Approval fatigue demonstrated in a simple game

A game by Alex Wauters simulating approval requests from a Claude Code session found that players missed 1 in 3 threats on average (66.3% accuracy), with 32.9% of sessions ending in a negative score. The game, with over 40,000 runs, demonstrated approval fatigue: as users see more approvals, they pay less attention, increasing the risk of approving malicious commands. Wauters suggests designing controls with sandboxing and strict context isolation to reduce approval noise and allow safer agent autonomy.

Jot https://cephalosec.com/tag/jot/ Approval fatigue demonstrated in a simple game Alex Wauters recently commented the results https://scalex.dev/blog/ai-agent-permissions-stats/?ref=cephalosec.com of a game he published a few months ago, where the player has to review approval requests from a fictitious Claude Code session https://llmgame.scalex.dev/?ref=cephalosec.com . While this was just a game and not a proper research experiment, the sample size is significant over 40,000 runs and the patterns are nonetheless interesting: The average player missed1 in 3 threats mean accuracy 66.3% 32.9%of sessions ended with a negative score: penalties from approved threats and blocked safe commands outweighed everything done right35.2%of players caught every threat, but only20.8%managed that while blocking at most 1 in 5 of the safe commands. The rest got there partly by blocking everything awarding the “Human Bottleneck” title More importantly, the game managed to show the effect of approval fatigue: The more approvals a user sees, the less attention they pay to each, becoming over time much less diligent in their supervision ... This is the other side of the human-in-the-loop dilemma. Users are asked to approve commands which are actually benign, and blocking them slows the agent down. Over time this noise will likely result in users dropping their guard and approving malicious commands. ... The high amount of noise introduces fatigue resulting in developers opting for complete bypasses instead, and developers don’t always have the context of what has changed to quickly determine the risk. The solution? Design controls so users can't take the wrong decision https://cephalosec.com/blog/design-your-controls-so-security-awareness-becomes-irrelevant/ : We need to make the tooling easier such as sandboxing, and strict context isolation and only grant agents broad permissions once these safeguards are in place, rather than pointing to human-in-the-loop as an acceptable fallback. The environment should be designed, so the model can progress in autonomy without risk. Approval requests should be seldom enough so we can reasonably expect the human in the loop to have enough energy to properly assess the risk when it matters.