Humans Approve a Third of Dangerous AI Agent Commands, Browser Game Reveals
A deceptively simple browser game built to test how well developers can police AI coding agents has produced some genuinely uncomfortable data. After more than 40,000 runs, players were letting roughly one in three malicious commands sail through unchallenged. So much for humans being the last line of defence.
The game was built by Belgian developer Alex Wauters, who grew frustrated watching colleagues either rubber-stamp every permission prompt their coding agent threw at them, or bypass approvals entirely with Claude Code's '--dangerously-skip-permissions' flag. Neither approach seemed sensible. The game was his attempt to stress-test the middle ground.
The premise is straightforward. A simulated permission dialog appears on screen, styled to look like something you'd see from Claude Code mid-workflow. You have 60 seconds to approve or deny as many requests as possible. Approve a malicious one, lose points. Deny a safe one, also lose points. Time pressure is the whole point.
Across 409,000 individual command decisions, the results weren't flattering. Scope violations, things like an agent quietly requesting access to Kubernetes config files or AWS credentials lists, were the most commonly missed category, slipping past players 35 percent of the time. Curl requests to unfamiliar APIs and typosquatted packages fared almost as badly. Players were much sharper at catching blunt-instrument attacks: recursive deletion of the root directory or blanket read/write/execute permissions got flagged regularly. Subtlety, it turns out, works.
The single command that fooled the most people was 'npm run analyze', approved by nearly two thirds of players. This sounds innocuous because it is, usually. But it executes whatever script is defined in a project's package.json, meaning a compromised agent could point it at anything. The game even displays the script contents in the history log directly above the prompt. Most players ignored it anyway.
Wauters isn't surprised. The core problem is that approving agent actions in bulk is cognitively exhausting, and exhausted people make bad calls. An AI coding agent can generate permission requests at a pace no human can scrutinise sustainably. Once that fatigue sets in, the approval button becomes a reflex rather than a decision.
This isn't purely a game mechanic quirk either. Anthropic's own telemetry from Claude Code shows that users approve around 93 percent of all permission prompts in real-world use. The company noted that the more prompts someone sees, the less attention they pay to each one. Wauters' synthetic stress test is apparently a reasonable model of what happens in production.
At the other extreme, skipping permissions entirely isn't a serious security posture, it's just giving up. Wauters is clear that the tooling needs to improve rather than expecting developers to maintain perfect vigilance across multi-hour agent sessions.
Anthropic has made some effort here with Claude Code's auto mode, which uses a model-based classifier to catch what it describes as 'overeager' agent behaviours before they execute. It intercepts around 83 percent of these cases in internal evaluations, which still means roughly one in six gets through. Anthropic frames it as one layer within a sandboxed environment, not a replacement for proper security boundaries.
Wauters' practical advice is to run coding agents inside proper sandboxes or cloud-based devcontainers, use auto mode as a filtering layer rather than the only layer, and write hooks that catch high-risk actions before they queue for approval. The threat model for agentic coding tools is genuinely different from anything developers have had to think about before, and most teams haven't caught up with it yet.
The game is still live if you want to test your own reflexes. Most people find they're worse than they expected.