Continue? Y/N: A 60-Second Game About AI Agent Permission Fatigue

A small browser game asks a question that anyone who has run a coding agent will recognise: are you actually reading the commands you approve? “Continue? Y/N” puts the player inside a simulated Claude Code session with one minute until a meeting, a refactor that needs approval and a stream of prompts that look routine.

Sixty seconds of approvals

The premise is drawn from everyday agent work. The agent explains why it wants to run something — “installing required project tooling”, “checking bundle sizes after the refactor” — and the player presses 1 to approve or 2 to deny, as many times as possible before the clock runs out. Every decision is answered with a consequence and a short lesson.

The traps are familiar ones: an environment file piped to a public paste service, a package published to the public registry, a script downloaded from a gist and piped into a shell, an unknown npm package run with access to the source, a bundle analyser that quietly streams its output to a third-party API, or a setup script that appends a line to the shell profile. Some arrive as prompt injection: a note planted in a documentation file or a Stack Overflow answer that tells the agent what to do next.

What 40,000 plays showed

The team behind the game, Scale X, published its own numbers: more than 40,000 plays and over 409,000 approve-or-deny decisions. The average player missed one in three threats, fatigue set in measurably inside the single 60-second session, and the most-missed command was “npm run analyze”, approved by two thirds of players even though the malicious script was printed on screen above the prompt.

Why it matters

The game lands in the middle of a wider debate about human-in-the-loop approval. Anthropic's write-up on containing Claude Code reported that users approved roughly 93% of permission prompts, adding that the more approvals a user sees, the less attention each one gets. The company has since introduced an auto mode that is enabled from the CLI and uses local fast filters and a server-side scan. Commenters on Hacker News pointed to another blind spot: an agent can edit files without approval and then ask the user to run them through a command that looks innocent.