“As human-in-the-loop, you’re the last line of defense,” Belgian software developer Alex Wauters wrote when he launched a browser game in late May to test whether people can reliably approve or deny AI coding-agent commands under time pressure.
The browser game and its headline findings
Wauters’ game presents simulated permission prompts like those a user might see from Claude Code. Players have 60 seconds to approve or deny as many requests as they can; okayed security risks and denied safe commands both subtract from a player’s score. Across more than 40,000 runs and roughly 409,000 approved and denied commands, the aggregate result was stark: players approved roughly one in three malicious requests on average.
Wauters himself stressed that the game contains a much higher proportion of malicious prompts than most day-to-day developer workflows would, but he framed the test as a probe of human judgement under fatigue and noise. “The high amount of noise introduces fatigue, and developers don’t always have the context of what has changed to quickly determine the risk,” he wrote.
Which dangerous commands slip through — and which are stopped
The most commonly missed class of risky behavior were scope violations — for example an agent asking to cat Kubernetes config files or lists of AWS credentials — which were missed about 35 percent of the time. Other frequent misses included curl requests to unknown APIs and typosquatted packages.
By contrast, obviously destructive commands were most often caught. Players frequently denied commands such as rm -rf on the root directory and requests to recursively grant full read/write/execute permissions on the same location. Crontab injections and git config hijacks were also frequently caught in the game.
Wauters highlighted one concrete example that slipped past players repeatedly: npm run analyze was approved nearly 65 percent of the time, despite the prompt’s history log showing what that script contained. “Two thirds of players approved it anyway, indicating the history log just above the permission prompt may not be read closely,” he wrote.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadApproval fatigue and what Anthropic’s telemetry shows
Wauters described a familiar trade-off: either ask users to inspect every single action an agent proposes — a time-consuming requirement — or reduce the number of prompts and risk missing attacks. He reported seeing developers adopt flags like --dangerously-skip-permissions because they did not want long agent workflows stopped minutes in.
Anthropic’s own telemetry provides corroborating data. In a May post about containing Claude, Anthropic said that users approve around 93 percent of permission prompts. “The more approvals a user sees, the less attention they pay to each, becoming over time much less diligent in their supervision,” the company wrote.
To address that problem, Anthropic also built a model-based classifier called Claude Code auto mode. Anthropic said auto mode catches roughly 83 percent of what it calls “overeager behaviors” before execution — meaning about 17 percent still get through in its evaluation — and characterized auto mode as “one layer of defense-in-depth inside a sandbox, not a substitute for one.”
What this means for developers, security teams, and platform vendors
- Developers and product teams: Wauters warned that handing over complex tasks to agents and only reviewing changes at the end is “a recipe for disaster.” Developers will have to balance productivity gains against the time sink of investigating every file an agent touches — or risk approving dangerous actions to avoid halting long-running flows.
- Security teams and technologists: The game's results underline the limits of relying solely on humans-in-the-loop. Wauters recommended running coding models in sandboxes and devcontainers in the cloud, and writing hooks to contextualize potentially malicious actions before they execute.
- Platform vendors (Anthropic and others): Anthropic’s auto mode demonstrates one mitigation path, but its own data shows a nontrivial residual risk (about 17 percent). Vendors will face pressure to harden permission models, improve classifiers, and integrate sandboxing and contextual checks as part of default agent workflows.
Conclusion — permission models, tooling, and the remaining gap
Wauters’ experiment is a blunt measurement: under time pressure and noisy prompts, humans allowed roughly one-third of malicious agent commands through. Anthropic’s telemetry and auto mode sit on the other side of the same ledger — very high human approval rates in real use, and a model-based filter that still lets about 17 percent of overeager behaviors pass.
Wauters’ prescription is pragmatic: better permission models, sandboxes and devcontainers, tooling that contextualizes actions, and hooks that catch risky behavior before automatic approvals. His closing note was practical and stark: “It’s a whole new world with a new set of attack vectors. It’s best to remain aware of the risks and know how to reduce them.”
Will vendors and teams adopt those measures quickly enough to close the gap between a third of malicious commands slipping past human reviewers and the 17 percent of overeager behaviors that automated filters still miss? The game’s numbers suggest that the answer will determine how safe — or brittle — coding agents become in practice.
