automation against it. It is not "DDoS with AI": it denies the business effective use of its AI agents, the infrastructure they depend on, or the services they protect. It can be engineered by an attacker or caused by a runaway or poorly governed agent. The article is a conceptual, vendor-authored analysis with no specific incident, victim or exploited vulnerability. It cites a Google threat intelligence observation of an attacker planning, building and running an agent-driven credential-harvesting campaign in under six hours.
Detalhes técnicos
The article describes three forms of ADoS:
- Denial of Security: an attacker feeds an AI-enabled SOC enough interesting-looking events to consume tokens, API quotas, enrichment and sandbox capacity, queue space and analyst attention. Defender cost grows with each event while attacker cost stays low. Poisoning the knowledge sources an AI SOC assistant retrieves from can also produce confident but wrong investigation summaries.
- Denial of Infrastructure: agent activity overloads shared services such as DNS, APIs, cloud resources and network paths. Examples are an SRE agent stuck in a recursive remediation loop and a crafted input that makes an orchestrator fan out to a dozen specialist agents. The result is a brownout (latency, throttled APIs, cloud spend spikes) that is hard to diagnose.
- Denial by Response: over-privileged agents cause damage through their own remediation, for example a service desk agent mass-resetting credentials during an identity provider outage, or an automated response quarantining the wrong network segment. Prompt injection or manipulated context could trigger this deliberately.
The article maps the building blocks to MITRE ATLAS, which lists cost harvesting, including a sub-technique for agentic resource consumption.
Remediação
Infoblox offers four principles and states that no single control stops ADoS:
- Decide early, where it is cheap, for example by blocking malicious destinations at the DNS query before expensive AI-driven investigation.
- Monitor agent behavior through DNS lookups and network flow records, including unregistered agents.
- Ground automation in trusted, authoritative asset data to avoid over-quarantine.
- Bound autonomy with budgets, rate limits, approval thresholds for high-impact actions and a kill switch, and keep foundational services such as DNS resilient.
Governance in the AI orchestration and identity layers remains necessary.
Linha do tempo
-
Infoblox defines Agentic Denial of Service (ADoS): attackers or runaway AI agents exhaust SOC and infrastructure resources
ler a análise desta fonte ocultar
Infoblox introduces Agentic Denial of Service (ADoS), a class of disruption in which AI agents overwhelm systems with excessive requests, actions or computations, or in which an adversary turns a defender's own automation against it. It is not "DDoS with AI": it denies the business effective use of its AI agents, the infrastructure they depend on, or the services they protect. It can be engineered by an attacker or caused by a runaway or poorly governed agent. The article is a conceptual, vendor-authored analysis with no specific incident, victim or exploited vulnerability. It cites a Google threat intelligence observation of an attacker planning, building and running an agent-driven credential-harvesting campaign in under six hours.
Technical Details
The article describes three forms of ADoS:
- Denial of Security: an attacker feeds an AI-enabled SOC enough interesting-looking events to consume tokens, API quotas, enrichment and sandbox capacity, queue space and analyst attention. Defender cost grows with each event while attacker cost stays low. Poisoning the knowledge sources an AI SOC assistant retrieves from can also produce confident but wrong investigation summaries.
- Denial of Infrastructure: agent activity overloads shared services such as DNS, APIs, cloud resources and network paths. Examples are an SRE agent stuck in a recursive remediation loop and a crafted input that makes an orchestrator fan out to a dozen specialist agents. The result is a brownout (latency, throttled APIs, cloud spend spikes) that is hard to diagnose.
- Denial by Response: over-privileged agents cause damage through their own remediation, for example a service desk agent mass-resetting credentials during an identity provider outage, or an automated response quarantining the wrong network segment. Prompt injection or manipulated context could trigger this deliberately.
The article maps the building blocks to MITRE ATLAS, which lists cost harvesting, including a sub-technique for agentic resource consumption.
Remediation
Infoblox offers four principles and states that no single control stops ADoS:
- Decide early, where it is cheap, for example by blocking malicious destinations at the DNS query before expensive AI-driven investigation.
- Monitor agent behavior through DNS lookups and network flow records, including unregistered agents.
- Ground automation in trusted, authoritative asset data to avoid over-quarantine.
- Bound autonomy with budgets, rate limits, approval thresholds for high-impact actions and a kill switch, and keep foundational services such as DNS resilient.
Governance in the AI orchestration and identity layers remains necessary.