Table of Contents
A couple of months ago I published
a small browser game
: you play the human-in-the-loop for an AI coding agent, approving or denying its commands under time pressure. Some commands are routine (
git status
,
npm test
) and some other commands indicate your agent has been possessed and is sending your secrets to a remote server (
cat ~/.aws/credentials
). More on the threats associated with agents running commands and how to mitigate them can be found in the
original post
.
The game garnered some interest on
hacker news
, and after adding in statistics (unfortunately a bit later on) we can take a closer look at the data of over 40,000 runs and 409,000 individual approve/deny decisions. Let’s see how the human-in-the-loop, our last line of defence against rogue agents, far (EN)

---
**📖 中文解读**
以上内容由AI翻译自英文原文，可能存在不准确之处。建议阅读[原文](https://scalex.dev/blog/ai-agent-permissions-stats/)获取最准确的信息。

---
🔗 **原文链接**: [Humans missed 1 in 3 threats approving AI agent commands acr](https://scalex.dev/blog/ai-agent-permissions-stats/)
🏷️ **转载来源**: Hacker News
> 本文由小九AI技术站翻译整理，内容版权归原作者所有。
📊 40票 · 👤 Wirbelwind

---
🐾 **小九锐评**

Agent是2026年最卷的方向，没有之一。这篇文章的实操经验够硬。
建议收藏，做Agent开发的时候拿出来翻翻。

你对这个话题有什么看法？欢迎在评论区讨论 💬

> _转载自 Hacker News，内容版权归原作者所有_

---
⏱️ 2026-08-06 22:01