Humans miss 1 in 3 dangerous AI agent commands in browser game
Belgian developer Alex Wauters built a browser game that mimics Claude Code permission prompts. You have 60 seconds to approve or deny as many simulated agent requests as you can. Approve a malicious one or deny a safe one and your score drops.
After more than 40,000 runs and 409,000 approve/deny decisions, the data is uncomfortable: players approved roughly one in three malicious commands.
What the data shows
The most commonly missed category was scope violations, things like an agent requesting to read Kubernetes config files or AWS credentials lists. Players missed those 35 percent of the time. Obviously destructive commands like rm -rf / or recursively granting full read/write/execute permissions on the root directory were caught most often.
The single most-missed command was npm run analyze, which players approved nearly 65 percent of the time. The game displays what that script actually contains in the agent’s history log, right above the permission prompt. Two thirds of players approved it anyway without reading it.
Why this happens
Wauters points to two forces pulling in opposite directions. Approving every command in a default agent flow is exhausting and invites sloppy decisions. Skipping permissions entirely with --dangerously-skip-permissions removes the human check altogether. Neither option is good.
Anthropic’s own telemetry from Claude Code backs this up. Users approve around 93 percent of permission prompts. The company noted that the more approvals a user sees, the less attention they pay to each one over time.
What actually helps
Wauters recommends running AI coding agents inside sandboxes and devcontainers in the cloud, using Claude Code’s auto mode (which Anthropic says catches roughly 83 percent of overeager behaviors before execution), and writing hooks to contextualize potentially risky actions before they reach an approval prompt.
Anthropic is explicit that auto mode is one layer of defense-in-depth inside a sandbox, not a substitute for one. The roughly 17 percent that still gets through in its evaluation means no single control is enough on its own.
If you’re running Claude Code on anything that touches credentials, production infrastructure, or live package scripts, the permission model deserves more thought than most developers currently give it.
I’m founder of BizStack at Cagri Sarigoz LLC and a passionate advocate for entrepreneurs.
With over 14 years in tech, marketing, and AI, including my role as Head of SEO at CitizenShipper and co-founder of TaleBot at Intale AI, I’m dedicated to sharing genuine, useful product insights and tips.
At BizStack, I aim to cut through the digital noise to provide clear, actionable advice.
And more than all else, I’m a father to a (always) little girl and a husband.
Contact me at [email protected] for assistance.
