The Command That Fooled 65% of Humans Was npm run analyze

TL;DR

On August 5, Belgian developer Alex Wauters published the aggregate results from a browser game that drops you into the seat every agentic coding user already occupies: a stream of shell commands, 60 seconds, approve or deny. Across over 40,000 runs and 409,000 individual decisions, mean accuracy was 66.3%. Players waved through roughly one malicious command in three. The most-missed threat of the 37 in the pool was not some baroque exfiltration chain, it was npm run analyze, approved 64.7% of the time. Meanwhile people confidently blocked rm -rf dist/. The human in "human in the loop" is the part of the safety story nobody stress-tested, and this is the first large-N look at it.

What the game actually measures

The format is deliberately close to a real session with Claude Code or any other agent that asks before it acts. You see a permission request, you have seconds, you decide. Scoring cuts both ways: approving a threat costs you, and so does denying a safe command. That second half matters, because a reviewer who denies everything is not a safety mechanism, they are a very slow keyboard.

About 34% of the commands shown were threats, sorted into four escalating categories. The miss rate climbs almost perfectly with how much the command has to hide.

Only 35.2% of players caught every threat in their run, and just 20.8% managed that while blocking no more than one in five safe commands. A third of sessions, 32.9%, ended with a negative score, meaning the reviewer was net harmful. And 7% approved every single prompt, which is at least an internally consistent strategy.

Wrong in both directions at once

The failure is not simple laziness, or the fix would be simple too. The same population that let package scripts through was blocking a build-artifact cleanup at nearly the same rate. People are not tuning a threshold, they are pattern-matching on scary-looking syntax.

Pooled across the run, npm script invocations were missed 52.5% of the time (n=9,482), against 28.4% for every other exfiltration attack in the set. The most divisive single line was cat ~/.zshrc, approved by 45.9% of players, which is about as close to a coin flip as a security control can get.

Why npm run wins

Because npm run analyze is not a command, it is a pointer. The actual behavior lives in package.json, in a repo the agent may have just edited. Think of it as a signed blank check where the payee line is filled in by whoever last touched the checkbook. You are not approving "analyze," you are approving whatever string a file currently maps to that word, and the reviewer would have to open the manifest to know which. Nobody opens the manifest in second forty.

The production number is worse than the game

Here is the part that should end the debate. Anthropic's own engineering write-up on Claude Code auto mode states plainly that users approve 93% of permission prompts. Game players, warned they were being graded, on a stream engineered to be one third hostile, hit 66.3%. Real developers, on a stream that is overwhelmingly benign and therefore trains the reflex, approve nine out of ten.

An approval dialog is supposed to be a decision point. At 93%, it is a load-bearing Enter key.

The machine reviewer is not a miracle either

Anthropic's answer to prompt fatigue is auto mode, a two-stage classifier that vets each tool call before it runs. A fast single-token filter clears the easy traffic, and anything it flags escalates to a slower chain-of-thought review running on Sonnet 4.6. FPR is the false-positive rate, safe actions wrongly blocked; FNR is the false-negative rate, dangerous actions wrongly allowed.

So the automated reviewer misses 17% of real overeager actions, against a human miss rate of roughly one in three. Better, not solved. Anthropic's own diagnosis of the remaining misses is worth internalizing: the classifier usually spots the danger correctly, then misjudges whether earlier consent in the conversation covers this action's blast radius. It finds approval-shaped evidence and fails to check whether that approval stretched as far as a force push.

Read the caveats before you quote the number

This is a browser game, not a controlled study, and Wauters says so himself. Threats appeared at roughly 34%, orders of magnitude above the base rate in real work. Players knew they were being scored, which usually makes people more vigilant, not less. The 60-second clock manufactures time pressure rather than measuring the ambient kind. And the population is self-selected internet developers with something to prove.

Every one of those distortions should push accuracy up relative to a Tuesday afternoon. It came in at 66.3% anyway, and the field data from Anthropic points the same direction. Treat 66.3% as a ceiling, not an estimate.

What to change on Monday

• Stop counting the human as a control. If your threat model says "the developer reviews each command," you have a control with a documented one-in-three miss rate and no alerting.
• Kill the noise so the signal survives. The reviewer's accuracy is a function of how many prompts they see. Allowlist the genuinely safe reads so the prompts that remain are worth reading.
• Treat indirection as a first-class threat. npm run, make, and any other verb that resolves through a file the agent can edit should be a distinct permission class, not a string match.
• Constrain the blast radius instead of the keystroke. Scope violations, the reach-for-the-AWS-creds category, were the worst-missed at 35.0%. Credentials the agent's process cannot see are not credentials a tired human has to defend.

Key Takeaways

• 409,000 approve/deny decisions across 40,000 runs produced a mean human accuracy of 66.3%, roughly one missed threat in three.
• Miss rates scale with subtlety: 11.7% for obvious destruction, 35.0% for scope violations reaching credentials and cluster configs.
• npm run analyze was the single most-missed threat at 64.7%; pooled npm script invocations were missed 52.5% of the time (n=9,482).
• Reviewers fail symmetrically, blocking npm config set registry 59% of the time and rm -rf dist/ 45%.
• Anthropic's field data is starker still: 93% of Claude Code permission prompts get approved, and its auto mode classifier still carries a 17% false-negative rate on real overeager actions.
• 32.9% of sessions ended net negative and 7% of players approved everything, so "add a human" is a design decision that needs evidence, not a default.

Sources: Scale X, "Humans missed 1 in 3 threats approving AI agent commands across 40,000 plays", The Register, Anthropic Engineering, "Claude Code auto mode", llmgame.scalex.dev