What Is Agentic Flooding? The Surge in Government Service Requests and the Intake Controls That Absorb It

Agentic flooding is the AI-linked surge in the volume or complexity of requests an organisation receives — a surge that strains its intake capacity and is enabled by AI lowering the cost of interacting with it. Researchers have documented 84 cases across 11 jurisdictions and 13 service domains.

The count comes from a preprint by Chris Schmitz, Lewis Hammond and Alan Chan, due at the AAAI Conference on AI, Ethics, and Society on 12–14 October 2026 and reported by TechCrunch on 10 September 2026. The cases are agentic flooding of government services; the reason to read them is the shape of the problem: when filing becomes nearly free, submission cost falls and review cost does not.

What agentic flooding is — and what it is not

The authors describe what they can document rather than measure: “We document 84 cases across 11 jurisdictions and 13 service domains.” That 84 is a strict subset, not a sample: of 2,288 candidate services named during discovery — roughly 190 per country — fewer than one in twenty met all three inclusion criteria. It cuts both ways: the pattern is documented widely enough to plan for, but 84 is not a rate you can multiply.

• Cheap text, not clever automation. Filings are legally sophisticated and longer than a person would send; one documented case involved letters that “spanned over 4000 pages”.
• Volume and complexity rise together. The authors code 50 of 84 cases (60%) as quantitative flooding and 76 (90%) as qualitative, half as both.
• The name is not settled. TNO Vector, writing with Schmitz, calls the same phenomenon Service Flooding. Search both terms.

Why are government complaints rising? The numbers behind 84 documented cases

Each figure comes from the preprint, the authors' case database or the primary record on the right.

When AI agents overwhelm public services — and every other intake queue

Submitting is near-free for the sender; reviewing is priced in human minutes. That is the pattern reported from bug-bounty intake, where inboxes filled up with low-quality LLM-written reports that rarely contained a real vulnerability — as TechCrunch reported in July 2025 — while the obligation to vet each one stayed. The cost was never the report; it was the review.

Two findings keep this from being a simple abuse story. The volume is largely legitimate: Schmitz says “the vast majority of cases we find are people who are entitled to claim for something, claiming for that thing.” And friction has a distributional cost — the paper notes that “friction disproportionately deters poorer, less digitally literate, and otherwise vulnerable users.” His framing of the response is the useful one: “This could be the moment to say, ‘we need to rethink pretty much everything about how this process looks.’” That is an intake-design project, not a blocklist.

Agent flooding intake controls that absorb machine traffic

Six control families carry most of the weight. None requires you to identify “bad” agents.

1. Rate limits keyed on identity, not IP address

Per-IP limits assume distinct senders sit at distinct addresses, which distributed agent traffic breaks. Limit per account, declared agent, domain and form, and log which key fired.

2. Prove-work requirements

When submission cost falls below review cost, raise the submission floor rather than the review ceiling: structured fields, a required evidence attachment, or a staged funnel. Every gate drops some legitimate filers too, so pair each one with the friction warning.

3. Tiering and quotas

Entitlement-based intake answers the Hessian intensive-petitioner pattern, where MPs stated one submitter accounted for about 800 of 2,641 petitions in a year. Quotas per account or matter, with a route for genuinely new issues, keep a queue representative.

4. Idempotent intake and deduplication

The CFPB's report names “duplicative and spurious submissions” as the failure it tracks. Deduplicate on content fingerprint plus submitter, and make receipt idempotent so an agent retry does not open a second case.

5. Escalation design without a human on every item

A single review queue makes every item cost the same. Split intake into self-service resolution, standard review and high-touch handling, then measure the share each tier absorbs — that number shows when flooding is underway. Our human checkpoints checklist covers where a person must stay in the loop.

6. Agent identity and provenance

You cannot manage what you cannot separate. Authenticate machine submitters, honour declared agent identity, and record whether a submission was human-authored, agent-assisted or agent-generated. Agent identity governance is the underlying control; intake logging makes it measurable.

Audit checklist: agent flooding intake controls

Work through this one queue at a time; each question should produce a finding, not a yes.

1. Inventory every public intake — forms, mailboxes, portals, support addresses and API endpoints.
2. Name the rate limit and its key for each: per IP, account, agent, domain or none. “None” is the finding.
3. Can you tell a declared agent from a human submitter? If not, that is finding number one; every other control depends on it.
4. Is receipt idempotent? Submit the same item twice and confirm it creates one record.
5. Do you deduplicate on content and submitter? Submitter-only misses reworded filings; content-only misses coordinated resubmission.
6. What does one submission cost in review minutes, and has cost per item moved? Volume up with flat cost is capacity; rising cost per item is flooding.
7. Is there a quota or tier policy, and who is exempt? Every exemption is a lane agent traffic can occupy.
8. Which friction controls exist, and who do they deter? Check the effect on less digitally literate and vulnerable filers before widening a gate.
9. Does any escalation path avoid opening a human task? If not, queue depth scales with intake volume.
10. Can you produce 12 months of volume by week, channel and declared agent type? Without that series an auditor gets an anecdote, not a trend.

Two of those controls — per-agent budgets with hard caps and idempotent retry handling — also belong in your spend review: see the AI spend governance audit and the parent AI agent risk checklist.

Run the free AI audit

Frequently asked questions