Give people access to an AI assistant and their willingness to say "I don't know" collapses from 44 per cent to 3 per cent. Their accuracy falls from 27 per cent to 9 per cent. Their confidence roughly doubles.

Those numbers come from a paper posted on 15 July by Chiara Marcoccia at the École Normale Supérieure, Walter Quattrociocchi at Sapienza, and Valerio Capraro at Milano-Bicocca. Five experiments, 3,132 participants, four of them preregistered plus one direct replication. The researchers engineered the questions so the AI's advice would be wrong, which lets them separate the effect of using AI from the effect of AI being right. The effect held whether participants asked for the advice or simply had it displayed at them unbidden.

The headlines wrote themselves: AI makes you dumber, again. That is the least interesting thing in the paper, and it is not what the authors measured. What they measured is a shift in what they call the metacognitive threshold, the point at which a person decides they know enough to answer. Abstention is the variable that moved most violently. And abstention happens to be the only thing that the entire agent safety industry is currently relying on.

The pitch

Every agent deployment story ends at the same place. The agent plans, the agent calls tools, the agent proposes a change, and then a human approves it. Permission prompts in coding agents, approval gates in workflow platforms, the escalation path in an enterprise deployment. When you ask a vendor what stops the agent doing something catastrophic, the answer is a person.

This is a reasonable-sounding position and it is doing enormous load-bearing work. Deloitte's 2026 enterprise AI survey, as reported by TechTarget, has 74 per cent of companies planning to deploy agents within two years and 21 per cent claiming a mature model for governing them. The gap between those two numbers is being filled, almost everywhere, by a human with an approve button.

Now look at what that button actually is. Its output space has two values. Approve means "I have checked this and it is fine". Deny means, in practice, "I am not confident enough to let this run". Deny is an abstention. It is the same cognitive act as answering "I don't know", dressed in different clothes. The approval gate is a machine for converting human uncertainty into a halt.

So the finding is sharper than the headlines allow. It is not that AI exposure makes the supervisor worse in general. It is that AI exposure specifically degrades the one output the supervisor exists to produce, and inflates their confidence in the other one. Capraro's summary to The Next Web: "People became much worse, the accuracy was only one third, but they were twice as confident." Near as I can tell, nobody selling agent governance has priced that in.

The strongest case against this reading

The obvious objection is external validity, and it is a good one. The study asked people about visual details from films, including the colour of a team's uniform in Bend It Like Beckham. That is trivia. Participants had no domain expertise, no professional stake, and no reason to care. A senior engineer reviewing a diff in a codebase they have maintained for three years is a different animal entirely: they hold a mental model the AI does not have access to, and they are accountable for what merges. Generalising from a trivia panel to that reviewer is a stretch, and the authors do not claim otherwise.

There is a second objection, from people much closer to the work. Laura Summers of Pydantic wrote a piece in February describing exactly this exhaustion from the inside, including a colleague who wakes to thirty AI-authored pull requests a morning and feels the pull to hand the review itself to an AI, because "at that point, what am I still doing here?" But Summers reads it as a transitional problem: bad feedback loops, immature tooling, a craft mid-reframing, comparable to how designers felt when responsive layouts killed pixel-perfect control. Better observability, better ergonomics, better review surfaces, and the supervisor gets their judgment back. Pydantic build those tools, which makes them interested but also makes them the people who would know.

Both objections deserve better than dismissal, so here is what I think answers them.

On external validity: the researchers ran the incentivised condition precisely to test it. Paying for accuracy and penalising error did move the numbers, and the movement was pitiful. Willingness to abstain went from 3 per cent to 8 per cent. Accuracy went from 9 per cent to 16 per cent. Both remain far below the 44 per cent and 27 per cent baselines people managed with no AI at all. Stakes helped at the margin and left the effect intact. That is the direction of travel that matters, because production conditions are structurally worse than the lab, not better. In the experiment, the AI was always wrong. In a real agent workflow, it is right most of the time, which is the classic setup for vigilance decrement: the higher the base rate of "fine", the faster attention degrades, and the more expensive the miss.

On the transitional-tooling argument: we have a forty-year controlled experiment on whether better design fixes this, and it ran in hospitals. Clinical alarm fatigue was named, studied, funded, and regulated. The Joint Commission issued a sentinel event alert on alarm safety in 2013 and made alarm management a National Patient Safety Goal the following year, after reports of dozens of deaths tied to alarm-related incidents. The underlying number never really went away: estimates put 85 to 99 per cent of alarm signals as requiring no clinical intervention. Every intervention the agent-tooling world is now proposing, smarter thresholds, better grouping, contextual suppression, escalation tiers, was tried there first by people with regulators, budgets and dead patients as motivation. It improved things. It did not solve it. That is the base rate I would apply to "better UX will fix approval fatigue".

The thing making it worse

While the supervisor's capacity to abstain is being studied, the information available to them is quietly shrinking.

Since a change merged in early June, OpenAI's Codex encrypts the instructions a main agent passes to its subagents. Issue #28058 reports that session history now shows ciphertext where a readable task description used to be, and asks for a plaintext audit copy to be kept locally alongside the encrypted payload. The Decoder reported that the forced path now applies to the larger GPT-5.6 variants while the smallest still uses the open one, and that OpenAI has not said whether the motivation is blocking distillation, privacy, or both.

I do not think this is sinister, and the distillation motive is entirely plausible given what agent-to-agent traffic is worth as training data. But note the compound effect. The safety story asks a human to adjudicate what the agent is doing. The research says that human's threshold for adjudicating anything is already sliding. And the tooling is now removing the delegation record they would need in order to adjudicate well. Three trends, one direction.

The bet

The bet the industry is making is that a tired, over-confident human clicking approve on their four-hundredth diff of the week constitutes meaningful oversight. I don't have a clean read on how badly that fails yet, and it may fail gracefully for a long time before it fails visibly.

But there is a measurable version of this, and it is worth watching for. Approval-gate telemetry already exists in every agent platform that has a gate. The number to ask for is the denial rate: what fraction of proposed agent actions a human rejects, tracked over the tenure of that reviewer. If oversight is real, the denial rate should be roughly stable, or rise as agents are given wider scope. If it decays month over month toward zero while scope expands, the gate has become a formality and everyone can stop describing it as a control.

No vendor publishes that number. The first one that does is telling you something. So is every one that doesn't.