Game reveals humans struggle to spot malicious AI coding agent requests

A browser-based game designed to test human ability to validate AI coding agent permission requests found that players approved approximately one-third of dangerous commands on average. Belgian developer Alex Wauters created the game after observing that continuous permission approval leads to developer fatigue and insecure workarounds. Analysis of over 40,000 game instances and 409,000 total approval decisions showed that scope violations—such as agents accessing Kubernetes configs or AWS credential files—were missed 35 percent of the time. Destructive commands like recursive root directory deletions were most frequently caught. The single most missed command was npm run analyze, approved nearly 65 percent of the time despite the ability to execute arbitrary code defined in package.json files. The results suggest that human-in-the-loop oversight, while necessary, may be insufficient without better interface design and developer context awareness.