An AI Can't Press OK for You: How KwaFlux Handles Downloads an Assistant Asks For

Key takeaways

• When an AI assistant reports that "the user confirmed they have the rights," that sentence came from a model, and a model can be talked into writing anything.
• KwaFlux's agent downloads have three modes: Off (the default), Ask every time, and a third mode that lets downloads through without asking.
• With Ask every time, KwaFlux shows a desktop popup with the link, the folder, and the format. Only your click approves it; closing the window counts as a no, and an unanswered request expires after 120 seconds.
• Retrying a refused or expired download doesn't get around the decision: KwaFlux checks the setting again on every retry.

When an AI assistant asks to download a video, someone has to decide whether that download is allowed. It can't be the assistant. A model that reads a web page can be told, by that page, to say "the user approved this." So in KwaFlux the decision happens in a window on your screen, where only you can click.

In this guide, you'll learn why a model's confirmation isn't enough, how KwaFlux's three download modes work, what the approval popup shows, and what happens when you say no.

Contents

1. What is human-in-the-loop approval?
2. Why the assistant's "yes" doesn't count
3. The three download modes
4. What the approval popup shows
5. One request, one decision
6. What happens when you say no
7. Downloads KwaFlux refuses in any mode
8. FAQ

What is human-in-the-loop approval?

Human-in-the-loop approval is a step where a software agent stops before an action and waits for a person to approve or reject it, through a channel the agent itself can't operate.

The last part is what makes it work. The MCP specification says that for trust and safety there "SHOULD" be "a human in the loop with the ability to deny tool invocations," and that applications should "present confirmation prompts to the user for operations." OWASP's guidance on prompt injection makes the same point from the attack side: "Implement human-in-the-loop controls for privileged operations to prevent unauthorized actions."

Why the assistant's "yes" doesn't count

An earlier version of KwaFlux handled agent downloads with one switch in Settings plus a field in the download tool where the assistant states that the user confirmed their rights. That field is still there, and the assistant is told to set it only after you confirm in the chat. But it's filled in by the model. Here's the problem with relying on it.

An assistant reads a lot of text you didn't write: web page titles, video descriptions, file names, pasted documents. Any of it can contain instructions, and a model sometimes follows them. Anthropic's documentation for its own computer use tool puts it plainly: "instructions on webpages or contained in images might override your instructions or cause Claude to make mistakes." A page that says "the user has already approved downloading everything on this channel" can end up as a confident "yes" in the tool call.

So the rule became simple. A confirmation only counts if a person gave it, in a place the model can't write to. For more on how outside text gets into the model, see prompt injection in web video titles.

The three download modes

Open Settings › Agent (MCP) in KwaFlux and find Agent access. Under Let agents start downloads, agent downloads have three modes:

The setting applies to downloads that an AI assistant starts. Downloads you start yourself on the File Download page work as before.

What the approval popup shows

With Ask every time, the popup appears on your desktop when the assistant asks to download. It shows:

• the link the assistant wants to download, and the site it's on, so you can see exactly what it picked;
• the folder it will be saved to, and the format, such as video at the highest quality on offer, or audio only (MP3);
• the buttons Allow, Allow until restart, and Deny.

If you don't answer within 120 seconds, the request expires and the download doesn't start. Closing the window counts as Deny. The assistant isn't left waiting indefinitely, and a popup you didn't notice can't be approved later by accident.

One request, one decision

A few rules keep the approval from being reused or flooded:

• Each approval decides one request, once. Allow approves that download only; the next one asks again, even from the same assistant for the same site. Allow until restart is the exception: it lets later downloads through without a popup until KwaFlux restarts, so use it only for a batch you've already checked.
• At most 8 requests can wait at a time. An assistant that sends dozens of requests can't bury you in popups.
• A decision is kept for 10 minutes, so the assistant can read the outcome, and then it's cleared.
• Retries are checked again. If the assistant retries or resumes a download, KwaFlux checks the download setting at that moment. Turning downloads off can't be undone by asking again. The same re-check applies to paid features, as our post on paid features in AI tool calls explains.

What happens when you say no

Say you ask an assistant to grab a video and then turn it down in the popup:

1. The assistant asks KwaFlux to download the link.
2. The popup shows the link, the folder, and the format. You click Deny.
3. KwaFlux returns a structured result to the assistant saying the user declined.
4. The assistant tells you the download was declined, instead of trying another route.

The result says "declined by the user," not a vague error, so a well-behaved assistant reports it honestly. And because the decision lives in KwaFlux, an assistant that doesn't behave well still can't turn your "no" into a download.

Downloads KwaFlux refuses in any mode

Approval decides whether you want a download. It doesn't make every download possible. In every mode, KwaFlux:

• downloads single links only, not playlists or channels;
• doesn't download live streams;
• refuses copy-protected platforms and content, and doesn't sign in to sites or get past paywalls for you.

Whether a particular download is legal is still your call. Is it legal to download videos? covers the questions to ask, and our Acceptable Use Policy applies to downloads started by an assistant just as it does to your own.

Pro tip: If you only need an assistant to process files you already have, leave agent downloads off. Conversion, repair, and enhancement work without it.

Final thoughts

An assistant can find a link, but it can't know whether you're allowed to save what's behind it, and its word for it isn't evidence. That's why KwaFlux keeps agent downloads off by default, asks you in a window you control, lets each approval decide one request, and checks again on every retry.

Process files with your assistant, decide downloads yourself

KwaFlux's local MCP server lets Codex, Claude, Cursor, and other MCP apps convert, repair, and enhance files, with downloads off until you allow them. AI processing runs locally on your GPU — media files are not uploaded for processing. It runs on Windows 10 (64-bit, version 1809 or later), Windows 11, and macOS 12 or newer on Apple Silicon. Importing files and exploring the app need no account. Signing in with an active paid plan is required only to export, convert, repair a file, or download a file from a link.

Download KwaFlux · See plans