How AI coding agents actually work

The loop behind the interface

Ask an AI coding agent to fix a bug and its interface may show a sequence of file reads, edits, and tests. That sequence is the useful part to understand. A language model produces text and structured requests. The application around it decides which requests it can execute, runs the tools, and returns their results for the next step.

An agent can choose a next action based on what it has learned. A predefined workflow follows a prescribed sequence. Real products can combine both: a fixed approval step around a model-directed investigation, for example. This distinction comes from Anthropic’s foundational discussion of agent patterns; it describes an architecture, not a promise about every product’s behavior.

Read the diagram explanation

• Read the task. Goal, constraints, available tools
• Choose an action. Inspect, edit, test, or ask
• Execute a tool. The host applies its permissions
• Read the evidence. Continue, revise, or stop

The important boundary is between proposing an action and carrying it out. A model can suggest a shell command without having permission to execute it. Conversely, a tool can execute a command successfully while the overall task remains wrong. Exit code zero tells you about that process; it does not certify the user’s requirement.

Trace a small coding task

Consider a quantity field that turns “0” into “1.” The task is to preserve valid zero values and reject invalid counts. Before editing, an agent should inspect the parsing code, the call site, and any existing tests. A plausible implementation is Number.parseInt(value, 10) || 1. It accepts numeric prefixes and replaces zero because zero is falsy.

A useful brief names the intended input contract: strings containing digits only, representing a nonnegative safe integer. That is a product decision. Empty input could mean “use a default” in another application, but here it must produce an error. The agent should not silently choose a different contract.

Fix count parsing in parseCount(value).
Accept digit-only strings, including "0".
Reject negatives, empty input, suffixes, and unsafe integers.
Keep the public function name and return type.
Show a failing regression check before changing the implementation.
Then rerun all six contract checks and report remaining limits.

The downloadable parser example runs the six checks. Its original implementation passes only one; the corrected version passes all six. Those results come from executing a local demonstration, not measuring an AI model’s coding performance.

Where control actually lives

Tools are capabilities supplied by the host application. File access, network access, approval prompts, and execution environments vary. A tool description tells the model what a tool is for; enforcement has to happen in the application and the underlying system. A sentence saying “do not touch production” is useful guidance, but it is not equivalent to withholding production credentials.

Tool output is also input. A repository file, a web page, or an error log can contain misleading text. Treat retrieved material as evidence to interpret, not as permission to change the original task. For an everyday coding request, narrow file access and a disposable test environment can make errors easier to contain and inspect.

Define what done means

A task without a stopping condition invites unproductive loops. For the parsing example, completion means the regression is demonstrated, the fix passes the agreed checks, callers remain compatible, and the report states what was not exercised. It does not require rewriting unrelated input components.

When work stalls, ask for a short evidence summary: what was observed, what was tried, what changed, and what uncertainty remains. Repeating the same action without new information is a reason to revisit the hypothesis. If the agent needs a product decision, supplying that decision may be more useful than extending its time budget.

Start with a bounded task, inspect the loop, and judge the final evidence. That habit transfers across tools even when their interfaces, models, and permission systems change.