There is a way to win an argument at work without making a single point: send more text than the other side can read. A status update that should have been a paragraph arrives as a forty-page document, the project plan has grown an appendix with an appendix of its own, and somewhere around page 31, inside a table nobody will scroll to, sits the one line that mattered. Nobody lied. Everything is technically there. The habit has acquired a name that I suspect will stick, slop bombing, the practice of stunning the other party with blows of text.

I want to take the name seriously, because it describes something my field has been dealing with for a long time under other labels, and because generative AI has changed the economics in a way that deserves a closer look.

cover

In brief

  • Slop bombing is the use of cheap, voluminous text to exhaust, distract or conceal, and generative AI made it practically free.
  • It works because writing now costs almost nothing, while reading, checking and deciding cost exactly what they always did.
  • Security teams know the pattern from alert fatigue and compliance paperwork, and the countermeasures they use there transfer well to ordinary office life.
  • Asking an AI assistant to summarize the pile is a partial answer at best, and it adds a new attack surface.

The price of a page has collapsed

For most of the history of office work, length was an honest signal. Producing eighty pages took days, so an eighty-page document told you that somebody had invested real effort, even if the effort was misdirected. That natural rate limiter is gone. A language model will produce eighty pages of fluent, confident, well-formatted prose in the time it takes to refill a coffee mug, and the result looks exactly like the work of someone who has been busy.

The consumer internet got there first. Merriam-Webster picked slop as its 2025 word of the year, defining it as low-quality digital content produced in quantity with the help of AI, and the editors made a point of mentioning the reports that waste colleagues’ time. That is the corporate side of the same phenomenon, which researchers at BetterUp Labs and the Stanford Social Media Lab named workslop in a Harvard Business Review article from September 2025: work that looks polished and contains nothing that moves the task forward. Their survey of 1,150 American workers found that 41 percent had received some in the previous month, that each episode cost the recipient close to two hours, and that the self-reported cost worked out to roughly 186 dollars per employee per month. A follow-up piece from June 2026 by Matthias Holweg and Thomas Davenport pushes the idea further, arguing that the accumulation of such material erodes a company’s collective knowledge, a process they call knowledge decay. Both studies rely on people estimating their own lost time, so the figures deserve some scepticism, but the direction of the mechanism is hard to dispute: the effort moves from the person who writes to the person who reads.

I have seen the same asymmetry in a very different place. In my recent piece on what Torvalds got right about AI and programmers, the uncomfortable part was that an assistant makes a patch nearly free to produce and leaves the cost of reviewing it exactly where it was. Swap the patch for a quarterly report and you have the whole problem of this article.

Workslop is mostly innocent, the product of a tired employee and a convenient button. Slop bombing is the same output with a motive attached.

Three ways to bury a message

The motives come in three varieties, and each one is familiar to anyone who has spent a couple of decades inside large organizations. The first is the person who has to look productive at any cost. When the only visible metric is output, output gets maximized, and a thousand words per day is a lot easier to display than a single good decision. This is a cousin of what I described in the tyranny of personal bests, where the number on the wrist replaces the reason for running, and of the “pseudo-productivity” I discussed in strategic disconnection. A document count is just a step count for people in meetings.

The second motive is more mischievous. Somebody keeps asking for updates, and the answer is a package so large that the asking stops. It is malicious compliance in its purest form, because the request was formally satisfied and the requester has been punished for making it. The third motive is the sharpest: place the awkward fact in a sea of other facts and trust that the reader’s attention will run out before the sea does.

None of this is new as a tactic, only as a price point. Brandolini’s law says that refuting nonsense takes an order of magnitude more energy than producing it, and debaters have a name for the practical application, the Gish gallop, in which the speaker fires so many claims that the opponent cannot answer them all and the unanswered ones are then declared won. Slop bombing is a Gish gallop in document form, with the useful property that the galloper never has to stand on a stage. The line on page 31 later becomes “it was disclosed in the documentation”, which is true in the way a needle is disclosed in a haystack.

The legal world noticed this long before language models arrived. The US rules of civil procedure on producing documents require a party to hand over material as it is kept in the usual course of business or to organize and label it by the categories requested, which suggests that burying the other side in boxes was a known move long before anyone had a chatbot. Corporate life has no equivalent rule, which is why it falls to individual readers to improvise one.

Security people have been here before

My own profession keeps a museum of cases where the signal was present and nobody saw it. The classic is the 2013 breach of Target. The monitoring tools did their job and raised alerts about the malware being installed and about where the stolen data would be sent, and a Senate committee staff report concluded that the company had missed a series of opportunities to stop the attackers. Commentators at the time speculated that the security team had been buried under holiday-season volume and an avalanche of other alerts, which is a plausible reading even if nobody can prove it. Target was not slop bombed by anyone, and that is exactly the point. Once the flow of text exceeds the capacity to read it, the result is identical whether the flood is hostile or merely careless.

Incident reports show the same problem from the inside. I argued in Every log must fire that a good report treats telemetry the way a good playwright treats props: whatever is introduced has to matter by the end. A report that pastes in every artefact the tooling produced is a slop bomb launched at oneself, because the board, the lawyers and the insurer will not be able to distinguish the finding from the furniture. The analyst who attaches four thousand lines of output looks thorough, but has postponed the hard part and handed it to somebody with less context.

Regulation can make the incentive worse. Under NIS2 an entity must send an early warning within 24 hours of becoming aware of a significant incident, a fuller notification within 72 hours and a final report within a month, as laid out in Article 23 of the directive. I covered the business consequences in incident response is a business decision, and one thing I did not stress enough is that a deadline regime rewards whoever delivers something on time, and the cheapest something is a heap. A seventy-page submission with the real assessment on page 52 satisfies the calendar. Whether it satisfies the purpose is a separate matter, and the party who has to read it is usually outnumbered by the parties who write.

When the reader is a model

The part I find most interesting is what happens on the receiving side. When things go well, the recipient feeds the whole package to an AI assistant and asks for a summary. This is a perfectly rational response, and it creates a curious loop in which one model expands a few ideas into forty pages and another model compresses them back into five lines, while no human reads the middle. Two lossy transformations in sequence, and the output is whatever happened to survive both.

Forensic examiners have a strong instinct about this. You work from the original, or from a verified copy of it, because every derived artefact is somebody’s interpretation of the evidence. A summary is the least verifiable derived artefact there is, and yet it becomes the document of record the moment the decision gets made on it, while the original is demoted to a kind of background exhibit.

There are also reasons to doubt that the summarizer will find the thing you most need. The research paper Lost in the Middle showed that language models used information from the beginning and the end of a long input far better than information buried in the center. Long-context handling has improved a great deal since that study, so I would not treat it as a law of nature, but I would also avoid betting a decision on page 31 being read as carefully as page 1. The structure of a slop bomb, an impressive opening, a conclusion that sounds sure of itself and a large middle, happens to fit that weakness rather well.

Then comes the part where my day job starts to itch. A document written for a model to ingest is a delivery channel for indirect prompt injection, the technique of planting instructions in content that an assistant will process, listed at the top of the OWASP risks for LLM applications. A long, tedious attachment is the ideal host, since no person will ever scroll through it and a sentence in tiny or white text addressed to the assistant will not be seen either. I wrote about the wider question of who answers for what an autonomous system does in the ghost story the industry tells about AI agents, and the lesson carries over: somebody has to answer for what a delegated system does with whatever it reads.

Defenses that cost nothing and annoy everyone

We will eventually find new ways to produce and consume information, of that I am sure. In the meantime the practical options are mostly social, which is awkward for people like me who prefer a firewall rule.

The first is to ask for the decision rather than the document. Every submission should open with a short paragraph stating what has changed since last time and what is needed from the reader. If the author cannot write that paragraph, the length of the document is the least of the problems, because the author has probably not finished thinking. The second is to make the sender own the short version. The kernel has a useful precedent: the machine may type, but a human signs, and the signature is where responsibility sits. A one-page summary with a name under it turns “it was in the appendix” into an uncomfortable sentence to pronounce.

The third is to treat volume as data. Anyone who has interviewed a witness learns to notice when a simple question receives a long answer, and the same instinct works on documents: if the request got sharper and the response got bigger, that tells you something about the content before you have read a word. Asking for a diff against the previous version belongs in the same family, since the genuinely new material in a four-hundred-page revision is rarely four hundred pages.

When an AI assistant is involved, use it as an index and never as an oracle. Ask it to list every claim about risk, delay, cost, exception or incident together with the page where it appears, then read those pages yourself, and search the raw text for the words that tend to carry bad news. Plain keyword search is boring technology and it has the one property that matters here: it cannot be talked out of finding the word.

Finally, there is the option of simply declining. A reader can state that the first three pages are what has been submitted and that the rest is reference material. It costs some political capital, and I admit it is a bit rude, but it is cheaper than reading everything and far cheaper than being surprised later.

I suspect the lasting solution will be the unglamorous one, with shorter documents, clearer ownership and fewer rituals that reward the appearance of work. The corporate world has always dressed itself in rationality without quite being rational, and this latest practice is a fine example of the genre. Until the new etiquette arrives, if you receive two hundred pages in reply to a question you asked in a single line, start reading from the middle.

FAQ

What is slop bombing?

It is the deliberate use of large amounts of low-value, often AI-generated text to overwhelm a reader, delay a decision or hide an inconvenient detail among harmless ones.

How is it different from workslop?

Workslop is low-quality AI output that someone sends carelessly, and the cost lands on the recipient by accident. Slop bombing uses the same kind of output on purpose, as a tactic.

Does asking an AI to summarize the document solve the problem?

Only in part. A summary can miss material buried in the middle of a long text, and a document written for an assistant can carry hidden instructions aimed at it. It works better as an index to the original than as a replacement for it.