Anthropic ran a study with 1,053 paid testers and found that auto mode—an AI safety classifier—caught 89% of harmful actions in Claude Code, while human review caught 13.6%. Human performance fell to about 5% after 50 prompts. On August 14, Anthropic made auto mode the default for Pro, Max, and Team accounts. The classifier is now the first line of defense, not the human.
This is not a feel-good story about keeping humans in the loop. This is admission that the loop stopped working because nobody was paying attention anymore.
I run review gates in production. Every payroll run, every invoice batch, every nightly sync that moves data between the ERP and the estimating SaaS gets a confirmation step. I built those gates in 2019, back when I had time to read what I was approving. By 2023 I was approving on muscle memory. By 2024 I stopped pretending the gate was doing anything except slowing me down. The gate was still there. I just wasn't.
Approval fatigue is now a named exploit
Approval fatigue is a documented, named technique that adversaries deliberately engineer for, with an open threat-detection ruleset adding an entry in March 2026 for "Human Approval Fatigue Exploitation". An attacker instructs an agent to generate rapid repeated permission requests, uses minimizing language to make dangerous actions read as routine, or embeds a risky operation inside a batch of benign ones. The ATR-2026-00118 rule is in production security tooling now. It's not theoretical.
Claude Code users approve 97% of permission prompts. That number is not a measure of trust. It's a measure of surrender. If a user denies an MFA request five times and then approves on the sixth, that's not authentication—that's surrender. Same dynamic, different surface.
I've watched this play out in my own systems. The construction ERP has a two-step confirmation for deleting a job. The first time you see it, you read both prompts. The hundredth time, you're hitting Enter twice before the text renders. The gate doesn't stop you from deleting the wrong job. It just adds two keystrokes to the mistake.
The classifier is not supervision, it's containment
A separate classifier reviews each proposed action and lets Claude proceed unless the action is judged irreversible, destructive, or outside your environment. The classifier is a distinct model from the one writing your code; the agent proposing an action is not the thing approving it. This is the same architecture I use for agent workflows: the thing that executes is not the thing that decides whether execution is safe.
I don't let agents approve their own API calls. I don't let the payroll script decide whether the pay period is correct. I don't let the Twilio dialer choose which list it's calling. Those are classification problems, and I solve them the same way Anthropic did: a separate, narrow model that only answers one question. Is this action inside the safety envelope or not?
The difference is I'm not calling it a review gate anymore. I'm calling it a containment layer. Auto mode does not eliminate risk; the classifier is a model, and models are wrong sometimes. So are humans, especially humans on their fiftieth approval prompt of the morning. The question is which one fails less often under load.
Anthropic's answer is clear. The AI does.
I stopped pretending the human was supervising
I pulled the confirmation prompts out of three workflows last month. The invoice approval gate in the estimating SaaS, the nightly database sync confirmation, and the SMS broadcast check in the review-request pipeline. All three had the same problem: I was clicking through them by reflex, and the only thing they were catching was my attention span.
I replaced them with the same pattern Anthropic is using: a classifier that checks whether the proposed action matches expected bounds, and a hard stop if it doesn't. The invoice gate now checks whether the total is within 15% of the estimate and whether the line items map to active jobs. The sync checks row counts and schema drift. The SMS gate checks list size and whether it's calling a production number or a sandbox.
None of those are supervised by me anymore. They're contained by rules I wrote once and a model that applies them every time. If the check fails, I get paged. If it passes, it runs. I'm not in the loop. I'm in the exception path, which is where I should have been all along.
The human review gate isn't safer if the human isn't reviewing.
Approval fatigue is not a training problem. It's an architecture problem. If the system depends on a human reading every prompt with full attention, the system fails the first time the human has a deadline. Approval fatigue is a real security bug; the right direction is to let agents do low-risk work without constant interruption, classify risky actions before execution, and deny dangerous operations. That's not removing the human. That's putting the human somewhere they can actually function.
I'll still review the payroll before it posts. I'll still check the high-dollar change orders before they go out. But I'm done pretending that a confirmation dialog in the middle of a 47-step nightly process is a control. It's a speed bump that stopped working the day I learned to ignore it.