A browser game simulating human-in-the-loop approval for AI coding agent commands collected data from 40,000+ runs and 409,000 decisions. Key findings: humans missed 1 in 3 threats on average (66.3% accuracy), with obvious destructive commands caught most reliably (11.7% miss rate) but credential exfiltration and scope violations missed 33-35% of the time. The most-missed threat was `npm run analyze` (64.7% miss rate) because familiar script names hide malicious payloads even when the payload is visible in the history log. Over-blocking of safe commands (e.g., `rm -rf dist/` blocked 45% of the time) creates noise that leads to permission fatigue, undermining the human-in-the-loop model. The data suggests that command-level approval is a weak safeguard when agents can pre-modify files like package.json before the command is ever reviewed.
