A browser-based game designed to test how well humans can safely approve AI coding agent requests suggests the human in the loop is a weaker gatekeeper than hoped. Across more than 40,000 runs and 409,000 approved or denied commands, players approved roughly one in three malicious requests, according to data published by the game’s builder, Belgian developer Alex Wauters.
Scope violations were the most commonly missed category, at 35 percent, including agents asking to read Kubernetes config files or AWS credential lists. The single most frequently approved dangerous command was npm run analyze, let through nearly 65 percent of the time even though it can execute anything defined in a project’s package.json. Obviously destructive commands such as rm -rf were caught most often. Wauters points to approval fatigue: the more prompts a user sees, the less attention each one gets, a pattern Anthropic’s own telemetry supports, with Claude Code users approving around 93 percent of permission prompts.
Wauters argues that pointing to human review as a solution is insufficient and calls for sandboxes, devcontainers, auto mode, and hooks that contextualize risky actions before they run. Anthropic’s model-based classifier catches roughly 83 percent of what it calls overeager behaviors, leaving about 17 percent through in its own evaluation.
