Humans approve dangerous AI agent requests at an alarming rate. Developer Alex Wauters created a browser game where participants had 60 seconds to approve or reject simulated permission requests from AI agents. Analysis of over 40,000 games and 409,000 decisions revealed a troubling pattern: users routinely approved access to sensitive resources.
Requests to access Kubernetes configuration files and AWS credential lists were granted. Destructive commands like "rm -rf" and potentially malicious ones, including "npm run analyze" with unknown scripts, were also approved. The culprit? Permission fatigue. Wauters identified that repetitive, high-volume permission requests from AI models wear down users' attention, causing them to rubber-stamp approvals without carefully examining what they're allowing.
This finding exposes a fundamental vulnerability in how developers interact with AI systems. As AI agents become more integrated into development workflows, the cognitive burden of constant permission decisions creates a security blind spot. Organizations need better safeguards—smarter filtering of requests, progressive permission escalation, and clearer warnings for sensitive operations—rather than relying on human vigilance alone.
