A browser-based game simulating AI coding agent permission prompts collected data from over 40,000 runs and 409,000 commands, revealing that humans in the loop approve roughly one in three malicious requests. Scope violations — like agents requesting access to Kubernetes config files or AWS credentials — were the most commonly missed at 35%. The single most-missed command was 'npm run analyze', approved 65% of the time despite being able to execute arbitrary scripts. Anthropic's own telemetry shows users approve ~93% of Claude Code permission prompts, with approval rates rising as fatigue sets in. Claude Code's auto mode catches ~83% of overeager behaviors but is designed as one layer of defense-in-depth, not a standalone solution. The takeaway: human-in-the-loop approval is insufficient on its own, and developers need sandboxes, devcontainers, auto mode, and custom hooks to meaningfully reduce risk from AI coding agents.
Table of contents
How humans in the loop failControlling coding agentsBug in top AI coding agents shows that Unix-era security headaches never really dieMeta wants to get inside your terminal with its new coding agentPrompt injection isn't the bug, AI agent frameworks areClaude Code bypasses safety rule if given too many commandsQuestions this post answers
How often do humans miss dangerous AI coding agent permission requests?
Humans approve roughly one in three malicious AI coding agent requests. In a study of over 40,000 simulated runs and 409,000 commands, scope violations like accessing Kubernetes config files or AWS credentials were missed 35% of the time. The most-missed single command was 'npm run analyze', approved ~65% of the time despite being able to run arbitrary scripts defined in package.json. Developers relying on AI coding agents track emerging permission model risks like these on daily.dev.
What percentage of Claude Code permission prompts do users approve?
Anthropic's own telemetry shows users approve around 93% of Claude Code permission prompts. The company notes that the more approvals a user sees, the less attention they pay to each, leading to declining diligence over time. This approval fatigue is a documented, real-world problem, not just a game scenario. Teams evaluating Claude Code's security posture find relevant findings like this on daily.dev.
How effective is Claude Code auto mode at blocking dangerous commands?
Claude Code auto mode catches roughly 83% of what Anthropic calls 'overeager behaviors' before they execute, meaning about 17% still get through in Anthropic's own evaluation. Anthropic describes it as 'one layer of defense-in-depth inside a sandbox, not a substitute for one,' and recommends pairing it with sandboxes, devcontainers, and custom hooks. Developers hardening their AI coding agent setups follow security trade-offs like this on daily.dev.