The Human in the Loop Approves 93% of Everything. Including the Attacks.

Ask an enterprise how they keep their AI agents safe and you'll usually get the same answer: there's a human in the loop. An approval prompt. A review step. Someone accountable, with a mouse, between the agent and the consequences.

This August, that answer got a miss rate.

The data

Belgian developer Alex Wauters built a deceptively simple browser game: you're shown permission requests from an AI coding agent — the same kind Claude Code or Cursor shows you every day — and you have 60 seconds to approve the safe ones and deny the dangerous ones. Over 40,000 runs and roughly 409,000 individual decisions, the results came back, and they are not flattering:

• Roughly one in three malicious commands got approved. Not by careless people — by people actively playing a security game, primed to look for threats.
• Scope violations were missed 35% of the time — requests that quietly reach for credentials or config files outside the task at hand.
• The single most-approved dangerous command? npm run analyze — waved through nearly 65% of the time, despite being a perfectly good vehicle for an arbitrary payload. It sounds like something a linter would do. That's the whole trick.

And that's the lab condition, where everyone knows they're being tested. In production, Anthropic's own telemetry shows users approve roughly 93% of Claude Code permission prompts. Anthropic's assessment of the pattern was refreshingly blunt: "the more approvals a user sees, the less attention they pay to each."

One in three missed under ideal conditions. Ninety-three percent approval under real ones. That is not a control. That is a ritual.

Why the loop degrades

None of this means humans are bad at security. It means humans are bad at this shape of security, and the security industry has known it for a decade — we just forgot to apply the lesson to agents.

The mechanics are boring and universal. Almost every request an agent makes is benign, so the base rate trains you: approve, approve, approve. Each prompt arrives with thin context — a command string, maybe a diff — and the cost of denying a safe request (your agent stalls, your task derails) is immediate, while the cost of approving a dangerous one is invisible until later. Wauters put it plainly: "approval decisions aren't easy to make when context is limited." Approval fatigue is alert fatigue with a nicer font. SOC teams burned out on this exact failure mode years ago; agents have simply reproduced it at the individual developer level, thousands of times a day.

Here's the uncomfortable implication: every additional approval prompt you add makes each individual approval less safe. The loop doesn't scale. It inverts.

The fix is not a bigger modal

The instinctive response — more warnings, scarier dialogs, mandatory review for everything — spends more of the one resource that's already exhausted. Human attention is a scarce, rapidly depreciating security asset. The only way to make it effective is to spend dramatically less of it, in dramatically better places.

That means the decision architecture has to change. Every agent action should get one of three answers, and a human should only ever see one of them:

Allow, automatically. The provably routine — actions consistent with the agent's baseline, inside policy, from an agent whose trust score has earned it slack. No human should ever see these. This is 90-plus percent of the volume, and it's precisely the volume that's currently training your reviewers to stop reading.

Deny, automatically. The provably bad — policy violations, scope grabs, actions from agents whose behavior has already degraded their standing. A human confirmation adds nothing here except a 35% chance of overriding the right answer.

Review, deliberately. The genuinely ambiguous middle — novel actions, elevated-risk requests, trust scores in the gray zone. This is where humans are excellent, provided the queue is short enough that each item gets actual attention and arrives with actual context: what the agent is, what it's done before, why this action tripped the threshold.

This is exactly how VeriSwarm's Gate works. Every agent action is scored against a live trust score and evaluated by policy tiers, and the response is one of those three answers — allow, review, deny — not a modal reflexively fired at a tired human. The review queue becomes what it should have been all along: a budget, spent only where human judgment beats automation. And because thresholds are configurable per policy tier, you decide how wide the gray zone is for a customer-support agent versus one that touches your billing system.

The industry is converging on the same conclusion. On August 5, Anthropic shipped inference hooks for Claude Enterprise — a beta that routes every prompt through the organization's own security server for an allow-or-deny verdict, with a five-second timeout, before the model proceeds. Read that design closely: the checkpoint is inline, automated, and answers in seconds. Even the people who build the models aren't betting on a human reading the modal.

For the ones that get through anyway

Some bad approval will always happen — by you, by your policy, by the reviewer having a bad Tuesday. The question is what it costs. Two things bound the damage:

Guard's kill switch ends a misbehaving agent's session the moment its behavior crosses the line — after approval, mid-execution, no committee required. An approval is not a lease; it's revocable.

Vault writes every decision — allowed, denied, reviewed, and who approved what, when — into a hash-chained, tamper-evident ledger. Which means approval fatigue itself becomes measurable: if one reviewer approves 99.4% of requests in under two seconds each, you don't have a reviewer, you have a rubber stamp with a badge. Now you can see it, and fix the tier, not the human.

The loop, rebuilt

Human-in-the-loop was always the right instinct pointed at the wrong volume. Keep the human. Fire the ritual. Let policy handle the edges automatically, give people the short, contextual, consequential queue they're actually good at, and log all of it so you can prove the system works — to yourself, and to the auditor who will eventually ask.

Gate's trust scoring and policy tiers are on VeriSwarm's free plan — the allow/review/deny answer costs nothing to start. Sign up at veriswarm.ai and stop asking tired humans to be your firewall.

---

Sources: The Register on the 40,000-run approval study; Unite.AI on Anthropic's inference hooks.