Cloud Parts

AI coding agents

A language model in a loop with tools: it reads files, runs commands and edits code, sees each result, and decides the next step until the task is done.

9 technologies on this page ↓

How it works

You give the agent a goal, such as “fix the failing tests”. A program around the model, often called the harness, sends the model your request plus its context: instructions, earlier messages and the tools it may call. The model doesn’t act by itself. It answers with a proposed tool call, such as “read src/auth.ts” or “run npm test”. The harness checks that call against your permission rules, runs it (often inside an OS sandbox), and appends the output to the context. The model reads that result and proposes the next call, and the loop repeats until it answers in plain text: run the tests, read the error, find the file, edit it, run the tests again. Instruction files checked into the repository (AGENTS.md, CLAUDE.md, GEMINI.md) are loaded at the start of every session, because each session begins with an empty context. Extra tools, such as an issue tracker or a database, plug in through the Model Context Protocol (MCP), a JSON-RPC protocol where a server lists its tools (tools/list) and the agent calls them (tools/call). Everything the agent reads, runs and writes lands in one context window of limited size, so managing what goes into it decides how well the agent works.

Think of it as

A contractor working from a radio. They can’t see the house; they ask you to read a label, try a switch or open a wall, and you report back exactly what happened. The house rules taped by the door (the instruction file) tell them what not to touch, you refuse requests that break them (permissions), and their notebook only holds so many pages, so a good contractor writes a short summary before starting a fresh one.

Reach for it when

  • Changes you can check automatically: failing tests, type errors, lint fixes, dependency upgrades
  • Finding your way around an unfamiliar codebase before you change it
  • Mechanical work across many files, such as a rename or an API migration with a clear pattern
  • Backlog tickets a cloud agent can turn into draft pull requests while you do something else

Think twice when

  • Nobody will review the result: agents produce plausible code that can be wrong
  • There is no way to verify the change (no tests, no build, no way to run it)
  • The agent would get credentials or network access it doesn’t need; prompt injection in a web page or issue can steer it
  • Hard design problems in a codebase no one on the team understands well enough to review the plan

A real example

Dex Horthy of HumanLayer describes fixing a bug in BAML, a 300,000-line Rust codebase Horthy had never worked in. The agent first wrote a research document on how the relevant code works. The first attempt concluded the bug was invalid, so Horthy threw it away and ran the research again with more steering. A second session turned the research into a short implementation plan, and a third implemented it. The pull request took about an hour and was approved by the maintainer the next morning. A plan written without the research also “would have worked”, but fixed the problem in a worse place.

Kinds of ai coding agents

Specific products, and what each does differently.

Terminal agents →

Agents you start in a shell, in your repository, that use the tools already installed on your machine.

Claude CodeCommercialAnthropic’s coding agent: a terminal program, also available in IDEs, a desktop app and the cloud, that drives Claude models through a loop of reading, running and editing.Gemini CLICommercialGoogle’s open-source terminal agent for Gemini models; since 18 June 2026 it serves only paid API keys and business licences, as Google moved free and consumer users to Antigravity CLI.OpenAI CodexCommercialOpenAI’s coding agent: an open-source CLI, written in Rust, that works in your local repository inside an OS sandbox, plus an IDE extension and Codex cloud for tasks that run on OpenAI’s machines.OpenCodeOpen sourceAn open-source (MIT) coding agent that works with 75+ model providers and local models, built as a local server with a terminal interface as one of its clients.+1 Kilo CodeWarpOpen sourceA Rust, GPU-drawn terminal that keeps each command and its output in its own block, now open source and built around coding agents.Mainly Editors and terminals

Cloud agents →

Agents that run each task on a machine in someone else’s cloud, take work from a chat, ticket or web app, and come back with a pull request.

DevinCommercialCognition’s cloud coding agent: each session gets its own VM with a shell, editor and browser, takes a task from Slack, a ticket or the web app, and comes back with a pull request.

Permissions and sandboxes#

An agent can run any command you could, so two separate layers decide what actually happens. Permission rules say which tool calls run without asking, which prompt you, and which are refused. Claude Code checks deny rules first, then ask, then allow, so a broad deny such as Bash(aws *) can’t be undone by a narrower allow. OpenCode uses the same three outcomes but starts permissive: most actions default to “allow”. Most agents also offer a read-only planning mode that explores without editing.

The second layer is an operating-system sandbox around the commands the agent runs. Codex and Claude Code use Seatbelt on macOS and bubblewrap on Linux to confine writes to the working directory and to block or filter network access; Codex turns its sandbox on by default and keeps .git read-only even inside the workspace. Gemini CLI’s sandbox is opt-in (-s) and can use Seatbelt, Docker, Podman or gVisor. Cloud agents go further and run each task on a separate virtual machine or container.

Rules on command text are easy to sidestep: Claude Code’s docs note that a deny rule on curl doesn’t match the same program called by its full path or inside sh -c. The sandbox is what holds. Network access matters most, because anything the agent reads, such as a web page or an issue comment, can carry instructions (prompt injection) that it may follow.

Four terminal agents side by side#

They share the loop; they differ in which models they drive, which instruction file they read and how hard they fence in commands.

AgentInstruction fileModelsCommand sandboxLicence
Claude CodeCLAUDE.md; reads AGENTS.md in its placeClaude, via Anthropic or Bedrock, Google Cloud and Microsoft FoundrySeatbelt or bubblewrap, set up with /sandboxProprietary
OpenAI Codex CLIAGENTS.md, up to 32 KiB combined by defaultOpenAI models, with a ChatGPT plan or an API keyOn by default: Seatbelt, or bubblewrap plus seccompApache 2.0
Gemini CLIGEMINI.md; the file name is configurable, e.g. to AGENTS.mdGeminiOpt-in: Seatbelt, Docker, Podman, gVisor or LXCApache 2.0
OpenCodeAGENTS.md; falls back to CLAUDE.md75+ providers, plus local modelsPermission rules; most actions default to allowMIT

Context engineering: research, plan, implement#

In “Advanced Context Engineering for Coding Agents” (August 2025), Dex Horthy of HumanLayer argues that each turn of an agent is a stateless function call: context window in, next step out. The context is the only lever you have, so optimise it for correctness, completeness, size and trajectory. The worst things it can contain are, in order, incorrect information, missing information and too much noise. Searching files, reading code flow, test and build logs and large JSON from tools all fill it up.

Horthy’s answer is “frequent intentional compaction”: build the whole workflow around context and keep utilisation around 40–60%. Work happens in three steps, each in a fresh session that starts from the last step’s markdown file. Research finds the relevant files and how data flows, often using subagents so their searching never enters the main context. Plan lists the exact changes and how each phase will be tested. Implement works through the plan phase by phase, writing progress back into the plan file.

Human attention goes where it has the most leverage. A bad line of code is one bad line, a bad line in a plan can become hundreds, and a misunderstanding in the research can become thousands, so people review the research and the plan more closely than the diff. Horthy is clear about the limits: it isn’t magic, it needs someone engaged for hours, an attempt to remove Hadoop from parquet-java failed because the research didn’t go deep enough, and Horthy’s team of three was spending about $12,000 a month on Opus. Claude Code’s own docs make a similar point: performance degrades as the context fills, so explore and plan before you code.

A minimal AGENTS.md#

Plain Markdown with no required fields, at the repository root. Agents read the nearest file in the directory tree, so a monorepo can add one per package.

text
# AGENTS.md

## Setup
- Install dependencies: `pnpm install`
- Run the tests: `pnpm test` (must pass before you finish)

## Conventions
- TypeScript strict mode; no `any`
- Put new API handlers in `src/routes/`, one file per resource

## Don’t
- Edit generated files in `src/gen/`
- Commit or push; leave that to a human

In code · python

import shlex
import subprocess

ALLOW = {"echo", "python3"}  # permission rule: these run without asking


def run(command: str) -> str:
    argv = shlex.split(command)
    if argv[0] not in ALLOW:
        return f"denied: {argv[0]} needs approval"  # a real harness asks the user here
    done = subprocess.run(argv, capture_output=True, text=True, timeout=60)
    return (done.stdout + done.stderr)[-2000:]  # trim: long logs eat the context window


def model(context: list[dict]) -> dict:
    """Stand-in for the LLM: reads the whole context, proposes the next step."""
    script = ["echo starting", "rm -rf build", "python3 -c 'print(6 * 7)'"]
    step = sum(1 for m in context if m["role"] == "tool")
    if step < len(script):
        return {"tool": "run", "input": script[step]}
    return {"answer": "6 * 7 = " + context[-1]["content"].strip()}


context = [{"role": "user", "content": "Use Python to work out 6 * 7"}]
while True:  # the agent loop
    reply = model(context)
    if "answer" in reply:
        print(reply["answer"])
        break
    result = run(reply["input"])  # the harness, not the model, executes the call
    print(f"run({reply['input']!r}) -> {result.strip()!r}")
    context.append({"role": "tool", "content": result})

# run('echo starting') -> 'starting'
# run('rm -rf build') -> 'denied: rm needs approval'
# run("python3 -c 'print(6 * 7)'") -> '42'
# 6 * 7 = 42

Worth exploring

Video· August 2025Advanced Context Engineering for AgentsDex Horthy (HumanLayer), YC Root AccessA talk on getting coding agents to work in large, existing codebases by keeping their context small and correct: split work into research, plan and implement, compact each step into a Markdown file, keep context use around 40–60%, and spend human review on the research and plan rather than every line of code. Summarised here from the written version in HumanLayer’s GitHub repository, which also notes where the approach failed; HumanLayer builds tools for this workflow.
All resources →

Often confused with

Editors and terminalsContainersRemote access
Where it came from2021–2025

The first popular AI coding tools completed code as you typed. GitHub Copilot’s technical preview in June 2021 suggested whole lines or functions, powered by OpenAI’s Codex model, but it couldn’t open another file, run the code or see whether its suggestion worked. Research then gave models a way to act. The ReAct paper (October 2022) had a model interleave reasoning with actions against an outside environment and read back what happened. SWE-bench (October 2023) turned that into a hard test: 2,294 real GitHub issues from 12 Python projects, where the best model, Claude 2, resolved 1.96%.

In 2024 the loop met software engineering. Cognition announced Devin in March, an agent with a shell, editor and browser in a sandbox, and reported 13.86% on a quarter of SWE-bench. In May, SWE-agent showed that the interface mattered as much as the model: custom commands for viewing, editing and testing code lifted it to 12.5%. Anthropic’s December 2024 guide put the idea plainly: agents are “typically just LLMs using tools based on environmental feedback in a loop”, and they need ground truth from the environment, such as test results, at each step.

2025 brought the terminal agents: Claude Code in February, OpenAI’s Codex CLI in April and Gemini CLI in June. Shared conventions followed. Anthropic had open-sourced MCP in November 2024 as one protocol for tools, OpenAI released AGENTS.md in August 2025 as one place for project instructions, and in December 2025 both moved to the Linux Foundation’s new Agentic AI Foundation. By then the open question was less whether agents could code than how to feed them: practitioners such as Dex Horthy called it context engineering, getting the most out of today’s models by controlling exactly what they see.

Why it’s built this way

Let the model drive a loop of tool calls
One-shot generation can’t check itself. Running tests and reading the output gives the model ground truth at each step, and code is unusually well suited to this because results can be verified automatically.
Design the tools for the model, not just reuse human ones
SWE-agent found that a purpose-built agent-computer interface beat raw shell access, and Anthropic reported spending more time optimising tools than prompts, for example requiring absolute file paths after the model kept getting relative ones wrong.
Keep instructions in a file in the repository
Each session starts with an empty context. A checked-in Markdown file (CLAUDE.md, AGENTS.md) is loaded every time and reviewed like code; AGENTS.md chose a vendor-neutral name so one file works across agents.
Keep a human able to say no
Agents run real commands with real credentials. The MCP spec says there should always be a human in the loop able to deny tool calls, and agents add permission rules, sandboxes and read-only plan modes so autonomy can grow step by step.

Timeline

  1. 2021

    GitHub Copilot’s technical preview brings AI code completion to the editor

  2. 2022

    The ReAct paper has a model interleave reasoning with actions

  3. 2023

    SWE-bench tests models on 2,294 real GitHub issues; the best solves 1.96%

  4. 2024

    Devin (March) and SWE-agent (May) work real issues in a sandbox; MCP open-sourced (November)

  5. 2025

    Claude Code, Codex CLI and Gemini CLI launch; AGENTS.md released in August

  6. 2025

    MCP and AGENTS.md move to the Linux Foundation’s Agentic AI Foundation (December)

Sources20

Improve this page on GitHub