Interfaces that interrupt a person for a decision are waved through in every domain measured

Method

This artifact compiles previously published measurements; it contributes no new experiment. Sources span 2005–2026: large-scale browser telemetry, vendor telemetry, regulatory alerts, peer-reviewed field studies, and the 2026 publications on agent tool approval. Each figure is cited to its source in table 1.

The unit of study is the interrupting interface, meaning any element of a system that halts a person mid-task and makes them the check on an action about to occur. Modal dialogs are the obvious instance, but the class is wider: a full-page browser interstitial, an elevation prompt, a runtime permission request, a bedside device alarm, a terminal approval. What they share is not their form but their contract, which is identical in every case: the system has detected something it will not decide alone, and a human is expected to supply the judgment, per occurrence, at whatever rate the system produces occurrences. The compilation asks one question of each: what happens to that judgment under volume?

The record, by domain

Browser security warnings. The largest field study of browser warnings measured twenty-five million impressions of real users meeting real warnings: 70.2% of Chrome’s SSL warnings were clicked through; Firefox’s differently designed warning held click-through to 33%.1 A redesigned Chrome warning later raised adherence from 37% to 62%, a genuine gain, though the authors report that comprehension stayed poor and that the improvement came from visual friction rather than understanding.2

Operating-system elevation prompts. Microsoft’s own telemetry on Windows Vista found consumer administrators approving 89% of User Account Control prompts, rising to 91% by SP1; the company wrote that it was “concerned users are responding out of habit due to the large number of prompts.” In its lab study, 13% of participants could explain why they were seeing the dialog at all.3 The Windows 7 response was not a better prompt but fewer prompts. An independent study found 69% of participants did not correctly apply the mechanism at all.4

Mobile permissions. At install time, 17% of users paid attention to Android permission screens and 3% could answer basic comprehension questions about them.5 When Android moved to runtime prompts, with the request arriving in context at the moment of use exactly as the install-time studies had urged, users granted 84% of requests.6

Clinical alarms. In hospitals, 72–99% of clinical alarms are false or non-actionable,7 and the documented consequence of that ratio is desensitization: the Joint Commission’s 2013 sentinel event alert recorded 98 alarm-related events over three and a half years, 80 of them deaths, and made alarm management a national patient safety goal.8 The clinical literature designates this condition alarm fatigue; the term predates its adoption in software by approximately two decades.

Rare-target visual search. In baggage-screening-style visual search, observers miss 7% of targets when targets are common, and 30% of the same targets when they appear on 1% of trials.9 Prevalence is the only manipulated variable; the miss rate rises by a factor of approximately four as prevalence falls.

The agent-era measurements

The newest points on this curve arrived in 2026, from Anthropic’s published work on agent tool approval, across two publications whose figures deserve separate citation. The March engineering study reported users approving 93% of Claude Code permission prompts;11 by the August announcement the figure was 97%.12 In the controlled study reported in August, 1,053 paid professional testers were shown dangerous commands inside working sessions: humans caught 13.6% overall, about 17% early in a session, decaying to about 5% after fifty or more prior prompts.12 The reported within-session decline is consistent in shape with the prevalence and vigilance findings above.

Their model-based classifier caught 89% in the same study, flat across session length, and classifier-mediated approval became the default for most plans on August 14. The published record also shows what a single accuracy number conceals: on real overeager actions the full pipeline missed 17% (an 83% catch rate); on synthetic data-exfiltration attempts it missed 5.7%; external red-teaming reduced a 12% miss rate to 7%.11,12 Reported accuracy therefore varies by evaluation set rather than resolving to a single figure. The publications identify the primary failure mode as consent scoping, in which the classifier locates approval-shaped evidence in the session transcript and misjudges whether it covers the action under evaluation. The same publications describe the system as one layer of defence-in-depth and recommend human review for production-affecting changes.

A second controlled study, published the same month by ScaleX, put approximately 2,000 participants through agent command approvals and reports a calibration result the other domains do not measure.13 Overall, 34% of attacks were approved and only 35.2% of participants caught every threat. Disaggregated by threat type, the miss rate for obviously destructive commands such as rm -rf / was 11.7%, while the miss rate for exfiltration and code execution was 33.4% and for scope violations such as reading cloud credentials 35.0%. A command named npm run analyze, whose malicious script piped output to an external endpoint visible in the session history above the prompt, was approved 64.7% of the time. Framing a script with a familiar name approximately doubled attack success, from 28.4% to 52.5%.

Two properties of that result bear on the compiled figures. Calibration is inverted with respect to consequence: the theatrical threat is caught and the consequential one is missed, so any triage interface ordered by apparent destructiveness would deprioritise precisely the cases already missed. And the study’s base rate was approximately 34% with participants aware they were being tested, whereas the prevalence result recorded above indicates miss rates rise as targets become rarer.9 Production rates should be expected to exceed these.

Two observations summarise the compiled figures. Across the five domains the wave-through rate ranges from 70% to 97%, and the ordering of rates does not correspond to the ordering of stated consequence: the highest recorded rate, 97%, is from a terms-of-service study whose policy assigned the reader’s first-born child as payment, with 98% of consenting readers not identifying the clause.10 In the single domain with within-session longitudinal measurement, the reported decline occurs across approximately fifty prompts.

Documented responses

Each field’s response to its own measurements is recorded below. No response is evaluated here.

Following the Vista telemetry, Windows 7 reduced prompt volume rather than altering prompt content.3 Following the browser warning studies, vendors redesigned toward visual friction; measured adherence rose from 37% to 62% while comprehension was reported unchanged.2 Following the Android install-time comprehension figures, the request was relocated to runtime; the subsequently measured grant rate was 84%.5,6 Following the alarm-related event reports, the regulatory response was alarm management, defined as reduction and reprioritisation of alarm signals, and alarm management became a national patient safety goal in 2014.8

In agent tooling, each of the three inspected harnesses ships a mode that bypasses per-action approval, and each stores approvals in a form intended to generalise one decision across multiple future actionsR/9B1. In August 2026 classifier-mediated approval became the default configuration for most Claude Code plans.12

Across the five domains and four decades compiled here, the recorded responses take five forms: reduction of prompt volume, redesign of the prompt, relocation of the prompt, prioritisation among prompts, and delegation of the decision to an automated classifier. This artifact records these responses and does not assess them.