Approval fatigue

How approval fatigue occurs

An AI agent such as Claude Code asks for permission before it changes files or starts commands. Most prompts are safe. Thus “approve” becomes the usual answer.

1. The agent shows many usual prompts in one session.
2. The person approves them, and no damage occurs.
3. The person starts to approve by habit and reads less.
4. A dangerous prompt comes, and it gets the same click.

Research on security warnings calls this effect habituation. Anderson and colleagues (2016) saw it in the brain with fMRI, in a study of 25 persons.

Why approval fatigue is a risk

Approval fatigue makes a human in the loop control a control on paper only. The approval step is there, but the person does not check.

In practice: the numbers from Claude Code

Anthropic gives these numbers for Claude Code. They are vendor figures.

Measure (Claude Code)	Result	Source, date
Manual prompts that users accept	93%	Anthropic, March 2026
Dangerous command stopped by 1,053 testers	13.6%	Anthropic, report of August 2026
Same, at the start of a session	about 17%	Anthropic, report of August 2026
Same, after 50 or more prompts	about 5%	Anthropic, report of August 2026
Plans that users reject	39%	Anthropic, August 2026
Single permission prompts that users reject	3%	Anthropic, August 2026

The testers worked in a test environment, not on their own code. Anthropic changed one prompt in each session to a clearly dangerous command.

Many users also make rules that remove prompts. As of June 2026, 49.5% of active Claude Code CLI users had made a Bash allow rule. 5% let all shell commands through, Anthropic says.

In practice: MFA fatigue is the same attack

Attackers use this weak point against login prompts. MITRE ATT&CK T1621 says adversaries “bombard users with MFA push notifications” until a user accepts one. MITRE records this for LAPSUS$, APT29 and Scattered Spider.

For AI agents, the lesson is clear. A prompt that a person approves many times each day is a control that an attacker can wear down.

Trade-offs: 4 methods to decrease approval fatigue

Each method removes prompts with a different mechanism. Each one has a cost.

Method	What it does	Cost or limit
Sandbox	Usual commands operate in set file and network limits, with no prompt	Anthropic calls it “safe but high-maintenance”. Anthropic says it cut prompts by 84% in internal use.
Approve plans, not steps	A person approves one plan	Users reject 39% of plans and 3% of single prompts (Anthropic).
Classifier (Claude Code auto mode)	A model approves or stops each command	Missed 17% of 52 overeager actions, Anthropic says (March 2026)
Skip all permissions	No prompts	Anthropic: “zero-maintenance but offers no protection”

Two more rules come from older security work:

• Keep prompts for high risk commands. Use least privilege. Then most commands get no prompt.
• Make the prompt hard to approve by habit. CISA recommends number matching against MFA fatigue. Anderson and colleagues found that a warning that changes its look resists habituation better.

More prompts do not help. Each new prompt adds to the habit that lets the dangerous one through.

Questions and answers

What is the difference between approval fatigue and MFA fatigue?

The two are the same human weak point. A person who sees many prompts starts to approve by habit. Approval fatigue usually names prompts from an AI agent that asks to change files or start commands. MFA fatigue names login prompts that an attacker sends on purpose, as MITRE ATT&CK T1621 records for LAPSUS$ and APT29.

How do you decrease approval fatigue in AI agents?

Show fewer prompts and make each one count. Put usual work in a sandbox or narrow permissions. Then it has no prompt. Let a person approve a plan or a high risk command, not each small step. Anthropic reports that Claude Code users reject 39% of plans but only 3% of single prompts.

Does a classifier that approves commands stop approval fatigue?

A classifier removes the prompts, but it makes errors too. Anthropic reports that its Claude Code auto mode classifier missed 17% of 52 overeager actions. Anthropic says auto mode is not a drop in replacement for careful human review on high stakes infrastructure.