A study of 40,000 game runs found that humans failed to identify one-third of malicious AI agent commands when asked to approve them. The findings highlight potential security vulnerabilities in human oversight of autonomous systems.
Researchers tested human ability to catch threats in AI agent requests across 40,000 simulated game scenarios. Results showed a 33% miss rate—meaning one in three malicious commands received human approval despite potential risks.
The experiment, documented on ScaleX's blog, simulates real-world permission systems where humans authorize AI actions. The high failure rate suggests current approval workflows may be insufficient as AI agents handle more critical tasks.
Key factors likely contributing to missed threats include alert fatigue from reviewing numerous requests and the difficulty of identifying sophisticated attacks within legitimate-appearing commands.
The findings sparked substantial discussion in tech communities, with 191 comments on Hacker News. Researchers suggest improved UI design, better threat presentation, and reduced approval volume could improve human detection rates. The study underscores ongoing challenges in maintaining meaningful human oversight of autonomous systems.
A former NSA official has warned against connecting water infrastructure controllers to the internet following suspected Iranian cyberattacks on U.S. water systems.
Security researchers scanning Polish government websites discovered critical vulnerabilities that could expose courts, hospitals, and airports to cyberattacks. The vulnerabilities stem from common software used to manage and display web content.
A critical SQL injection vulnerability in Metabase is being actively exploited in the wild to steal customer data. The zero-day attack has already compromised instances at Framework and Tally.
Healthcare software company Unlimited Technology Systems disclosed a data breach affecting 3.8 million individuals. The breach occurred in October 2025.