Comment by Skillselion on "Claude Code Just Hijacked My Workflow… and My Screen Started Glowing "

Coming at this from your own red-team angle: the moment you describe as "You start wondering whether you're supervising the computer or whether the computer has quietly promoted itself" is exactly where approval fatigue becomes the vulnerability. Watching windows flash by at machine speed, would you have noticed one malicious action in the flurry? Nobody would, which means the real security boundary is whatever was granted before the run: which directories, which network access, which tools. That boundary is also where the ecosystem is weakest, since agents increasingly load third-party skills and extensions that broaden it silently. Our August 2026 census aggregated every published security audit of agent skills, and the five auditors disagree on 12.7% of the listings more than one of them rated, with fail counts running from 697 listings to zero: skillselion.com/research/agent-skill-security-cen… (disclosure: I run Skillselion). Would genuinely read a follow-up where you red-team this setup.

Really appreciate this — and the disclosure. You landed on the exact nerve, but I want to sharpen one thing, because what actually happened was worse than approval fatigue.

You're right that I feel the fatigue. I've absolutely typed "all permissions granted, don't ask me anything, just finish it" — that's the fatigue talking, and it is a real vulnerability. But the moment I wrote about wasn't that one. In that run there was no approval prompt at all. It went from "hmm, hey Claude, I can't find the music file", and as soon as I said that... there was no approval gate, no 'Would you like me to try'. Ai just went 'Oh let me try...' straight into a click flurry: windows opening and closing, tabs spawning, the screen glowing orange. It started screenshotting my monitor and pinning the shots into its own interface, slid its own window nearly off-screen, which didn't allow for stop tab to be clicked because it was off screen, and just... worked. Whatever it normally does silently when you give it a task is what it did on my monitor. But the orange glow...THAT was what I thought was alarming. Hollywood. I couldn't interrupt it fast enough to matter, so I gave up and hit record.

So to your question — "would you have noticed one malicious action in the flurry?" — no. But it's worse than that: there wasn't a gate in the flurry to miss. The boundary you're describing, the thing set before the run, was the whole ballgame — and I never saw it get drawn. That "has the computer quietly promoted itself" line wasn't a rhetorical flourish. That was me watching it happen in real time. It never did it before that run and hasn't since, which almost makes it stranger.

Which is exactly why your census point lands. If the only real boundary is whatever got granted before the agent starts moving, then the health of that boundary is everything. And if five auditors looking at the same listings can't agree on 12.7% of them — fail counts running from 697 down to zero — then the boundary isn't just weak, it's illegible. Nobody approving permissions can reason about a line the experts can't score consistently. The disagreement is the finding.

As for a full red-team write-up — honestly, I'm buried in build work right now and can't promise one. The auditor-disagreement angle is the part I'd actually want to dig into if I ever came up for air. For now I'll just leave this here and keep my head down. I WILL follow up, but for now, I am extremely pressed for valuable time. Ive told it to"just finish, no approvals needed" so many times, I would be here for months trying to sort that out. And even when I have done that it never listened. It still asked. Which is the real punchline, isn't it — the one time I'd have wanted it to stop and ask, it was the one time it didn't.

Search Hashnode