Game Data Shows Humans Missed One in Three Dangerous Agent Commands
Scale X reported on August 5 that players missed about one in three dangerous commands while reviewing AI coding-agent requests in its browser game. The analysis covers roughly 409,000 approve-or-deny decisions across more than 40,000 plays, but it is an observational game dataset rather than a controlled study or production benchmark.
Scale X published results from a browser game designed to test whether people can spot dangerous commands proposed by an AI coding agent. Across roughly 409,000 approve-or-deny decisions from more than 40,000 plays, the operator says players approved about one third of the malicious requests. The Register independently reported the same dataset and its central finding on August 6.
The result is useful evidence about permission fatigue, but its limits matter. Players knew the game contained threats, worked under a 60-second timer, and were not sampled as a representative population of production developers. The data therefore shows behavior inside this game; it does not establish a universal failure rate for human reviewers or compare specific commercial coding agents.
Familiar commands created a blind spot
The published breakdown says players blocked an explicit attempt to read an SSH private key 82% of the time. A disguised path performed much worse: an npm run analyze request was approved 65% of the time even when the malicious payload had been placed in package.json and was visible in the preceding history. The contrast suggests that reviewers often judge a familiar command label instead of tracing what the command will actually execute.
That distinction matters because coding agents can edit project files before asking permission to run an apparently routine script. A confirmation dialog that displays only the final command may hide the material change one layer below it.
What teams can take from the result
The dataset supports treating human approval as one control rather than a complete security boundary. Teams deploying coding agents should combine narrow credentials, isolated workspaces, restricted network access and auditable diffs with risk-based approvals. High-volume prompts also need enough context to expose the effective action, including changed scripts and downstream tools, rather than a reassuring command name.
The game does not prove which control mix is sufficient, but it does make one operational risk concrete: repeated approval requests can train reviewers to recognize surface patterns while missing the action those patterns trigger.
Key Points
- 1Scale X says players missed about one third of dangerous requests across roughly 409,000 decisions from more than 40,000 game plays.
- 2Players blocked a direct SSH-key read 82% of the time but approved an npm script wrapper 65% of the time, according to the first-party analysis.
- 3The observational game is evidence of approval fatigue and command-label bias, not a controlled production benchmark or a universal reviewer failure rate.
Scoring Rationale
A large observational dataset makes a concrete coding-agent permission risk measurable and useful to security and developer-platform teams. The evidence is limited to a self-selected, time-pressured browser game rather than controlled or production telemetry, which constrains generalization.
Sources
Primary source and supporting public references used for this report.
Practice interview problems based on real data
1,625 SQL & Python problems across 15 industry datasets — the exact type of data you work with.
Try 250 free problems
