tl;dr: Data from 40,000 runs of a browser game simulating human approval of AI agent commands showed players missed 33% of threats, with credential exfiltration attacks missed three times more often than obviously destructive commands like `rm -rf /`. The most-missed attacks hid malicious payloads behind familiar-looking scripts like `npm run analyze` (64.7% approval rate), even when the suspicious contents were visible in the log. The author argues human-in-the-loop is an unreliable security boundary due to alert fatigue and missing context, and that sandboxing and isolation should be prioritized over approval prompts.