130 秒速览

1The 30-second version

一句话:让人逐条点“批准”来管住编码 Agent,在数据上并不可靠——一个 40,000 局的审批游戏里,人平均漏放三分之一的威胁,同时又误拦大量正常命令。更好的做法是把“人”放到最后一道、只审少数真正不可逆的动作,前面用沙箱、规则和分类器把大部分风险挡掉。

In one sentence: asking a human to click “approve” on every agent command is not a reliable control: in a 40,000-run approval game people let through about a third of the threats while also blocking many harmless commands. A better design puts the human last, reviewing only the few truly irreversible actions, with sandboxes, rules and classifiers absorbing most of the risk before that.

先说名词:人在回路(Human-in-the-loop,HITL)指 Agent 执行某些动作前要先问人;审批疲劳指提示太多、绝大多数又是无害的,于是人开始不看就点。

Vocabulary first: human-in-the-loop (HITL) means the agent asks a person before certain actions; approval fatigue is what happens when there are so many prompts, almost all harmless, that people start clicking without reading.

2背景:数据从哪来

2Background: where the data comes from

Scale X 的 Alex Wauters 做了一个浏览器游戏:玩家扮演编码 Agent 的审批者,在时间压力下对一串命令点“批准”或“拒绝”。命令里有日常操作(如 git status、npm test),也有会泄露密钥或破坏系统的威胁(如 cat ~/.aws/credentials),共 37 个威胁场景、分 4 类,威胁约占 34%。

Alex Wauters of Scale X built a browser game: players act as the approver for a coding agent and approve or deny a stream of commands under time pressure. The stream mixes routine operations (e.g. git status, npm test) with threats that leak secrets or damage the system (e.g. cat ~/.aws/credentials): 37 threat scenarios in 4 categories, about 34% of all commands.

数据:Scale X(2026-08-05),40,000+ 局、409,000 次决策;文章未公布独立玩家人数。35.2% 的玩家抓到了全部威胁,但其中不少是靠“几乎全拦”做到的。

Data: Scale X (2026-08-05), 40,000+ runs and 409,000 decisions; the number of unique players is not given. 35.2% of players caught every threat, but many did it by blocking almost everything.

这和一线产品数据对得上:Anthropic 在 2026-03-25 的工程博客里说,Claude Code 用户实际批准了 93% 的权限提示;它在 2026-02-18 的研究里还发现,新用户约 20% 的会话开着全自动批准,到第 750 个会话时升到 40% 以上。也就是说,人一旦信任了 Agent,审批很快就变成走过场。

This matches product data. Anthropic’s engineering blog (2026-03-25) says Claude Code users accept 93% of permission prompts; its research post of 2026-02-18 found that about 20% of new users’ sessions use full auto-approve, rising past 40% by the 750th session. Once people trust the agent, approval quickly becomes a formality.

这不是 AI 才有的新问题。2013 年 Google 与 UC Berkeley 的“Alice in Warningland”研究分析了 2,500 多万次浏览器警告:Chrome 的 SSL 警告有 70.2% 被用户点过去,而 Firefox 的恶意软件/钓鱼警告只有约 10%——警告长什么样、出现得多频繁,会显著改变人的行为。

This is not new with AI. The 2013 “Alice in Warningland” study by Google and UC Berkeley looked at more than 25 million browser warnings: users clicked through 70.2% of Chrome’s SSL warnings but only about 10% of Firefox’s malware/phishing warnings. How a warning looks and how often it appears changes behaviour significantly.

3核心概念

3Core concepts

4机制:逐条审批为什么会失效

4Mechanism: why per-action approval fails

把 Scale X 的数据和上面的来源放在一起,可以归纳出四个原因(归纳为作者整理,数字均来自原文):

Putting the Scale X data next to the other sources gives four causes (the grouping is the author’s; all numbers come from the sources):

5方案对比:除了逐条点批准还能怎样

5Options compared: alternatives to clicking approve

Anthropic 的 auto mode 设计说明里有两个值得借鉴的细节:一是分类器故意看不到 Agent 自己的文字和工具输出,避免 Agent“说服”分类器、也降低提示注入风险;二是被拒的动作带着理由退回给 Agent,连续 3 次或累计 20 次被拒才升级给人——人被放在了异常路径上,而不是每一步。Anthropic 也明确说它“不能直接替代对高风险基础设施的仔细人工审查”。

Two details of Anthropic’s auto mode design are worth borrowing. The classifier deliberately cannot see the agent’s own text or tool outputs, so the agent cannot talk it round and prompt injection has less to work with. And a denied action goes back to the agent with a reason; only after 3 consecutive or 20 total denials does it escalate to a human. The human sits on the exception path, not on every step. Anthropic also says plainly that it is “not a drop-in replacement for careful human review on high-stakes infrastructure”.

6怎么用:给编码 Agent 搭门控的清单

6In practice: a gating checklist for coding agents

下面以 Claude Code 为例,把图 2 的四层落到配置上(配置项来自官方文档;取舍为作者建议):

Using Claude Code as the example, here is how the four layers of Figure 2 map to configuration (settings from the official docs; the trade-offs are the author’s suggestions):

// ~/.claude/settings.json(示意:第 1 层)
{
  "sandbox": {
    "enabled": true,
    "network": { "tlsTerminate": {}, "allowedDomains": ["*.github.com", "registry.npmjs.org"] },
    "credentials": {
      "files":   [ { "path": "~/.aws/credentials", "mode": "deny" } ],
      "envVars": [ { "name": "GH_TOKEN", "mode": "mask", "injectHosts": ["api.github.com"] } ]
    }
  }
}

// ~/.claude/settings.json (sketch: layer 1)
{
  "sandbox": {
    "enabled": true,
    "network": { "tlsTerminate": {}, "allowedDomains": ["*.github.com", "registry.npmjs.org"] },
    "credentials": {
      "files":   [ { "path": "~/.aws/credentials", "mode": "deny" } ],
      "envVars": [ { "name": "GH_TOKEN", "mode": "mask", "injectHosts": ["api.github.com"] } ]
    }
  }
}

注意:遮罩相关设置只在用户级、托管设置或 --settings 中生效,写在仓库的 .claude/settings.json 里会被忽略;沙箱只覆盖 shell 命令,Claude 的文件工具、MCP server 和 hooks 在沙箱之外。

Note: masking settings are honoured only from user settings, managed settings or --settings, and ignored in a repository’s .claude/settings.json; the sandbox covers shell commands only, while Claude’s file tools, MCP servers and hooks run outside it.

7坑与未解问题

7Pitfalls and open questions

8资源与来源

8Resources and sources