AI agent approvals failed one in three threat checks in a 40k-run game

The approval prompt in front of an AI coding agent looks like a sensible safeguard. Scale X’s browser-game data shows why it should not be treated as the whole defense. Across more than 40,000 plays and 409,000 approve-or-deny decisions, the average player missed one in three threatening commands. The reported mean accuracy was 66.3%.

The game asks players to act as the human in the loop for a coding agent. Some commands are routine, such as git status or npm test. Others are dangerous, including attempts to read credentials or send sensitive data away. Scale X reported that 32.9% of sessions ended with a negative score, while 7% of players approved every prompt they saw.

The caveat is important. The game deliberately included a high threat rate, about 34% of the commands shown, and it placed players under time pressure. Real developer workflows may contain far fewer malicious-looking commands. That means the numbers should not be read as a direct breach forecast. Their better use is as evidence for a weaker but practical point: repeated approval prompts train people to move quickly, and eventually to stop reading closely.

The Hacker News thread, posted at 2026-08-06 11:58:07Z, had 334 points and 243 comments at crawl time. The discussion split in a useful way. Some commenters argued that a timed game with no real consequences cannot prove much about workplace behavior. Others connected the result to an old security UX failure: asking users to click “yes” hundreds of times and hoping they notice the one dangerous request.

AI agents make that old failure sharper. Once approved, an agent may read files, install packages, call the network, or chain shell commands in ways the user did not fully inspect. If the person is the last line of defense, that person must correctly understand context and intent every time. In practice, the stronger pattern is structural: sandboxing, network controls, separate permissions, and policies that block risky command classes before a tired user sees another approval box.