Agentic coding: what actually changes when the model runs a loop

The loop

Autocomplete predicts the next few tokens at your cursor. An agent runs a loop. That is the whole definition, and everything below is a consequence of it.

AUTOCOMPLETE                    AGENT

you type                        you describe an outcome
  model predicts                  model reads files
  you accept or not               model runs a command
  repeat                          model reads the output
                                  model decides what next
                                  ... until done
                                you review a diff

The consequential difference is the fourth line on the right. An agent can run your tests, read the failure, and try again. That feedback loop is why it can finish a task rather than produce a plausible first draft, and it is why an agent can work unattended for twenty minutes while an autocomplete cannot work unattended at all.

What one turn actually contains

A turn is not one request. A single instruction like "make the failing test pass" typically produces a dozen model calls, each one carrying the whole conversation so far plus whatever the last tool returned.

1. You send an instruction. The harness prepends a system prompt, your project memory file, tool definitions, and environment details.
2. The model emits a tool call. Read a file, run a command, search the repository.
3. The harness executes it, subject to whatever permission mode you are in, and appends the result to the conversation.
4. The whole conversation goes back to the model, which decides what to do next.
5. Repeat until the model emits text instead of a tool call, or until you interrupt it.

Most of the product is the harness

People compare agents by comparing models. That gets the proportions wrong. Two harnesses running the same weights produce very different experiences, because the harness owns everything between the model and your filesystem.

Why it prices differently from chat

Every turn re-sends the accumulated conversation so the model can decide what to do next. That single property explains most surprising bills.

• Cost grows with turns squared, not linearly. Caching flattens the curve substantially but does not change its shape.
• Reading dominates. A coding session is overwhelmingly input tokens. Output is a rounding error on the token count and a large share of the bill.
• Turn count is driven by prompt precision. A vague prompt that sends the agent exploring costs multiples of one that names the files. Anthropic makes the same point in its own cost guidance: "improve this codebase" triggers broad scanning, while naming the function does not.

Caching is why this is affordable at all

Prompt caching is what stops the quadratic curve from being fatal. On the Anthropic API, as of August 2026, a cache write costs 1.25x the base input rate at the five-minute TTL and 2x at the one-hour TTL, and a cache read costs 0.1x. A conversation prefix that stays byte-stable is therefore re-sent at a tenth of list price on every subsequent turn.

For scale, Anthropic reports an average of about $13 per developer per active day across enterprise deployments, and $150 to $250 per developer per month, with 90% of users staying under $30 per active day, as of August 2026. Those are API-billed figures. On a subscription you pay a flat fee and hit a usage window instead of a bill, which is a different failure mode rather than a cheaper one.

The autonomy dial

Every serious agent now ships a setting for how often it stops to ask you. This is the most consequential configuration in agentic coding and the one people leave on the default without deciding.

In the Claude Code CLI, Shift+Tab cycles default, acceptEdits, and plan. dontAsk and bypassPermissions are opted into at launch; auto appears once your account qualifies for it. Codex defaults to workspace-write with on-request approvals inside a git repository, and OpenAI recommends read-only for a folder that is not version controlled.

• Auto mode is not a rubber stamp. As of August 2026 its classifier blocks curl | bash, force push, production deploys and migrations, git reset --hard, and irreversibly destroying files that existed before the session, all by default.
• It gives up rather than nagging. After 3 consecutive blocks or 20 in a session, auto mode pauses and Claude Code goes back to prompting. Those thresholds are not configurable.

What changes about your job

Three habits it forces

1. Write conventions down. Things you knew implicitly now have to exist in a file, because the agent cannot absorb them from your codebase the way a colleague does over months. Anthropic suggests keeping CLAUDE.md under about 200 lines and moving longer workflow instructions into skills that load on demand.
2. Review deletions as carefully as additions. Removed lines get less scrutiny and are where regressions live.
3. Commit before unattended runs. Git becomes the undo button, and a clean tree is the difference between a reset and an investigation.

The security shape

An agent that can run commands is a process acting with your credentials on input you did not write. Two consequences follow, and neither is solved by prompting.

1. Instructions are not boundaries. Telling a model not to do something is a preference. Capability limits are controls: read-only tools, an OS sandbox, a token that cannot merge, a deny rule on a path.
2. Content the agent reads can instruct it. A comment in a contributed patch, a README in a dependency, a page fetched from the web. If the agent can act, that content is an instruction channel. OpenAI states it plainly for Codex: prompt injection can cause the agent to fetch and follow untrusted instructions, so treat web results as untrusted.

How to tell whether it is working

Agentic coding is unusually measurable, because every turn leaves a record on disk. Five signals separate a workflow that is compounding from one that is quietly costing you.

The last row is the one to watch. Every other number can improve while that one degrades, and when it does, the productivity gain is a loan rather than a return.

Questions people ask

Keep reading