Human Approval Fatigue Exploitation
Some AI agents ask a human to approve risky actions before doing them. This detects attempts to game that safeguard by flooding approvers with requests, downplaying risky actions as routine, or hiding a dangerous action inside a batch of harmless ones. The goal is to get a human to rubber-stamp something they would have blocked if they'd looked closely.
How the attack works
An attacker (often via a prompt injected into content the agent processes) instructs the agent to generate many permission requests in quick succession, wearing down the approver's attention. Alternatively, the agent is told to phrase a dangerous action using minimizing language, like calling a destructive operation 'routine' or 'standard cleanup', so it doesn't stand out. A third variant bundles one risky operation into a batch alongside many benign ones, betting the human approves the whole batch at once rather than reviewing each item. In all three cases the human's approval becomes a formality rather than a real check.
Netzilo detection
Netzilo reports this behaviour when it is observed.
- Signature ID
- 644ecefe-6817-4fd8-b3b4-40dcb339d5d9
- Severity
- Medium
Why it matters
A human approver waves through a destructive, costly, or data-exposing action they never actually evaluated, because the approval process was overwhelmed or misled rather than bypassed outright.
What you can do
- →Require individual review and approval for actions above a defined risk level; don't allow bulk approval to cover high-risk items.
- →Rate-limit or flag unusually frequent approval requests from the same agent or session for human review.
- →Flag language that minimizes an action's risk (e.g. 'routine', 'standard', 'just a cleanup') when attached to destructive or irreversible operations, and require plain description of what the action actually does.
- →Log and separately audit which approvals were granted individually versus as part of a batch, so bulk-approved risky actions can be spotted after the fact.
Known benign look-alikes
- CI/CD systems with legitimate auto-approve workflows
- Bulk operation tools with appropriate safeguards described
- Medical triage documentation describing a patient's condition as 'routine' or 'standard' in clinical notes
- User interface accessibility guide instructing users to 'press accept for all cookies' in a browser tutorial