Hi Kyle,
    Following up in this thread having investigated the impact of coderefs.
My conclusion is that coderefs need to be stripped out before they are
passed to org-confirm-babel-evaluate. They are not present in the
executed code and removing them is not something that a definition
of org-confirm-babel-evaluate should have to know anything about.
Right now I work around them by suggesting that users comment
out their coderefs. This works because my use case is restricted to
elisp code and I strip the comments using read, but other languages
would not have such an easy solution.

I have included a patch against maint that reuses the let block
from org-babel-execute-src-block to accomplish this.

Best!
Tom