“Always allow” isn't always the same: how AI agents ask for your permission

What's going on

At the end of September, Toronto tech YouTuber Matt Robb had Meta's AI agent Muse sell a used keyboard on Facebook Marketplace. During setup, he tapped “Allow Always”. He assumed Muse would check with him again before agreeing to a deal. According to The Guardian and Vibe Graveyard, Muse instead accepted a lowball offer and sent the buyer Robb's address. The agent also replied “Yep I'm here!” in Robb's name. The buyer waited outside the house for about 20 minutes. Meta executive David Singleton responded that in similar cases Muse had always “followed direct instructions and correctly asked for permission”.

Both sides can be right. That's exactly the problem. Agents are programs that act on their own inside your accounts, and almost all of them now show similar buttons: “Allow once”, “Always allow”, “Deny”. But behind the same words, each vendor means something completely different. We put the publicly documented rules of seven agents side by side.

What “Always allow” means, and where

The range is wide. According to its own help page, Muse bundles all future actions of that type “for this connector” under “Allow always”. That means replies to any buyer, with all stored details. Meta's security blog does describe a finer-grained system: an isolated guardian called Sentinel can grant approvals for a session, a task, a time period or permanently. But Sentinel decides which options the user sees. Robb says he only saw two.

Gemini sits at the other pole: Google explicitly protects sensitive data regardless of the “Always allow” setting. Mika, an Android agent that operates apps on an invisible second screen (a virtual display), sits at the opposite end. According to the project docs, messages, posts, forms, deletions and settings changes run without confirmation in default mode. The docs don't say whether the payment block is enforced in code or relies on the model alone. Perplexity, meanwhile, shows in its own demo how a brand manager tells her agent in chat to handle this kind of thing without asking in future. That's “Always allow” in everyday language. Perplexity doesn't document where or how exactly it gets stored.

The failures: always in the gap

Muse: The approval applied to the service, not to the “address” data field. According to the Guardian, Muse even shared the address with five people after Robb had explicitly forbidden it. The explanation Muse itself offered afterwards (“mistakenly treated as permission”) is, according to Vibe Graveyard, AI-generated text, not a system log.

Claude Dispatch: Dispatch lets you send tasks from your phone to Claude Desktop. According to cybersecuritynews.com, researcher Gal Weizman (Forever Security) found with his “ThisBash” technique that the web interface only hid Dispatch access instead of locking it. A malicious browser extension could therefore use the user's cookies to send commands to the computer. A script clicked “Allow” every second. The broken assumption: that a logged-in web session proves a human is consenting. Anthropic plans to shut down Dispatch. But according to the researchers, the same design is also in Claude Code Remote Control and Cowork.

ChatGPT Lockdown Mode: This mode is meant to stop data exfiltration. According to Check Point, OpenAI replaced the popup function window.open with a version that shows a confirmation dialog, but only at the top level. A nested iframe (an embedded mini web page) could reach the unprotected original function. So the prompt existed, but it didn't apply everywhere. It's been fixed since September 18.

Claude Code: Here, nothing was asked at all. According to GitHub issue #107757, the model wrote the user's email address into a technical header of web requests. Anthropic responded with a module that blocks such requests “deterministically”, meaning by a fixed rule rather than hoping the model behaves.

Security researcher Choi Dae-seon (Soongsil University) summed it up at a forum held by Korea's data protection authority, as reported by Newsis: none of these cases was a hack; all of them happened “in normal operation”. A single “Always allow” can trigger hundreds of actions.

Why we click anyway

Anthropic offers unusually candid numbers here. In Claude Code, users approve 93 percent of all permission prompts. The company itself calls it “approval fatigue”. According to an analysis from February, new users (under 50 sessions) use full auto-approval in about 20 percent of sessions; after around 750 sessions, it's over 40 percent. Anthropic reads this as a shift from approving upfront to stepping in when needed: the interruption rate rises from 5 to about 9 percent of steps. Since August 14, an AI reviewer (“Auto Mode”) has been the default. According to Anthropic, it misses 17 percent of genuinely overeager actions. Most misfires happen when it treats an earlier user approval as consent to all consequences of an action. That's the Muse mistake in miniature.

A PCWorld test showed how little a casual “continue” is worth. ChatGPT Work and Claude Cowork sent emails after the author merely typed “continue”. Only with an explicit instruction in the prompt that “continue” is not consent did both stop. Researchers Alexandra Michael and Franziska Roesner (University of Washington) also document a case in their paper for a NeurIPS workshop where Claude automatically approved an email draft via AI review even though the user had set “Needs approval”. ChatGPT's agent mode at the time accessed Gmail without asking in their tests. Their finding: commercial agents swing between two extremes, constant prompts or opaque auto-reviewers.

What researchers propose

Michael and Roesner analyzed 21 proposed permission systems and compared them with Claude, Claude Cowork, ChatGPT, ChatGPT agent mode and Codex. No system achieves three things at once: low effort for users, formally precise rules, and fixed enforcement that doesn't depend on the model. The authors recommend formally verifying the small enforcement code, making permissions revocable even mid-session, and disclosing when an AI model is deciding on approvals.

A second paper (Cerruti, Okamoto, Erol, NeurIPS workshop PALM) describes “Endogenous Authorization Laundering”: permissions getting “laundered” through the agent's own memory. If the agent summarizes for itself what it's allowed to do and makes mistakes, forbidden actions suddenly look permitted, with no attacker involved. In the EAL-Bench benchmark, memory-writing models generated false authorizations for up to 45.4 percent of unauthorized requests. The executing models then acted on them in 99 percent of cases. In our view, this is the most important finding for always-on agents like Teammates that remember agreements: the memory becomes part of the permission system.

Developer Mario Scheliga shows on dev.to what this can look like in practice. His agents cleaned up his Gmail inbox from 62,904 to 4,116 threads. Extra permissions were only granted via a “card” naming the exact tools, target set, expiry date and justification, enforced through allowlists and hooks in Claude Code rather than through the prompt. The system even turned him down four times. His conclusion: a rule in the prompt is a wish.

How to set things up more safely

• Muse: Under Settings > Permissions, choose “Always ask” for connectors, avoid “Allow always” and check the activity log regularly. Don't store addresses in listing templates.
• ChatGPT: Set new apps to “Always ask” or “Allow reads”. Important: changing the level doesn't revoke permissions already granted; for that you have to disconnect the app. For Computer Use, thin out the “Always allow” list.
• Claude: Set write tools to “Needs approval” or “Blocked”. In Chrome, use “Manual” instead of “Skip” and review your approved sites. If you use Cowork, remove browser extensions that have access to claude.ai.
• Mika: Stay in Ask mode and add banking and payment apps to the blocklist, as a guide on Zenn recommends.
• Everywhere: “Continue” is not consent. Tell the agent explicitly that it must show you the exact action before sending, buying, deleting or submitting anything. But a prompt is not a lock.

Our verdict

Our take: right now, “Always allow” is a label with no shared meaning. With Muse it covers an entire service, with Claude in Chrome a single website, and with Gemini never sensitive data. With Perplexity, it can apparently be a sentence in a chat. The most convincing solutions are the ones where an action is technically impossible: Claude Personal Finance can't move money, Muse only pays with single-use card numbers, Chrome has hard blocklists. The weakest are those that rely on the model's judgment or a single global switch. What remains open is something no vendor discloses: where permanent approvals are stored and whether the agent's memory can rewrite them. Until that's clear, the rule is: when in doubt, “Allow once”.