Anthropic found humans catch 14% of dangerous AI-agent actions when they're the ones clicking approve. That's the same safety net your back-office AI tools run on

Anthropic ran a controlled test of its own coding tool and found that when a person is asked to approve or block a risky AI action, they catch it about 14% of the time. An automated classifier catches 89%. As of August 14, Anthropic replaced the human-approval step with that classifier by default for Claude Code — a tacit admission that "a person clicks approve" isn't the safety control most software assumes it is, including a growing list of construction back-office AI tools built on exactly that pattern.

What did Anthropic actually change?

Claude Code is Anthropic's AI coding agent. Until now, it stopped and asked a person to approve each risky action — running a command, editing a file, deploying something — before proceeding. Starting August 14, new sessions on Pro, Max, and Team plans run in "auto mode" instead: every tool call routes through a classifier trained to block anything irreversible, destructive, or aimed outside the working environment, without stopping to ask first. When the classifier can't resolve something safely, it either finds a safer path on its own or falls back to asking a human — but the default posture flipped from "ask every time" to "ask rarely."

Why did human review only catch 14% of dangerous actions?

Anthropic's own numbers are the story here. In a controlled study with 1,053 paid professional testers, people approved 93-97% of permission prompts they were shown — not because the prompts were all safe, but because repetition trained them to stop reading. Catch rate on planted dangerous commands started at 13.6% and dropped to roughly 5% later in long sessions. The automated classifier held steady at 89% regardless of session length. The finding isn't that people are careless. It's that "review every action" is a control that decays predictably the moment it becomes routine — and coding agents, like most AI agents doing real work, generate a lot of routine.

What does this have to do with construction?

Nothing about Claude Code writing software is construction-specific. But the design pattern it just abandoned — an AI agent proposes an action, a person clicks approve, that approval is the safety control — is exactly how the current wave of construction back-office AI tools is built. Agents now log into insurance portals, state payroll sites, and owner document-control platforms and act the way a person would, drafting RFI responses, filling submittal transmittals, and staging pay applications, with a PM or PE reviewing before anything goes out. Anthropic just measured, with real professional users doing real repetitive work, how well that review step actually functions once it becomes a habit — and the number is 14%, not 100%.

Where does a GC or sub already lean on "someone approves it"?

• RFI and submittal drafting agents — a PE reviewing 30 AI-drafted RFI responses a week is the same repetition pattern Anthropic's testers hit.
• Pay application and change order tools — anything where an agent stages a number and a person signs off before it's released.
• Portal-automation agents — tools that log into Procore, Textura, or an owner's document system and act on a project's behalf, with a human "supervising" the session.
• Email and correspondence drafting — an agent that writes and a person sends, especially on high-volume, low-variance traffic like daily logs or status updates.

None of these are wrong to build. The problem is treating the approval click itself as proof the risky case got caught.

Should a GC copy Anthropic's fix?

Not literally — building a classifier that judges construction actions the way Anthropic's judges code commands is a real engineering project, not a policy switch. But the underlying move is copyable: stop treating "a human approves it" as sufficient on its own, and add a second, automated layer that doesn't get tired — hard blocks on irreversible actions (releasing a payment, sending an executed change order, deleting a file), scoped permissions so an agent can't act outside its lane, and full logging so a bad approval is at least traceable. That's the same shape as Anthropic's fix, sized for a job trailer instead of a codebase. Whoever owns your firm's AI-agent rollout should know that "we have a human review it" is not the airtight control it sounds like — Anthropic just put a number on exactly how leaky it is.

Forward this to whoever's piloting an AI agent on your project — especially if their pitch leans on "don't worry, someone reviews it before it goes out."

Friday one chart. Every week, one piece of data that should change a decision on your project. Subscribe at constructionaibrief.com.