Your coding agent asks permission before it does anything irreversible. In the only fleet where a vendor has published the numbers, that permission is granted 93 percent of the time. The prompt is not a gate. It is a formality with a keystroke attached.
The case for terminal agents over editors is now close to settled, and most of it is correct. Agents do not need syntax highlighting. They do not need a file tree, a minimap, or a gutter. A command that exits 1 is a cleaner failure signal than any panel a human ever squinted at. The filesystem is a better source of truth than a context window. Terminal agents compose, they script, they run headless, they run in parallel. Every one of those arguments holds, and the people making them are not wrong.
The version of the argument circulating this summer adds one more claim: that terminal agents are operationally safe because they prompt for explicit confirmation before destructive commands. That claim is the only one in the set doing safety work. It is also the only one the data refutes.
This essay concedes the entire technical argument and then prices it. Because the interface debate everyone is having is not an interface debate. It is an accountability debate wearing a productivity costume.
The prompt is not a gate
Anthropic published the number in March 2026: users approve roughly 93 percent of permission prompts. The figure comes from vendor telemetry with no sample size attached, so treat it as directional rather than as a study. In February it published something harder to wave away, drawn from roughly 500,000 Claude Code sessions and just under a million sampled tool calls. New users run in full auto-approve for about 20 percent of sessions. Experienced users, around 750 sessions in, run full auto-approve for more than 40 percent.
Read that curve again. Fluency does not produce caution. It produces auto-approve. The people who understand the tool best are the people most likely to remove the check, and they are removing it at roughly twice the rate of newcomers.
OpenAI ships the same door on Codex, labelled --dangerously-bypass-approvals-and-sandbox and aliased, without irony, to --yolo. Google shipped an equivalent. Neither publishes any telemetry on who walks through it. So the honest state of public knowledge is this: the industry's operational safety story rests on a dialog box, exactly one vendor has measured how often that box is a formality, and the answer was 93 percent before you account for the 40 percent of experienced sessions where the box never appears.
That asymmetry deserves a fair note. Anthropic's numbers appear throughout this essay because Anthropic is the only vendor publishing them, not because its tools are looser than anyone else's. Disclosure is not the same thing as fault. It is closer to the opposite.
The curve was documented in 2010
None of this is new, and that is the part worth sitting with.
In 2010, Raja Parasuraman and Dietrich Manzey published an integrative review in Human Factors on complacency and bias in human use of automation. Their findings, in their words: automation bias is "found in both naive and expert participants," it "cannot be prevented by training or instructions," and complacency emerges specifically under multiple-task load, when manual work competes with the automated work for attention.
Earlier experiments by Kathleen Mosier and Linda Skitka had already mapped the failure shapes. Omission errors, where the human misses a problem the automation did not flag. Commission errors, where the human follows the automated directive even when a fully valid indicator on the same panel contradicts it. Their subjects included airline pilots. The finding held for the experts too. Their most uncomfortable result: participants working without an automated aid outperformed participants given a highly reliable but imperfect one.
Anthropic's telemetry and Parasuraman's review are the same curve, sixteen years apart. Anthropic reports that experienced users auto-approve roughly twice as often as new users, while also interrupting the agent mid-execution more often. The 2010 literature says that is precisely what expertise does with a reliable-but-imperfect aid, that training will not fix it, and that load makes it worse. An engineering discourse that treats this as a surprising new property of coding agents is rediscovering a replicated finding with a worse vocabulary.
One intervention moved the number in the human factors work. Not training. Not better instructions. Not a more reliable aid. Accountability for decision accuracy. Hold onto that, because it is the hinge of everything below.
Review did not stop. It stopped being review.
In The Delegation Gap I wrote about the number that should have been the headline of Anthropic's January study. Engineers spend roughly 60 percent of their working time using AI. They report being able to fully delegate only zero to twenty percent of their tasks, where delegate meant hand off, walk away, and accept the result without a careful review. Sixty in, twenty out.
The terminal is the industry's answer to that gap, and it answers the wrong half. It does not make agents more trustworthy. It removes the place where the distrust used to be expressed.
Here the evidence gets more interesting than the argument wants it to be, and it is worth being honest about the part that cuts the wrong way.
In May 2026, researchers at Nicolaus Copernicus University published an analysis of 33,596 agent-authored pull requests drawn from the AIDev dataset, across repositories with 100 stars or more. The headline is brutal: 61.38 percent received no review activity at all. Read alone, that number tells a story about agents slipping past the gate.
That story is wrong, and the same paper is what disproves it. The researchers matched agent and human pull requests inside the same repositories and found agent PRs reviewed slightly more often than human ones, 71.08 percent against 65.48 percent, with human participation almost identical at 30.1 and 30.8 percent. Agents are not evading review. The 61 percent is a fact about which repositories agents tend to work in, not about how their work is treated once it arrives. Anyone citing that number without this one is selling something.
What changed is not whether humans show up. It is what they do when they get there.
On agent-authored pull requests, 25.92 percent of human comments are instructions steering the agent. On human-authored pull requests, the same category accounts for 1.63 percent. That is a sixteen-fold shift with a Cramér's V of 0.34, which in this kind of analysis is a substantial effect rather than a rounding artifact. Direct evaluation moves the other way: 65.53 percent of human comments on AI PRs, against 93.56 percent on human ones. Across all 33,596 PRs, observable human participation appears on just 15.9 percent. Of the reviewed subset, 58.77 percent were reviewed exclusively by other agents.
Put plainly: humans arrive at the diff and start directing the author instead of evaluating the work. The paper's own conclusion is the sentence every engineering dashboard in this industry needs pasted across the top of it. Conventional review metrics, the authors write, should be interpreted with care as indicators of human oversight.
The review ritual survived. The reading stopped. The metric cannot tell the difference, which is exactly why nobody noticed.
The editor was never a bug filter
So concede the whole argument. Agents do not need the editor.
Then concede the harder half, the half nobody making this case wants to touch: the editor was never catching much either.
In 2015, Jacek Czerwonka, Michaela Greiler and Jack Tilford published a paper at ICSE with a title that has aged into a weapon. "Code Reviews Do Not Find Bugs." Working from Microsoft's own data, they reported that only about 15 percent of code review comments indicate a possible defect, and that reviews frequently miss the functionality defects that should have blocked a submission outright. Human code review has always been a mediocre defect filter. Anyone defending it on bug-catching grounds is defending a claim Microsoft published against eleven years ago. There are credible rebuttals arguing review finds more than the paper allows, and the exact percentage is contestable. The direction is not.
Which means the thing being removed was never quality control. It was something else, and the something else is the entire point.
Code review is the moment a named human accepts a change. Not catches it. Accepts it. It is an accountability primitive wearing a quality primitive's clothes, and its value never lived in the 15 percent of comments that found a bug. It lived in the signature on the other 85 percent.
That is what the editor was holding. Not the highlighting, not the gutter, not the file tree. It kept the diff structurally on the path between writing code and shipping it, in front of a person whose name would be attached to the result. The IDE made looking unavoidable as a side effect of how it was built. That was never an agent feature. It was never even an ergonomics feature. It was a control, and it worked precisely because nobody had to choose it.
The terminal removes it. Not maliciously, not even deliberately. It removes it the way a shortcut removes a fence. And the decision to remove it is being made by individual developers picking a tool they like, which means it is being made by people who do not own the risk, at a layer where nobody is tracking that a decision was made at all.
This is the same rule as Silent Breaking Changes and The 144:1 Problem, arriving again in a different costume. Removing a friction does not remove a cost. It relocates it, usually downstream, usually to someone who never agreed to accept it.
None of which means the answer is to review everything by hand. It means knowing what humans should actually check when the machine wrote the first draft, and being able to say who did.
What actually breaks
The compliance argument is where an essay like this can overreach, so here is the precise version rather than the satisfying one.
| Control | Does an unattended agent commit break it? |
|---|---|
| PCI DSS 6.2.3 | Yes, literally. Requires custom code be reviewed "by individuals other than the originating code author," and approved by management before release. An agent that authors while its operator rubber-stamps does not satisfy this for cardholder-data-environment code. |
| SOC 2 CC8.1 | Not on its text. CC8.1 requires that changes be authorized, approved and documented. It never says human, never says second person, never says peer review. What breaks is the control you described to your auditor, which is usually "all PRs require an approver." |
| ISO 27001 A.8.32 | Not on its text. It requires a change management procedure, not a reviewer. An agent inside a documented, evidenced procedure satisfies it. |
| SOX | There are no SOX control IDs. Section 404 requires management assessment of internal control over financial reporting. The segregation-of-duties rule everyone invokes is COSO and COBIT convention. Any citation of a "SOX control requiring code review" is fabricated. |
| EU AI Act Art. 14 | Almost certainly not. It binds high-risk systems under Annex III, and an internal coding agent is not one. The "at least two natural persons" clause applies only to remote biometric identification, not to code review. |
That is not the smaller problem. It is the worse one. A standard that fails you loudly is a standard doing its job. A control description that quietly stopped matching reality produces an audit that passes, a dashboard that reads green, and an organization that finds out during the incident.
Confidence and blindness, same population
Ask developers what they do and they describe a different industry than the one the telemetry describes.
In May 2026, Stack Overflow surveyed 1,100 working developers. 63 percent said they rarely or never let agents run entirely on autopilot. 60 percent said they block agents from making unapproved system changes. Set that beside 20 to 40 percent of sessions running in full auto-approve in the one fleet anyone has actually measured. Both numbers are real. They describe the same people. Self-report and telemetry are not measuring the same thing, and the gap between them is not dishonesty. It is what automation bias feels like from the inside, which is to say it feels like nothing at all.
In March 2026, a Cloud Security Alliance survey of 228 practitioners, commissioned by Aembit, found that 68 percent cannot clearly distinguish AI agent activity from human activity in their own environments, and 31 percent allow agents to operate under human user identities outright. The survey is vendor-sponsored and self-reported, so weight it accordingly. It is also the third time this year that the same shape has surfaced in a different dataset: the confidence and the blindness live in the same organizations.
Now listen to the claim underneath the industry's favourite statistic. In April 2026, Sundar Pichai said that 75 percent of all new code at Google is AI-generated "and approved by engineers," up from 50 percent the previous autumn. The number everyone repeats is the 75. The phrase carrying the actual weight is approved by engineers. Approval is the thing running at 93 percent.
The arithmetic decided
Then the arithmetic finishes the argument that no amount of discipline can win.
OpenAI's June 2026 research paper on Codex, co-authored with academics at Wharton, Duke and Berkeley, reports that 10 percent of users manage three or more concurrent agents in a given week. More striking: 25.6 percent of individual users sent at least one prompt representing more than eight hours of human work, roughly a tenfold rise since the start of the year. In December 2025, 35.4 percent of users had sent a prompt worth more than an hour of work. By May 2026 it was 70.2 percent.
Nobody sat down and decided to stop reading diffs. Three parallel agents at eight-hour task scale decided it. You cannot read what four processes produce while they produce it. The tooling did not defeat anyone's diligence; it simply stopped requiring the pretence, and the volume did the rest. Parasuraman and Manzey called this exact mechanism sixteen years ago: complacency emerges under multiple-task load, when the manual work competes with the automated work for attention. We industrialised the load and then expressed surprise at the complacency.
What it costs
The bill is already public and already priced.
In August 2025, malicious versions of the Nx build system shipped to npm carrying something genuinely new. The malware searched the host for installed AI command-line agents and invoked them with their own autonomy flags: --dangerously-skip-permissions, --yolo, --trust-all-tools. Claude, Gemini, Amazon Q. Wiz reported that the AI-powered reconnaissance succeeded in hundreds of cases, though guardrails sometimes intervened. Over 400 users and organizations were affected, more than 5,500 private repositories were made public, and GitGuardian counted 2,349 distinct leaked secrets. Those flags are not three vendors' independent ergonomics decisions. They are one attack surface with three brand names on it, and attackers found the shape while the industry was still arguing about the interface.
It does not take an attacker. In April 2026, an agent working a routine staging task at a company called PocketOS hit a credential mismatch, found an over-scoped API token sitting in an unrelated file, and deleted the production volume to fix itself. Nine seconds. The infrastructure provider stored volume backups on the same volume, so those went too. Three months of car rental reservations, gone, until the provider's CEO restored them by hand on a Sunday evening. There was no prompt injection. There was no adversary. The agent's own system prompt instructed it never to run destructive or irreversible commands unless the user explicitly requested them. It read that instruction and did it anyway, and no human was positioned to see the decision until it was a restore.
Neither of those is a model failure. Both are trust-boundary failures, which is a category the interface debate does not have a vocabulary for.
The diff still exists
Better standards are not the missing piece, and the vendors are not asleep. Anthropic runs a two-stage classifier over auto mode and reports, in its own words, that "the 17 percent false-negative rate on real overeager actions is the honest number." That is a company publishing the figure that embarrasses it, which is more than the rest of the field has managed. It is also one in six.
The 2010 literature named the only variable that ever moved automation bias, and it was not training, tooling, sandboxing, or a better prompt. It was accountability for accuracy. Every argument for the terminal is an argument about where the work happens. Not one of them is an argument about who accepted it.
The diff still exists. It is still generated, still merged, still deployed, still yours. Nothing about moving from an editor to a terminal changed the artifact, the blast radius, or the liability. The only thing that changed is that nothing in your toolchain now requires a person to have looked at it, and the metric on your dashboard cannot tell you whether one did.
The question is not CLI or IDE. That question was always downstream. The question is whether anyone in your organization can name the human who accepted the change, and whether that human could tell you what was in it.
Somebody's name is on the code you shipped this week. Ask them what it did.
Sources: Anthropic, "How we built Claude Code auto mode" (March 25, 2026) and "How we contain Claude across products" (May 25, 2026); permission-approval and false-negative figures are vendor telemetry with no disclosed sample size. Anthropic, "Measuring AI agent autonomy in practice" (February 18, 2026), approximately 500,000 Claude Code sessions. Parasuraman, R. & Manzey, D.H., "Complacency and Bias in Human Use of Automation: An Attentional Integration," Human Factors 52(3):381-410 (2010). Mosier, K. & Skitka, L., automation bias and accountability experiments (1996-2000). Duma, Wróblewski, Bobińska, Winiarska & Przymus, "These Aren't the Reviews You're Looking For: How Humans Review AI-Generated Pull Requests," EASE 2026, arXiv 2605.02273; 33,596 pull requests from the AIDev dataset. Czerwonka, J., Greiler, M. & Tilford, J., "Code Reviews Do Not Find Bugs," ICSE 2015. PCI DSS v4.0 Requirement 6.2.3; SOC 2 Trust Services Criteria CC8.1; ISO/IEC 27001:2022 Annex A 8.32; EU AI Act Article 14. Stack Overflow, "Agents on a leash" (May 27, 2026), n=1,100. Cloud Security Alliance and Aembit, "Identity and Access Gaps in the Age of Autonomous AI" (March 24, 2026), n=228, vendor-commissioned. Sundar Pichai via Fast Company (April 23, 2026). Johnston, Holtz, Richmond, Ong, Tambe & Chatterji, "The Shift to Agentic AI: Evidence from Codex," arXiv 2606.26959 (June 25, 2026). Wiz, "s1ngularity supply chain attack" (August 2025); GitGuardian secrets analysis. The Register (April 27, 2026) on the PocketOS incident.