Humans wave through 1 in 3 malicious AI-agent commands, study finds
409K approvals deep, npm run is the blind spot no warning fixed — so sandbox your agent, don't trust the click. Plus: drop any agent into Slack, MIT-licensed.
Copy markdown
1 in 3 threats got a yes
In a 40,000-player game logging 409,000 approve/deny calls, reviewers hit just 66.3% accuracy — and the misses climbed with the stakes: 33.4% of exfiltration/code-exec commands and 35% of credential-scope violations sailed through. Even with a warning shown up front, one in three real threats was approved.
npm run was the trap door
The single most-approved threat was npm run, waved through 64.7% of the time, with malicious payloads tucked into package.json scripts — right there in the log, but nobody reads the log. Meanwhile harmless commands got over-blocked: npm registry config 59% of the time, clearing a build dir 45%.
The fix isn't a sharper human
Per-command approval is structurally weak: the agent can rewrite files before the command you're shown ever appears. The practical moves for your setup — sandbox the agent, split credentials out of its environment, and stop treating a fatigued click as a security control.
Build this weekend: your agent, in Slack
CopilotKit open-sourced Channels SDK (MIT) — drop any AG-UI agent into Slack, Microsoft Teams, Discord, or Telegram with native interactive UI, no rebuild. A clean weekend project: wire your existing coding or ops agent into your team's chat.
Elsewhere: Meta's coding agent spawns its own helpers
Meta shipped Muse Code (beta) on its new Muse Spark 1.2 model — a terminal agent whose persistent async background agents spin up parallel helpers for planning, stress-testing, and finishing tasks. It's closed-weights and API-only at $1.25/$4.25 per million tokens, with a 1M-token context.