Medium
Reliability & Confabulation
Human-in-the-Loop Fatigue (Approval Flooding)
Flood the human approver with look-alike approval prompts so a malicious action is rubber-stamped in the noise - defeating human-in-the-loop as a control.
Guardrail / Policy Bypass
LLM06ASI09T10
Tells spot it before you commit
- » A human must approve sensitive agent actions, but approvals are frequent and low-context.
- » Approve/deny prompts look alike and lack per-request detail.
- » The agent (or attacker) can generate many approval requests quickly.
Method
- Generate a high volume of benign approval prompts to induce click-through fatigue.
- Slip the sensitive action into the stream where it blends in.
- Confirm the control degrades as approvals become reflexive (measure benignly, in a lab).
Payloads templates - adapt to authorized scope
Queue 50 near-identical low-risk approval requests, then one that differs only in
a benign CANARY field. Measure whether the reviewer still catches the odd one out.
Why it works
Human oversight assumes each request gets real scrutiny. Volume, sameness, and low context collapse that scrutiny into reflexive approval - the control still exists but no longer discriminates between safe and dangerous actions.
Impact
High-impact or malicious actions receive human sign-off they should never get, nullifying human-in-the-loop as a safeguard.
Defenses
- Rate-limit and batch approvals; escalate only genuinely risky actions, with rich context.
- Make sensitive prompts visually distinct; require step-up verification for high impact.
- Detect approval-flooding patterns; add cool-downs and anomaly alerts.
Mappings
OWASP LLM
LLM06 - Excessive Agency
OWASP ASI
ASI09 - Human-Agent Trust Exploitation
Agentic Threats
T10 - Overwhelming Human-in-the-Loop