Study: Humans Approve 1 in 3 Malicious AI Coding Agent Commands in Browser Game Test

A browser-based game designed to test how well humans catch dangerous AI coding agent commands has produced a troubling result: players approved roughly one in three malicious requests on average, according to data from more than 40,000 game runs.

The game, built by Belgian software developer Alex Wauters, simulates the permission prompts that tools like Claude Code generate as they execute multi-step workflows. Players get 60 seconds to approve or deny a stream of simulated requests, with points deducted for wrongly approving dangerous commands or wrongly denying safe ones. Wauters published the results in a blog post this week, drawing on more than 409,000 individual approve/deny decisions collected since the game's late-May launch.

The numbers

Scope violations — requests like reading Kubernetes config files or AWS credential lists that could enable data exfiltration — were the most commonly missed category, slipping past players 35 percent of the time. Curl requests to unknown APIs and typosquatted package installs were caught at nearly as low a rate.

Obviously destructive commands fared better: things like rm -rf on a root directory or recursive full read/write/execute permission grants were caught most often, as were crontab injections and git config hijacks.

The single most frequently missed command was npm run analyze, approved by nearly 65 percent of players despite the game displaying the actual contents of the underlying package.json script in a history log. According to Wauters, this indicates players are not reading the context provided just above the approval prompt closely enough before clicking through.

This pattern isn't confined to a browser game. Anthropic disclosed in a May post that telemetry from real Claude Code usage shows users approve around 93 percent of permission prompts. The company stated that "the more approvals a user sees, the less attention they pay to each, becoming over time much less diligent in their supervision."

Why this happens

Wauters built the game after observing developers increasingly reaching for the --dangerously-skip-permissions flag in Claude Code to avoid interrupting long-running agent workflows — a shortcut that removes human oversight entirely. The alternative, manually reviewing every action, creates what Wauters calls fatigue: reviewers lack context on what has actually changed and cannot easily judge risk under time pressure.

He told The Register that agents can attach arbitrary payloads to commands that appear benign on the surface, meaning a cautious reviewer would need to inspect every file an agent wants to call — a time cost that undermines the productivity benefit of using an agent in the first place.

What Anthropic and others are doing

Anthropic's response has been "auto mode," a model-based classifier in Claude Code that delegates some approval decisions automatically. According to Anthropic, it catches roughly 83 percent of what the company terms "overeager behaviors" before execution — implying about 17 percent still get through in its own evaluations. Anthropic describes auto mode as "one layer of defense-in-depth inside a sandbox, not a substitute for one."

Wauters' recommendation aligns with that framing: run coding agents inside sandboxes or cloud-based devcontainers, layer in classifier tools like auto mode, and write hooks that contextualize potentially malicious actions before they reach a human or automated approver.

What this means

This research — however informal its browser-game methodology — corroborates a pattern security teams have flagged repeatedly: human-in-the-loop review degrades under volume and repetition. With approval rates near 93 percent in production Claude Code usage and roughly a third of malicious test commands slipping past attentive game players, the message is consistent across both casual and real-world settings. Relying on manual approval as a primary safeguard for agentic coding tools is not a durable security model. The near-term fix isn't better human vigilance — it's sandboxing, scoped permissions, and automated classifiers that reduce how often a human needs to make a judgment call at all.