Reviewers Miss a Third of Malicious Agent Commands

Reviewers in a large permission-approval game missed a third of malicious agent commands, according to Scale X.

That 33.7% miss rate spans 409,000 individual approve or deny decisions across 40,000-plus plays, published August 5. It lands on coding-agent products that treat a human's click as the main safety gate before a command runs.

The blind spot clusters around npm scripts. npm run analyze got waved through 64.7% of the time, npm run setup 48.0%, and npm run deploy 44.9%, pooling to 52.5% across npm-script variants. Obviously destructive commands fared far better, missed just 11.7% of the time. Reviewers aren't ignoring risk, they're trusting anything that looks like routine tooling.

The errors run both directions. 59% of reviewers blocked a harmless npm config set registry, and 45% blocked rm -rf dist/, a routine build-cleanup command. Almost a third of sessions, 32.9%, ended with a negative score.

The pattern is the tell, not the intent

The mix-ups show reviewers grading command names, not behavior. npm run analyze reads safe and rm -rf reads dangerous, regardless of what each one actually does in context. A related pattern showed up in Claude Code coverage: a sandbox bug let a bash command hide itself from the permission prompt entirely. Codex separately moved to stricter automatic-review defaults for cyber-capable models. The direction across all three is the same: shrink what depends on a human clicking approve, because the click doesn't reliably work.

For anyone shipping an approve or deny prompt, npm run analyze is exactly the command that needs a second layer of defense. A dialog box alone isn't it.