You Approve 93% of What Your AI Asks. That’s the Problem

TL;DR: Two days ago we told you to review what an AI agent does before approving it. New data suggests that advice, on its own, doesn’t work very well. In a browser game that put over 40,000 people in the approve-or-deny seat, players missed one in three dangerous commands — and telemetry from Claude Code reportedly shows real users approve 93% of the permission prompts they see. The fix isn’t to try harder. It’s to need the checks less.

What happened

Belgian developer Alex Wauters built a browser game that drops you into the job your AI coding tool gives you a hundred times a day: a command pops up, you have seconds, you approve or deny. Some commands are routine. Some quietly steal your credentials.

Across more than 40,000 runs and 409,000 individual decisions, the results were not flattering:

• Mean accuracy: 66.3% — players missed roughly one in three threats.
• Only 35.2% caught every threat, and just 20.8% managed that without also blocking piles of harmless commands.
• The danger is inversely proportional to how dangerous it looks:

Type of malicious command	How often it was missed
Obviously destructive (e.g. wiping a drive)	11.7%
Persistent changes	23.8%
Stealing data / running code	33.4%
Reaching outside its remit	35.0%

The single worst performer was a command called `npm run analyze` — approved 64.7% of the time. It looks utterly routine. That’s exactly why it worked.

The Register adds the detail that should give everyone pause: telemetry from Claude Code reportedly shows users approve around 93% of permission prompts. As Wauters puts it, “the more approvals a user sees, the less attention they pay to each.”

One honest caveat: this is a self-selected browser game played under a 60-second timer, not a controlled study of people doing real work. The time pressure probably makes results worse than reality; the low stakes probably make them better. And the commands tested are developer-level. Treat the exact percentages as indicative, not gospel — the direction of travel is the point.

Why it matters if you don’t code

You might look at `npm run analyze` and think none of this applies to you. The specific commands are developer territory — but the moment being tested is not. Every time Cursor asks to connect to your Gmail, or Claude Code asks to run something, or any AI tool shows you an “Allow?” box, you are the human in the loop this study is about. And the finding is that being the human in the loop is a weaker safety net than it feels.

Worse, the pattern that fools people is the one non-developers are most exposed to: threats that hide behind ordinary-looking names. If you can’t read the command anyway, “does this look normal?” isn’t a check you can meaningfully perform.

So here’s our correction. We’ve been telling readers to review AI actions before approving them — most recently on Wednesday. We stand by it as far as it goes, but this research shows it’s necessary rather than sufficient, and we’d rather say so plainly than let good-sounding advice do more work than it can carry. Vigilance degrades. It degrades fastest exactly when you’re busy and being asked most often.

What actually helps

The useful shift is from catching bad things to making bad things impossible. In rough order of how much they help for a non-developer:

1. Reduce what the agent can reach. This is the one we keep coming back to, and this study is the strongest argument for it yet. An agent connected only to the files it needs can’t leak the ones it never had. Choose narrow permissions at setup, when you’re calm and paying attention — one careful decision beats a hundred rushed ones.
2. Keep credentials out of reach entirely. Passwords, API keys and payment details shouldn’t live in projects you hand to an AI. The Grok CLI incident made this point the hard way; this study explains why “I’d notice” isn’t a plan.
3. Prefer tools that check for you. The research points to model-based classifiers — Anthropic’s auto mode reportedly catches about 83% of problematic behaviour — plus sandboxing that limits blast radius. That’s a genuine reason to favour tools that do this work automatically.
4. Treat a flood of prompts as a warning sign. If a tool asks constantly, that isn’t diligence, it’s noise that trains you to click yes. Fewer, more meaningful prompts is a better design — and a fair thing to weigh when picking tools.
5. Never switch the checks off. Some tools offer flags that skip approvals entirely to stop the interruptions. Understandable, and exactly backwards.

Who should care (and who shouldn’t)

• Using Cursor, Claude Code, or any tool with agent permissions: the most relevant group — revisit what you’ve connected rather than relying on in-the-moment vigilance.
• Building with Lovable, Bolt or Replit: fewer raw command prompts, but the same logic applies to what you connect and what secrets your project holds.
• Anyone who’s ever clicked “Allow” without reading it: which is nearly everyone. That’s the finding, not an accusation.
• Not yet building: nothing to act on — the quiz will point you at a tool, and good habits are easier to start early than to retrofit.

Our take

We like this research because it’s uncomfortable for the standard advice, including ours. “Keep a human in the loop” has become the reassuring thing everyone says about AI agents — and it turns out the human in the loop approves 93% of what they’re shown and misses a third of the genuine threats. That’s not a moral failing. It’s what happens to any person asked to make hundreds of rapid judgement calls about things they can’t fully see.

The honest conclusion isn’t “be more careful”, because that advice has a poor track record. It’s that the decisions worth agonising over are the ones you make once, at setup — what this tool can reach, what secrets exist near it, whether it sandboxes its own work. Get those right and the hundred rushed approvals matter far less. That’s the same minimum-access principle we’ve been circling for a month, now with numbers behind it.

Not sure which AI tool fits how you build? Take the 60-second Vibe Coding Tool Finder quiz → then set its permissions narrowly on day one.

FAQ