"Can I send this email?" Yes. "Can I fill out this form?" Yes. "Can I access your account?" Yes. By the tenth approval you've stopped reading. By the twentieth, you're looking for a setting so it stops asking. Developers even have a nickname for when the AI does everything without asking: YOLO mode, as in "you only live once".
Now every AI wants to act on your behalf: ChatGPT browses and buys, Gemini fills out forms in Chrome, Copilot answers emails, Claude works on your files. They all ask for your approval first. The question is whether anyone on the other side is reading.
Ninety-seven yeses in a row
The company that measured this behavior best is Anthropic. In March, it reported that users of Claude Code, its coding agent, accepted 93% of permission requests. By August, it was 97%. The most telling detail: people reject 39% of the plans the AI proposes, but only 3% of individual permissions. We read the plan. Request number 47, nobody reads.
And it gets worse over time. At the start of a session, people blocked around 17% of dangerous actions. After 50 requests, that number dropped to about 5%. Anthropic's answer was to put another AI in charge of approving instead of the human.
You don't need to code to recognize yourself here. It's the same reflex that accepts every website's cookies and every app's terms of use without reading a line.
Every agent has a "may I?"
Look at how vendors designed this. ChatGPT's agent asks permission before consequential actions, like making a purchase or sending an email, and Sam Altman himself advised against giving it more than the minimum access or letting it answer all your emails without asking. Gemini's auto browse in Chrome asks for confirmation before sending messages, changing data, submitting forms and scheduling events. Copilot does the same before sending any message.
Google itself, on the feature's help page, says that monitoring your tasks is the most important way to protect yourself, and asks you to review every confirmation request carefully. Translation: all of the security has been outsourced to your click.
The web page that gives orders to your assistant
The agent reads everything it finds along the way: pages, emails, PDFs, comments. If one of them carries a hidden instruction, it may follow it. That's called prompt injection.
The clearest example came from Brave in 2025. Researchers hid instructions in a Reddit comment. When a user asked Perplexity's AI browser, Comet, to summarize the page, the assistant followed the hidden orders: it grabbed the account email, went to Gmail and read the one-time login code. The user had only asked for a summary.
On your side, all you see is one more "Can I continue?", just like the other forty-six that day.
A permission request only protects you while you read it. After that, it's decoration.
The "Allow access" nobody revokes
There's an even more dangerous button, and it predates agents: the consent screen. An app, an extension or an "AI assistant" asks to "read your emails and files", the screen is Google's or Microsoft's, the address is legitimate, and you click Allow.
From then on, the app has its own access to your accounts. This scam has a name, consent phishing, and the cruel part is that two-factor authentication doesn't help and changing your password doesn't remove the access. It only goes away when someone revokes the permission. Try this: how many apps have access to your Google or Microsoft account right now? Do you know?
A sense of risk in three questions
Before approving, three questions settle almost everything:
- Can it be undone? A draft, yes. A sent email, a paid purchase or a shared file, no.
- Does it leave you and reach someone else? Messages, forms, posts, payments, data sent to a website: anything going out deserves a read.
- Whose idea was it? If you asked for it, great. If the agent "decided" after reading a page or an email, be suspicious.
| The AI asks to... | Fine on autopilot | Read before approving |
|---|---|---|
| Summarize, search or compare | Yes | |
| Draft text, an email or a presentation | Yes | |
| Send an email, a message or post on social media | Always | |
| Fill out and submit a form | Yes | |
| Buy, pay or subscribe to a service | Always | |
| Share a file or change who has access | Always | |
| Sign in to an account with your saved password | Yes | |
| "Allow access" for an app or extension to your accounts | Always, and review the list from time to time |
And one simple habit: give each agent only the access it needs for that task. Nobody hands the electrician the keys to the whole house to replace one outlet.
The yes that's still worth something
Agents will ask for approval less and less, and that's good: fewer requests, more attention on each one. But no AI knows what's irreversible in your life or your company. That list is yours, and it's worth writing down before your next automatic "yes".
If you or your team are already using agents with access to email, files or payments and nobody has defined what can go through without approval, send me a message and let's talk.
Sources
- Claude Code auto mode: a safer way to skip permissions, Anthropic
- Anthropic Bets Claude Code Users Are Safer With Fewer Permission Prompts, TechWyse
- OpenAI just launched its new ChatGPT agent, PC Gamer
- Ask Gemini in Chrome to complete tasks for you with auto browse, Google
- Agentic Browser Security: Indirect Prompt Injection in Perplexity Comet, Brave
- OAuth Consent Phishing Explained, Inforcer
