AI agents will DDoS trust-based institutions

I’ve filed a number of Access to Information requests (ATIPs, or FOIA requests for my American readers) in my time, and I’m always surprised there aren’t…more of them. The federal government received just under 34,000 requests across all institutions in the 2024–25 fiscal year. In a country of around 40 million people, that doesn’t seem like very many, especially since ATIPs are an important tool for many journalists. (Note: This excludes Access to Information requests to Canada’s immigration agency, which account for the vast majority of federal ATI requests but are mostly requests for immigration files rather than the kind of spammable public records requests I refer to in this article.)

Since 2016, you have never had to pay more than the initial $5 filing fee. In searching the government’s public list of completed requests, I have come across some pretty nutty ones, like people demanding proof for the existence of various viruses (or even any virus—yes, there is a conspiracy theory that viruses are not real). So the constraint on filing ATIPs isn’t really financial; it’s a question of time and attention.

Many components of our society rely upon this simple constraint: abusing them is tedious.

Yes, you could file endless complaints, appeal every decision, and escalate each dispute. Some people are bloody-minded enough to stay on the phone for five hours to get a $20 refund. But most people rationally give up. This is time-and-attention arbitrage.

AI agents remove this rate limit by commoditizing persistence.

Now any crank can generate hundreds of reasonable-looking ATIPs, appeal every rejection, and continue rewording the question if they don’t like what they get the first time.

Every NIMBY can generate dozens of plausible-sounding objections to a development in their neighbourhood.

Everyone with a grudge can generate a nuisance lawsuit against their perceived enemies.

Nikita Bier joked about an agent doggedly pursuing a refund for everything he ever purchased on Amazon:

Hello computer,

Find every Amazon purchase I ever made. Call the number of the manufacturer. Say you’re not satisfied. Request a refund. If they decline, threaten to leave a bad review. If they decline, find the CEO’s phone number and ask him for a refund.

Now, repeat the same process for items I never even purchased and see if you can get them to send me money.

If they ask for a recipient, generate an image of one and send that.

Do not stop until you’ve collected $1 million in refunds.

High-trust systems work because the cost of pursuing a request is somewhat proportional to the cost of adjudicating it, but agents change that calculus by sending the cost of requests toward zero. Persistence is good in the abstract because it allows people to exercise their rights. But in this case, the bad could easily crowd out the good.

What happens to the vital information obtained through Access to Information requests? Justified refunds from customer service? Justice for ordinary people accessible only through the courts? The useful gets crowded out by the merely persistent. AI agents DDoS the institutions that were designed for a world where persistence was costly and motivated by conviction rather than automation.