I too like the idea of an option to either leave the green box open until the user acknowledges it or close it after a certain number of seconds if no threat found. If it used to behave a certain way and that behavior is changes I would think it best to give users the option of what they want.