What We'll Cover
- What Agentic Coding Actually Is 2 min
- How It Works (Simply) 2 min
- Agentic vs. Copilot-Style Tools 2 min
- What Actually Works Today 1 min
- What Doesn't Work (Yet) 2 min
- What Research Says 2 min
- Types of Coding Agents 2 min
- Multi-Agent Systems 2 min
- Security Concerns 2 min
- Getting Started 1 min
- Our Honest Take 2 min
1. What Agentic Coding Actually Is
Let's skip the buzzwords. Agentic coding means AI systems that can write, modify, and debug code on their own—without you typing each prompt. You describe what you want. The AI figures out how to build it.
That's the idea, anyway. The reality is messier.
Traditional AI coding tools like GitHub Copilot work like autocomplete on steroids. You type, they suggest. You accept or reject. You're still driving.
Agentic tools are different. They take a goal—"build a REST API for user authentication"—and then:
- Break it into subtasks
- Write the code themselves
- Test what they wrote
- Fix bugs when tests fail
- Ask you questions when they're stuck
The AI has agency. It makes decisions. It takes actions. It doesn't wait for you to type each line.
The Simple Version
Copilot-style: AI suggests code while you type. You're in control.
Agentic: AI writes code autonomously toward a goal. You supervise.
2. How It Works (Simply)
Most agentic coding systems follow the same basic loop:
1. You describe the goal. "Add a forgot-password feature to this app."
2. The agent plans. It reads your codebase, understands the structure, and breaks the task into steps: create password reset table, add email sending, build the form, write tests.
3. The agent executes. It writes code, runs it, checks if it works. If something breaks, it tries to fix it.
4. The agent asks for help. When it's stuck—unclear requirements, architectural decisions, external API credentials—it asks you.
5. You review and approve. Before anything goes to production, you check the work.
The key difference from traditional AI tools: steps 2-4 happen without you. You're not prompting each action. The agent is looping on its own.
Reality Check
This loop sounds clean. In practice, agents get stuck more than vendors admit. They hallucinate dependencies. They write code that looks right but breaks in edge cases. They sometimes need more hand-holding than the marketing suggests.
Agentic coding works best for tasks the AI has seen many times before. Novel problems are harder.
3. Agentic vs. Copilot-Style Tools
Copilot-Style Tools
Examples: GitHub Copilot, Cursor Tab, Codeium
- Suggest code as you type
- You accept, reject, or modify
- Works line-by-line or function-by-function
- You maintain control at every step
- Fast feedback loop
Best for: Writing code faster when you know what you want
Agentic Tools
Examples: Claude Code, Cursor Composer, Devin, Replit Agent
- Execute multi-step tasks autonomously
- You review completed work
- Works on features or whole projects
- Agent makes intermediate decisions
- Slower but more comprehensive
Best for: Tasks you can clearly specify but don't want to hand-code
Here's the honest truth: most developers use both. Copilot-style for quick edits. Agentic for bigger chunks of work. They're not competing—they're complementary.
The question isn't which is "better." It's which fits the task.
4. What Actually Works Today
After building agentic tools and watching the industry, here's what we've seen work reliably:
Works Well
- Boilerplate generation: CRUD APIs, database schemas, standard patterns. Agents excel at code you've written a hundred times before.
- Test generation: Given existing code, agents can write decent test suites. Not perfect, but a useful starting point.
- Bug fixing with clear reproduction: "This test fails, fix it" works better than "something's wrong somewhere."
- Code refactoring: Extracting functions, renaming variables, reorganizing files. Mechanical transformations.
- Documentation: Generating docs from code. Agents are often better at this than developers who "will add it later."
- Migrations: Converting code from one framework to another, when patterns are well-established.
Notice the pattern? Agents work best on well-defined, repetitive tasks. The more your problem looks like problems the AI has seen before, the better it performs.
5. What Doesn't Work (Yet)
And here's what fails more often than vendors admit:
Still Struggling
- Novel architecture: If you're building something genuinely new, agents struggle. They pattern-match to what exists.
- Complex debugging: Multi-system issues, race conditions, production-only bugs. Agents get lost.
- Large codebase understanding: Context windows are limited. Agents can't hold a 500k-line codebase in their head.
- Security-critical code: Agents introduce vulnerabilities. Hallucinated packages can be attack vectors (see: slopsquatting).
- Ambiguous requirements: "Make it better" or "improve performance" without specifics. Agents need clarity.
- Long-running tasks: Multi-hour autonomous work often drifts off course. Human checkpoints help.
That METR number is real. In a rigorous study, experienced developers were 19% slower when using AI coding tools on their own projects. Context-switching, debugging AI code, and integration overhead ate the gains.
Does this mean agentic coding is useless? No. It means the "10x developer" claims are oversimplified. The reality is more nuanced: AI helps in some contexts, hurts in others.
6. What Research Says
Let's look at actual data, not marketing:
METR Study (2025)
Experienced developers were 19% slower with AI tools on their own codebases. The researchers concluded that "claims of AI making developers dramatically faster may be overstated, at least for experienced developers on familiar projects."
GitClear Analysis (2024-2025)
Code churn (code that's changed or deleted shortly after being written) increased significantly in codebases with heavy AI usage. AI-generated code often needs more revisions than human-written code.
MIT Iceberg Index (2025)
AI can technically perform 11.7% of work tasks—but only 2.2% are currently being automated in practice. Technical capability doesn't equal real-world adoption.
Veracode Security Research (2025)
AI-generated code had higher rates of security vulnerabilities compared to human-written code in several categories. Speed came at the cost of security.
The pattern: AI coding tools show promise but also introduce new problems. The "productivity revolution" is real for some tasks, overstated for others.
7. Types of Coding Agents
Not all agents do the same thing. Here are the main types you'll encounter:
Code Generation Agents
Write new code from specifications. Good at: standard patterns, boilerplate, well-defined features. Struggles with: novel architectures, performance-critical code.
Testing Agents
Generate tests for existing code. Good at: unit tests, happy-path coverage. Struggles with: edge cases that require domain knowledge, integration test complexity.
Debugging Agents
Find and fix bugs. Good at: clear error messages, test failures, syntax issues. Struggles with: production-only bugs, race conditions, issues spanning multiple systems.
Refactoring Agents
Improve existing code structure. Good at: mechanical transformations, style consistency, dead code removal. Struggles with: architectural decisions, knowing when to stop.
Documentation Agents
Write docs and comments. Good at: API documentation, README generation, inline comments. Struggles with: architecture docs requiring broader context.
Most agentic coding tools combine several of these. Claude Code, for example, can generate, test, debug, and refactor—switching modes as needed.
8. Multi-Agent Systems
Here's where it gets interesting—and where the hype gets thick.
Multi-agent systems use multiple AI agents working together. One agent writes code. Another reviews it. A third runs tests. They coordinate like a small team.
The promise: agents with different specializations produce better results than one agent trying to do everything.
The reality: coordination is hard. Agents disagree. They duplicate work. They pass bugs back and forth. Multi-agent systems require careful orchestration.
Multi-Agent Strengths
- Separation of concerns (writer, tester, reviewer)
- Built-in code review
- Parallel execution for independent tasks
- Specialized prompts for each role
Multi-Agent Problems
- Coordination overhead
- Conflicting decisions
- Error propagation between agents
- Higher costs (more API calls)
- Harder to debug what went wrong
Our take: multi-agent works for specific, well-defined workflows. "50 agents collaborating on your codebase" sounds impressive but often creates more problems than it solves. Start with one agent doing one thing well.
9. Security Concerns
This section matters. Agentic coding introduces security risks that aren't obvious:
Slopsquatting
AI agents hallucinate package names that don't exist. Attackers register those names with malicious code. When developers install the hallucinated package, they get malware. Research found 440,000+ potentially affected packages.
Prompt Injection
Malicious content in code comments, documentation, or user input can manipulate agent behavior. An agent reading a file might execute hidden instructions embedded in that file.
Credential Exposure
Agents with access to your development environment might expose secrets in generated code, commit messages, or error logs. 80% of organizations report risky AI agent behavior.
Vulnerable Code Generation
Agents trained on public code learn from both good and bad examples. They can reproduce security vulnerabilities from training data.
Mitigations that help:
- Run agents in sandboxed environments
- Review all generated code before production
- Use lockfiles and verify package integrity
- Rotate credentials agents can access
- Audit agent actions with logging
Agentic coding is powerful. Unchecked agentic coding is dangerous. Treat agents like junior developers: useful, but needing supervision.
10. Getting Started
If you want to try agentic coding, here's a realistic path:
Step 1: Start with a simple task. Not your production app. Pick a side project or isolated feature. "Build a CLI tool that does X" is better than "refactor our payment system."
Step 2: Choose a tool and learn it. Options include Claude Code (Anthropic), Cursor Composer, Windsurf, or Replit Agent. Each has different strengths. Try one, get comfortable before comparing.
Step 3: Give clear, specific instructions. "Add a forgot-password feature using JWT tokens with 15-minute expiration" works better than "add password reset."
Step 4: Review everything. Don't trust. Verify. Read the code. Run the tests. Check for obvious issues.
Step 5: Expand gradually. As you learn what works, take on larger tasks. Keep a human in the loop for anything important.
Expectation Setting
You won't be 10x faster on day one. There's a learning curve. You'll fight with the agent sometimes. But for the right tasks, agentic coding genuinely helps—once you know its limits.
11. Our Honest Take
We build agentic coding tools. We obviously think they're valuable—otherwise why build them?
But we also see the problems. The 19% slower finding is real. Security vulnerabilities are real. Hallucinations are real. The gap between demo and production is real.
Here's what we believe:
Agentic coding works for well-defined, repetitive tasks on codebases the AI can understand. Boilerplate, tests, migrations, docs, straightforward features.
Agentic coding struggles with novel problems, complex debugging, security-critical code, and tasks requiring deep domain knowledge.
The best approach is human-AI collaboration, not AI replacement. Use agents for what they're good at. Stay involved for what they're not.
The hype is overblown—but the technology is still useful. Don't believe the "AI will replace developers" takes. Also don't dismiss agentic coding as a gimmick. The truth is in the middle.
The Bigger Picture
Yuval Noah Harari calls AI an "alien intelligence"—something that makes decisions we didn't anticipate in ways we don't fully understand. That applies to agentic coding too.
When you let an agent write code, you're delegating decisions. That's powerful when it works. It's dangerous when it doesn't. The skill isn't just prompting—it's knowing when to trust and when to verify.
We're in the early days. The tools will improve. But the fundamental challenge—human judgment about AI work—isn't going away.