# Human Approval Fatigue Exploitation

- **Severity:** Medium
- **Signature ID:** `644ecefe-6817-4fd8-b3b4-40dcb339d5d9`
- **MITRE ATLAS:** AML.T0051 (LLM Prompt Injection)
- **OWASP:** ASI09 (Traceability and Accountability Gaps), LLM01 (Prompt Injection)

## Summary

Some AI agents ask a human to approve risky actions before doing them. This detects attempts to game that safeguard by flooding approvers with requests, downplaying risky actions as routine, or hiding a dangerous action inside a batch of harmless ones. The goal is to get a human to rubber-stamp something they would have blocked if they'd looked closely.

## How the attack works

An attacker (often via a prompt injected into content the agent processes) instructs the agent to generate many permission requests in quick succession, wearing down the approver's attention. Alternatively, the agent is told to phrase a dangerous action using minimizing language, like calling a destructive operation 'routine' or 'standard cleanup', so it doesn't stand out. A third variant bundles one risky operation into a batch alongside many benign ones, betting the human approves the whole batch at once rather than reviewing each item. In all three cases the human's approval becomes a formality rather than a real check.

## Why it matters

A human approver waves through a destructive, costly, or data-exposing action they never actually evaluated, because the approval process was overwhelmed or misled rather than bypassed outright.

## What you can do

- Require individual review and approval for actions above a defined risk level; don't allow bulk approval to cover high-risk items.
- Rate-limit or flag unusually frequent approval requests from the same agent or session for human review.
- Flag language that minimizes an action's risk (e.g. 'routine', 'standard', 'just a cleanup') when attached to destructive or irreversible operations, and require plain description of what the action actually does.
- Log and separately audit which approvals were granted individually versus as part of a batch, so bulk-approved risky actions can be spotted after the fact.

## Known benign look-alikes

- CI/CD systems with legitimate auto-approve workflows
- Bulk operation tools with appropriate safeguards described
- Medical triage documentation describing a patient's condition as 'routine' or 'standard' in clinical notes
- User interface accessibility guide instructing users to 'press accept for all cookies' in a browser tutorial

## References

- https://agentthreatrule.org/en/rules/ATR-2026-00118

---
Source: https://www.netzilo.com/threats/atr-human-approval-fatigue-exploitation