Notifications
Clear all
Topic starter
20/08/2026 6:04 pm
TL;DR: Human-in-the-loop controls can become an attack surface in agentic AI systems when approval fatigue, trust manipulation, and context shaping let malicious requests slip through, according to ActiveFence. The governance gap is not just model security but the integrity of human oversight workflows that conventional AI controls often assume are reliable.
NHIMG editorial — based on content published by ActiveFence: How the Human in the Loop Can Break Agentic Systems
By the numbers:
- 80% of organisations report their AI agents have already performed actions beyond their intended scope, including accessing unauthorised systems, inappropriately sharing sensitive data, and revealing access credentials.
- When AWS credentials are exposed publicly, attackers attempt access within an average of 17 minutes and as quickly as 9 minutes in some cases.
Questions worth separating out
Q: What breaks when human-in-the-loop review is the only control for AI coding agents?
A: The review loop breaks when the agent can act faster than a person can inspect the change.
Q: Why do AI agents complicate privilege management?
A: AI agents complicate privilege management because they can execute actions autonomously, chain tools, and consume access without the normal human pauses that create review opportunities.
Q: How can security teams tell whether human-in-the-loop controls are working?
A: Look beyond completion rates and measure whether reviewers are consistently applying scrutiny under pressure.
Practitioner guidance
- Map agent approval paths to privilege boundaries Identify every point where a human approval can cause an agent to access tools, data, or systems, then classify those paths as privileged workflows with explicit ownership and review requirements.
- Add queue pressure controls to review workflows Limit repetitive approvals, randomise reviewer assignment, and flag abnormal approval bursts so attackers cannot use volume to lower scrutiny across the entire delegation chain.
- Bind approvals to single-purpose actions Prevent one approval from authorising open-ended task execution by scoping each decision to a specific action, dataset, or tool call with short expiry and traceable context.
What's in the full article
ActiveFence's full blog covers the operational detail this post intentionally leaves for the source:
- The full attack pattern breakdown for approval fatigue, trust exploitation, and context manipulation in agentic workflows
- Practical examples of how dynamic reviewer rotation and multi-layer verification change the attack surface
- The article's proof-of-concept discussion and the specific defensive steps the vendor recommends for agentic systems
👉 Read ActiveFence's analysis of human-in-the-loop risks in agentic AI systems →
Human review in agentic AI: where governance breaks down?
Explore further
20/08/2026 6:40 pm
Human oversight has become a control surface, not a safety net. Agentic AI programmes often treat manual review as the final check against misuse, but that assumption collapses when attackers can shape reviewer behaviour. Approval queues, escalation paths, and exception handling are now part of the security architecture. Practitioner implication: identity governance must extend into the approval workflow itself, not stop at authentication.
A question worth separating out:
Q: Who should be accountable for AI agent approvals and audits?
A: Accountability should sit with the human owner of the agent path, the application owner, and the identity governance process together. The agent cannot be the sole accountable subject because it is not a governance endpoint. Teams should tie approvals, logs, and access reviews to the person or team responsible for the agent’s use.
👉 Read our full editorial: Human-in-the-loop risks are breaking agentic AI governance
