Agentic flooding

How agentic flooding works

AI makes a request cheap to write. The cost to read it stays the same. The paper of Schmitz, Hammond and Chan (arXiv, August 2026) names two types:

Type	What grows	Share of the 84 cases
Quantitative flooding	The number of requests	60% (50 cases)
Qualitative flooding	The length and complexity of each request	90% (76 cases)
The two together	Number and complexity	50% (42 cases)

AI agents must cause the surge, and the surge must strain the service. A consumer language model chatbot counts as an AI agent.

Why agentic flooding matters

The highest near-term risk is at “financially attractive services where complex submission requirements have historically suppressed demand”. Court claims and tax returns are the examples of the authors.

The two types of response each have a cost:

Response	Examples	Cost
Stop demand	Fees, rate limits, requests in person	Stops fair users too
Add capacity	More staff, AI tools, new interfaces	Slow, and needs money

Governments responded in 56% of the 84 cases: friction in 17%, their own AI tools in 25%. Friction “disproportionately deters poorer, less digitally literate, and otherwise vulnerable users”, the authors write.

In practice

The study scanned 13 service domains in 11 jurisdictions. From 2288 candidate services, 84 cases passed the test. Officials themselves say AI is involved in 58 of the 84 (69%).

Examples from the paper and the reports on it:

• German social courts: some courts largely put a 55% increase in caseload in 2025 down to AI-generated claims. Some letters had more than 4000 pages.
• Australian FOI requests: the government thought about fees again, after “a wave of AI-generated submissions”.
• Dutch property tax objections: the Hertie School reports a 400% increase in one municipality. The increase came after a commercial AI platform started.
• UK: Money Claims Online, and Regulation 18 and 19 Local Plan consultations (Local Government Lawyer, September 2026).

The near-term steps of the authors for governments:

1. Audit which services are open to flooding.
2. Add digital identity to the most exposed services.
3. Make clear which resilience measures are legal.

Limits of the data

The authors give three limits. The data gives no statistical claim about prevalence and no causal claim about the role of AI. Their pipeline collects only positive cases. They “cannot exclude the risk of LLM hallucination” in it.

The counts also changed. Before the preprint, the Hertie School gave 93 examples across 11 countries. The preprint gives 84 cases. The 400% Dutch figure is in the Hertie School report, not in the text of the paper.

Questions and answers

Is agentic flooding an attack?

Usually not. Schmitz, Hammond and Chan found that most of their 84 cases show ordinary users in good faith. Some show persons in bad faith, who want money or an advantage. A small number are organized campaigns, such as mass freedom of information requests.

How is agentic flooding different from denial of AI service?

Denial of AI service puts too much load on an AI system. Agentic flooding is the opposite. Persons use AI to send too much work to a court, a tax office or a regulator.

Does agentic flooding need autonomous agents?

No. The definition includes consumer chatbots. In 87% of the cases in the August 2026 study, LLMs help to make legally sophisticated text at low cost.