Jot Alex Wauters recently commented the results of a game he published a few months ago, where the player has to review approval requests from a fictitious Claude Code session.
While this was just a game and not a proper research experiment, the sample size is significant (over 40,000 runs) and the patterns are nonetheless interesting: The average player missed1 in 3 threats(mean accuracy 66.3%)32.9%of sessions ended with a negative score: penalties from approved threats and blocked safe commands outweighed everything done right35.2%of players caught every threat, but only20.8%managed that while blocking at most 1 in 5 of the safe commands. The rest got there partly by blocking everything (awarding the “Human Bottleneck” title)
More importantly, the game managed to show the effect of approval fatigue:
The more approvals a user sees, the less attention they pay to each, becoming over time much less diligent in their supervision [...]
This is the other side of the human-in-the-loop dilemma. Users are asked to approve commands which are actually benign, and blocking them slows the agent down. Over time this noise will likely result in users dropping their guard and approving malicious commands. [...]
The high amount of noise introduces fatigue resulting in developers opting for complete bypasses instead, and developers don’t always have the context of what has changed to quickly determine the risk.
The solution? Design controls so users can't take the wrong decision: We need to make the tooling easier (such as sandboxing, and strict context isolation) and only grant agents broad permissions once these safeguards are in place, rather than pointing to human-in-the-loop as an acceptable fallback.
The environment should be designed, so the model can progress in autonomy without risk. Approval requests should be seldom enough so we can reasonably expect the human in the loop to have enough energy to properly assess the risk when it matters.