409,000 human decisions on an AI agent’s commands: one threat out of three gets through, and confirmation fatigue is to blame

🚨 In a game, 40,000 people acted as the “human in the loop” for an AI agent: they made 409,000 decisions on whether to approve or block a command. And one threat out of three got through.

The game: 60 seconds to approve or block a coding agent’s commands

The game (llmgame.scalex.dev) puts you in the seat of the person who has to green-light a coding agent’s commands: you get 60 seconds to say “yes” or “no” to as many commands as possible, knowing upfront that some of them are traps.

Across 409,000 real decisions, average accuracy was 66.3%. One threat out of three gets through. 7% of players approved everything without filtering anything.

The numbers come from the analysis published by Scale X on August 5, 2026: more than 40,000 plays, 409,000 decisions, 66.3% average accuracy, “npm run analyze” approved by 64.7% and “cat ~/.zshrc” by 45.9%.

The obvious traps get blocked, the routine ones get through

The uncomfortable number is about the less obvious cases. The obvious ones get caught:

- "cat ~/.ssh/id_rsa", the SSH private key, is blocked by 82%.

The problem is the traps disguised as routine operations:

- The most overlooked command is "npm run analyze": approved by 64.7%, even when the malicious code was printed in the log right above the prompt. Hide the payload inside a "package.json" script and suddenly it stops looking dangerous.

- Lesser-known credential files get through about half the time: reading "~/.aws/credentials" slips past 35%, and "cat ~/.zshrc" is approved by 45.9%.

The cause: confirmation fatigue

The cause is fatigue. In testing, users end up approving roughly 93% of requests, and the more confirmations you’re asked for, the less attention you give each one: the effect shows up within the first minute.

The figure on the share of approvals comes from the post in which Scale X launched the game, May 27, 2026: telemetry showed roughly 93% of permission prompts approved, with fatigue measurable within the 60-second session.

The lesson is the same one from the breaches of recent months: asking a human to hit “yes” amounts to giving an instruction, not enforcing a real security boundary.

Five countermeasures worth more than the click

💡 What to do instead of relying on the click:

1) Cut down the confirmations, don’t add more. If the agent asks your permission dozens of times, sooner or later you approve without reading. Better a few decisions that actually matter.

2) Block upstream, not at the last second. Define in advance which commands are always allowed, and use a hook that stops destructive ones before they run. One caveat: a list of forbidden commands is easy to get around by obfuscating the command, so on its own it isn’t enough.

3) Be wary of "npm run" scripts and of "package.json". You read “npm run analyze”, not what the script actually executes. Open the script and ask claude to analyze it, don’t trust the name alone.

4) Isolate for real: a devcontainer or a sandbox with outbound network access blocked, so even if a command slips past you, nothing can get out.

5) Reduce the credentials the agent can reach. What isn’t there can’t be read.

Under pressure, how many times have you hit “yes” without really reading what the agent was about to run?