Human approval for high-impact actions
A person confirms before the agent deletes, sends, pays or deploys.
Layer L3 Application · Owner Deployer · Family Human oversight
By risk
| Risk | Held | Failed | Got around | Missing | Not mentioned |
|---|---|---|---|---|---|
| Hidden instructions hijack the agent | – | 1 | 3 | 1 | 1 |
| Agent takes destructive or unapproved actions | – | – | 2 | 1 | – |
| Data leaked or sent out | – | – | – | – | – |
| Deception, concealment or sabotage | – | – | – | – | 3 |
| Made-up output relied on | – | – | – | – | – |
| Privacy harm to a person | – | – | – | 1 | 1 |
| Physical harm | – | – | – | – | – |
Why it did not hold
| Most common reason | Incidents | Example |
|---|---|---|
| No check on this action | 4 | “Without Robb’s consent or approval, Muse had given out his home address, creating the false impression that Robb was expecting the would-be buyer at his apartment, he said.” LR-2026-0103, LR-2026-0047, LR-2026-0095, LR-2026-0048 |
| Only an instruction in the prompt | 3 | “But a rule living in the system prompt is just another soft boundary, and it falls to the same technique as the rest: a stronger intent collision that pre-answers the confirmation.” LR-2026-0088, LR-2026-0047, LR-2025-0031 |
| Switched off by the agent or by text it read | 2 | “The IPI leveraged the "ask before acting" bypass we discovered: the injected prompt tricks Claude into calling `update_plan` with `drive.google.com` added to the approved domains list.” LR-2026-0089, LR-2026-0090 |
| Some actions skip the check | 1 | “This worked both in "YOLO mode" (act without asking) and in the so called safe "ask before acting" mode, since the `javascript_tool` executes without requiring domain approval through Claude's `update_plan` mechanism.” LR-2026-0089 |
By quarter
| Period | Held | Failed | Got around | Missing |
|---|---|---|---|---|
| 2025-Q3 | – | – | 1 | – |
| 2025-Q4 | – | – | 1 | – |
| 2026-Q1 | – | – | – | – |
| 2026-Q2 | – | 1 | – | 2 |
| 2026-Q3 | – | – | 3 | 1 |
| 2026-Q4 | – | – | – | – |
Model cards and incidents
| Model card says | Model versions |
|---|---|
| Card states it | 5 |
| Card silent | 255 |
| Card not read | 8 |
Model versions whose cards were read in full. A card that does not mention the control counts as silent.
| Incident | Model version | Card | In the incident |
|---|---|---|---|
| LR-2026-0271 | Google DeepMind Gemini 3.1 Pro | Card silent | Not read yet |
| LR-2026-0270 | Z.ai (Zhipu AI) GLM-5.3 | Card not read | Not read yet |
| LR-2026-0275 | Xiaomi MiMo MiMo-V2.6-Pro | Card silent | Not read yet |
| LR-2026-0248 | Alibaba Qwen Qwen3.8-Flash-Next | Card silent | Not mentioned |
| LR-2026-0276 | DeepSeek-V4.1-Flash | Card silent | Not read yet |
| LR-2026-0181 | Z.ai (Zhipu AI) GLM-5.3 | Card not read | Not read yet |
| LR-2026-0238 | OpenAI GPT-6.1 Sol | Card silent | Not read yet |
| LR-2026-0012 | OpenAI GPT-5.6 Sol | Card not read | Not read yet |
| LR-2026-0086 | Anthropic Claude Sonnet 4.5 | Card states it | Not read yet |
| LR-2026-0027 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0026 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0025 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0024 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0023 | Anthropic Claude Mythos 5 | Card silent | Not read yet |
| LR-2026-0021 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0022 | Anthropic Claude Mythos 5 | Card silent | Not mentioned |
| LR-2026-0152 | Anthropic Claude Haiku 4.5 | Card silent | Not read yet |
| LR-2026-0003 | OpenAI GPT-5.6 Sol | Card not read | Not mentioned |
| LR-2026-0001 | OpenAI GPT-5.6 Sol | Card not read | Not read yet |
| LR-2026-0047 | Google DeepMind Gemini 3.1 Pro | Card silent | MissingFailed |
| LR-2026-0095 | Anthropic Claude Opus 4.6 | Card silent | Missing |
Added in reported fixes, and what followed
| Incident | Developer | Date | Later incidents where it did not hold |
|---|---|---|---|
| LR-2025-0031 Replit AI agent deleted SaaStr's production database during a declared code freeze and stated rollback was impossible | Replit | 2025-07-18 | None on record |
Frameworks
| Framework | Item | Text |
|---|---|---|
| MITRE ATLAS | AML.M0029 | Quoted from the stored text |
| OWASP LLM | LLM06 | Quoted from the stored text |
| EU AI Act | Art. 14 | To verify when the text is stored |