Working with AI Coding Tools

"How do you use AI coding tools?" is now a standard interview question. Interviewers aren't checking whether you've heard of Claude Code or Cursor. They want to know if you can direct a coding agent like a capable but fallible colleague: scope the work, give it context, make it verify its output, review the result, and keep it inside safe boundaries. This page covers the tool landscape, how the tools work, the configuration primitives that are now similar across vendors, the workflows practitioners use, team rollout and security, and what the productivity evidence really shows.

1. The landscape (late 2026)

Autocomplete vs chat vs agent

The main tools, by where they run

Terminal agents. Claude Code runs in the terminal and also in IDEs, a desktop app, the browser and Slack, with the same agent loop everywhere. Anthropic docs 2026 OpenAI Codex CLI is open source, with codex exec for non-interactive runs, MCP, skills and plugins, and codex cloud for remote tasks. OpenAI docs 2026 Gemini CLI is Apache-2.0, uses GEMINI.md for context, has a headless -p mode, MCP, and a GitHub Action. GitHub 2026 GitHub Copilot CLI has a -p mode and --allow-tool / --deny-tool flags. GitHub docs 2026 Aider is the veteran open-source terminal pair programmer. Aider 2026 You may also hear about Amp, OpenCode, Cursor CLI, Factory and goose.

IDE agents. Cursor is a VS Code-derived editor with Tab completion, an agent, rules, skills, hooks, subagents and MCP. Cursor docs 2026 Copilot in VS Code has agent mode, MCP, custom agents and checkpoints. VS Code docs 2026 Windsurf was acquired by Cognition in July 2025 and reportedly rebranded as Devin Desktop in June 2026. Wikipedia 2026 Cline is an open-source editor extension with Plan/Act modes, a CLI and MCP. Cline 2026 Roo Code, Kilo Code, JetBrains Junie and Kiro (spec-driven) are in the same category.

Cloud and background agents. Codex cloud runs a setup phase with network access, then an agent phase that is offline by default. OpenAI docs 2026 Copilot cloud agent (formerly "coding agent") picks up issue assignments, @copilot comments or chat prompts, works in an ephemeral GitHub Actions environment, and opens a draft PR. GitHub and Playwright MCP are enabled by default. GitHub docs 2026 Claude Code in the cloud runs on Anthropic-managed VMs. You start it from the browser, phone or claude --cloud, pull it back with --teleport, and it can auto-fix PRs. Anthropic docs 2026 The Claude Code GitHub Action responds to @claude mentions or runs prompts on GitHub events. Anthropic docs 2026 Cursor Cloud Agents run in VMs and can be launched from the editor, web, Slack, GitHub, Linear or the API. They return PRs with screenshots and logs. Cursor docs 2026 Jules clones your repo into a VM and proposes a plan first. Google 2026 Devin works in its own shell, IDE and browser. Cognition docs 2026

2. How coding agents work under the hood

Every tool above is an LLM in a tool-use loop plus a harness that supplies tools, manages context and enforces permissions. Anthropic describes three blended phases (gather context, take action, verify results) and calls the surrounding layer the "agentic harness". Anthropic docs 2026 For general agent theory, see B4 · Agent Architectures.

Tools and edit formats

Claude Code groups its built-in tools as file operations, search (glob, regex), execution (shell, tests, git), web, and code intelligence (type errors and definitions via language-server plugins), plus orchestration tools for subagents and questions. Anthropic docs 2026 The shell is the key tool. It lets the agent use gh, test runners and any other CLI. Anthropic calls CLIs "the most context-efficient way to interact with external services". Anthropic docs 2026

How the model expresses an edit affects reliability and cost. Aider documents the options: Aider docs 2026

Modern harnesses mostly use the last option. The harness rejects an edit when old_string isn't unique or the file changed since the model last read it. Claude Code snapshots files before edits so you can rewind, but only for edits made through its file tools, not changes made via the shell. Anthropic docs 2026

Context gathering: agentic search vs embeddings

• Agentic search: the model iteratively runs grep/glob/read and follows imports. It's always fresh, precise for identifiers, and needs no index. It costs more turns on vague questions. Claude Code works this way and uses a read-only Explore subagent to keep search noise out of the main context. Anthropic docs 2026
• Embeddings index: chunk, embed and retrieve by similarity. It helps when you don't know the identifier. The costs are staleness, chunking quality and privacy. This is RAG for code (see B2).

The trend is toward fast local search plus agentic exploration. Cursor's current docs describe a local Instant Grep index and say Cursor "does not store embeddings of your codebase for search", with an optional parallel Explore subagent. Cursor docs 2026 That's a change from its earlier embedding-based indexing.

Context windows and compaction

Anthropic's guide says most best practices follow from one constraint: the context window "fills up fast, and performance degrades as it fills". Anthropic docs 2026 Near the limit, Claude Code clears older tool outputs, then summarizes the conversation. Instructions given only in chat can be lost, while the root CLAUDE.md is re-read after compaction. Anthropic docs 2026 Anthropic docs 2026 In practice: filter big outputs (pytest -x -q, | tail -50) or let a subagent read them. Connected MCP tools used to cost context just by being present, and Claude Code now loads MCP tool definitions on demand by default ("tool search"). Anthropic docs 2026 A session full of failed attempts biases the model toward them, so restarting is often better than more corrections.

Permission modes and sandboxing

Effective sandboxing needs both filesystem isolation (or the agent escapes) and network isolation (or it can exfiltrate keys). Claude Code uses Linux bubblewrap and macOS seatbelt, which also cover subprocesses. Anthropic reported 84% fewer permission prompts internally. Anthropic 2025

Model choice and reasoning effort

Harnesses let you pick the model and often a reasoning-effort level. Claude Code has /model, and Anthropic positions Sonnet for most coding and Opus for complex reasoning. Anthropic docs 2026 Codex custom agents can set model and model_reasoning_effort. OpenAI docs 2026 Rule of thumb: spend reasoning on planning and debugging, where one wrong turn wastes the session, and use cheaper models for mechanical fan-out and read-only search.

3. Configuration and extension primitives

Between 2025 and 2026 the major tools converged on the same extension points. Learn the concepts once and map the file names per tool. The layers run from "always in context, advisory" to "outside the model, enforced".

Project memory files

Markdown injected at session start, holding what you'd otherwise re-explain every time. Claude Code treats it as context, "not enforced configuration". Anthropic docs 2026

• CLAUDE.md: managed (org) → user ~/.claude/CLAUDE.md → project ./CLAUDE.md → local CLAUDE.local.md (gitignored). Ancestor-directory files are concatenated at launch, and subdirectory files load when Claude reads files there. @path imports pull in other files. .claude/rules/*.md with paths: globs load only for matching files. The docs suggest staying under about 200 lines. Anthropic docs 2026
• AGENTS.md: "a simple, open format for guiding coding agents", stewarded by the Agentic AI Foundation (Linux Foundation). Adopters include Codex, Jules, Cursor, Gemini CLI, Copilot's agent, Aider, Devin, Zed and VS Code. Rule: "the closest AGENTS.md to the edited file wins". agents.md 2026 Codex concatenates root-to-cwd files (with AGENTS.override.md taking priority) up to 32 KiB by default (project_doc_max_bytes). OpenAI docs 2026 Claude Code reads AGENTS.md when no CLAUDE.md exists, or you can import it with @AGENTS.md. Anthropic docs 2026
• Cursor rules: .cursor/rules/*.mdc with alwaysApply / description / globs, giving Always, Intelligently, Specific Files or Manually. Cursor also has nested AGENTS.md, plus User and Team rules. Cursor docs 2026
• Copilot: .github/copilot-instructions.md, path-specific .github/instructions/*.instructions.md, AGENTS.md anywhere, or a root CLAUDE.md or GEMINI.md. GitHub docs 2026 Gemini CLI: GEMINI.md. Gemini CLI docs 2026

What makes a good one: test each line with "Would removing this cause Claude to make mistakes?" Include commands it can't guess, non-default style rules, test instructions, repo etiquette, architectural decisions and gotchas. Exclude what the code already shows, standard conventions, tutorials and file-by-file descriptions. Bloated files get ignored. Emphasize the one rule that keeps getting skipped, not every rule. Anthropic docs 2026

# AGENTS.md  (one file for every agent; CLAUDE.md just contains "@AGENTS.md")
## Commands
- Install: `pnpm install` (never npm/yarn)
- Typecheck: `pnpm tsc --noEmit`   Lint: `pnpm lint --fix`
- One test file: `pnpm vitest run path/to/file.test.ts` (prefer over full suite)
## Architecture (non-obvious bits)
- Handlers in `src/routes/*` call services in `src/services/*`; never import `src/db/*` directly.
- Money is integer cents (`type Cents = number`). Never floats.
## Conventions
- Throw `AppError(code, httpStatus)`; don't return `{ error }` objects.
- New endpoints need: zod schema + OpenAPI annotation + route test.
- Ask before adding any dependency.
## Gotchas
- Integration tests need `docker compose up -d db` (else ECONNREFUSED).
- `src/legacy/` is frozen. Don't refactor it.
## PRs
- Conventional commits; keep PRs under ~400 lines; description must say how you verified.

Slash commands and prompt files

These are named, reusable prompts. In Claude Code, commands have been merged into skills: .claude/commands/deploy.md and .claude/skills/deploy/SKILL.md both create /deploy, with $ARGUMENTS substitution. Anthropic docs 2026 Gemini CLI uses TOML in .gemini/commands/ (subfolders become /git:commit). Gemini CLI docs 2026 VS Code uses .github/prompts/*.prompt.md and recommends migrating to skills. VS Code docs 2026

Skills (Agent Skills, SKILL.md)

A skill is a folder with a SKILL.md (frontmatter plus instructions) and optional scripts/, references/ and assets/. Anthropic created the format and released it as an open standard. Supporting clients include Claude Code, Codex, Gemini CLI, Cursor, GitHub Copilot, VS Code, OpenCode, Goose, Junie and Kiro. agentskills.io 2026 The core idea is progressive disclosure: (1) only name + description load at startup (about 100 tokens); (2) the body loads when a task matches (recommended under 5,000 tokens and 500 lines); (3) scripts are executed and references read only when needed. Required fields: name (≤64 chars, lowercase/digits/hyphens, matches the folder) and description (≤1,024 chars, saying what the skill does and when to use it). Agent Skills spec 2026 Tools add fields of their own. Claude Code, for example, has disable-model-invocation: true for manual-only workflows. Anthropic docs 2026 Locations: .claude/skills/, .gemini/skills/ or .agents/skills/. Gemini CLI docs 2026

.claude/skills/db-migration/
├── SKILL.md
├── references/conventions.md      # expand/backfill/contract patterns, locking rules
└── scripts/check_migration.py     # lints a migration; run it, don't read it

---
name: db-migration
description: Create and validate PostgreSQL migrations for apps/api. Use when asked to
  add/alter/drop tables, columns or indexes, or when a migration is mentioned.
---
1. Generate: `pnpm db:new <snake_case_name>` (never hand-name files).
2. Forward-only SQL. Large tables: follow references/conventions.md.
   Never add NOT NULL without a default in the same migration.
3. Validate: `python .claude/skills/db-migration/scripts/check_migration.py <file>`.
   Fix every ERROR; justify each WARNING in the PR.
4. `pnpm db:migrate && pnpm vitest run src/db`. Paste both outputs in your summary.

Subagents

A subagent is a separately prompted agent with its own context window, tools and optional model that returns a summary. In Claude Code they're markdown files in .claude/agents/, requiring only name and description. They start without your conversation history, and the built-ins include read-only Explore and Plan. Anthropic docs 2026 Cursor reads .cursor/agents/ and also .claude/agents/ and .codex/agents/. Cursor docs 2026 Codex uses TOML files in .codex/agents/. OpenAI docs 2026

# .claude/agents/test-reviewer.md
---
name: test-reviewer
description: Reviews a diff for test quality after a feature or fix, before commit.
  Flags weakened assertions, skipped tests and special-casing.
tools: Read, Grep, Glob, Bash
model: sonnet
---
You are a skeptical reviewer. You see only the diff and the task, not the reasoning.
Report with file:line: (1) assertions loosened or deleted? (2) tests skipped or snapshots
regenerated? (3) implementation special-cases test inputs? (4) do new tests fail if the
implementation is reverted? Run them to confirm. Correctness issues only, no style nits.

Use subagents for: file-heavy research, so the noise stays out of the main context; independent review in a fresh context, so the agent that did the work isn't grading it Anthropic docs 2026; and parallel fan-out, optionally in worktrees (isolation: worktree). Anthropic docs 2026 Avoid them for tightly coupled edits. Subagents don't share context, so parallel writers make inconsistent decisions. Parallelize reading, keep writing single-threaded (B4).

Hooks

Hooks are commands (or HTTP calls, MCP tools, prompts) that run at lifecycle events. Memory files are advisory, while "hooks are deterministic and guarantee the action happens". Anthropic docs 2026 Claude Code events include SessionStart, UserPromptSubmit, PreToolUse, PostToolUse, Stop, SubagentStop and PreCompact. Exit code 2 blocks where the event supports it: PreToolUse blocks the call, and Stop keeps Claude working. PostToolUse can only feed stderr back. Anthropic docs 2026 The equivalents elsewhere: Cursor .cursor/hooks.json Cursor docs 2026, Copilot .github/hooks/*.json GitHub docs 2026, Codex .codex/hooks.json OpenAI docs 2026, and Gemini CLI. Gemini CLI docs 2026

// .claude/settings.json  (committed: same guardrails for everyone)
{
  "permissions": {
    "allow": ["Bash(pnpm lint *)", "Bash(pnpm vitest *)", "Bash(git diff *)"],
    "deny":  ["Read(./.env)", "Read(./.env.*)", "Bash(git push *)"]
  },
  "hooks": {
    "PreToolUse":  [{ "matcher": "Bash",
      "hooks": [{ "type": "command", "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/block-dangerous.sh" }] }],
    "PostToolUse": [{ "matcher": "Edit|Write",
      "hooks": [{ "type": "command", "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/format-and-lint.sh" }] }],
    "Stop":        [{
      "hooks": [{ "type": "command", "command": "${CLAUDE_PROJECT_DIR}/.claude/hooks/require-green-typecheck.sh" }] }]
  }
}

# .claude/hooks/block-dangerous.sh  (tool call JSON arrives on stdin)
#!/usr/bin/env bash
cmd=$(jq -r '.tool_input.command // ""')
if echo "$cmd" | grep -Eq 'rm -rf /|git push --force|DROP TABLE|curl .*\| *(ba)?sh'; then
  echo "Blocked by policy: $cmd" >&2; exit 2     # 2 = block; stderr goes to Claude
fi

The allow/deny syntax follows the documented examples ("Bash(npm run test *)", "Read(./.env)"). Anthropic docs 2026 The Stop hook is the enforced version of "don't say done until typecheck passes". There's a cap on consecutive blocks so it can't loop forever. Anthropic docs 2026

MCP servers

MCP is the standard way to plug in external tools and data (protocol details in B4). MCP 2026 In Claude Code, servers are added with claude mcp add at local, project (.mcp.json, committed) or user scope. Anthropic docs 2026 Common choices: GitHub GitHub 2026 (though gh is cheaper on context); Playwright browser automation, so the agent can screenshot its own UI Microsoft 2026; up-to-date library docs (fewer hallucinated APIs); read-only databases; issue trackers; observability. Context cost: each tool's schema used to sit in every prompt, and many similar tools also hurt tool selection. Connect only what the project needs. Claude Code defers tool definitions via tool search by default and caps MCP output at 25,000 tokens unless configured. Anthropic docs 2026 A server that fetches external content is also an injection channel, so trust it as you would a dependency.

Plugins, headless mode and SDKs

Plugins bundle skills, hooks, subagents and MCP config into one installable unit (/plugin in Claude Code; skills become /plugin:skill). Anthropic docs 2026 Codex has plugins and Gemini CLI has extensions. GitHub 2026 A private marketplace is a natural way to share team defaults. Treat third-party plugins as code you run. Headless: claude -p with --output-format json and --allowedTools Anthropic docs 2026, codex exec OpenAI docs 2026, gemini -p Gemini CLI docs 2026, and copilot -p. SDKs: the Claude Agent SDK gives "the same tools, agent loop, and context management that power Claude Code" Anthropic docs 2026, and there's also the Codex SDK. OpenAI docs 2026 CI integrations are built on these.

Cross-tool mapping

"Yes" means the docs confirm the feature exists, without our verifying the exact file path.

4. Daily workflows that work

These come mostly from vendor best-practice guides (Anthropic's is the most detailed) and from practitioners such as Simon Willison. The common thread: separate thinking from typing, and make the agent prove its work.

Explore → plan → implement → commit

Anthropic's recommended loop: (1) explore in plan mode (Shift+Tab or --permission-mode plan), where Claude reads and answers but doesn't edit; (2) plan, and edit the plan directly (Ctrl+G); (3) implement against the plan, writing and running tests; (4) commit and open a PR. Skip planning when "you could describe the diff in one sentence". Anthropic docs 2026 Cline's Plan/Act modes follow the same idea. Cline 2026

Spec-first development

For larger features, ask the agent to interview you about implementation, UX, edge cases and trade-offs, have it write SPEC.md, then start a fresh session to implement. Good specs are self-contained, name files and interfaces, state what's out of scope, and end with an end-to-end verification step. Anthropic docs 2026 GitHub's Spec Kit packages a constitution → specify → plan → tasks → implement workflow as agent skills. GitHub 2026 Kiro is built around specs. Kiro 2026

# SPEC.md: Rate limiting for /v1/* (skeleton)
Goal: per-API-key token bucket, 100 req/min, burst 20; 429 + Retry-After.
Non-goals: per-endpoint limits, UI, auth middleware changes.
Design: Redis bucket via Lua (src/infra/redis.ts); middleware src/middleware/rateLimit.ts after auth.
Edge cases: Redis down → fail open + warn + metric. Missing key → auth returns 401 first.
Acceptance (one test each): 1) burst of 120 → 20 succeed  2) keys isolated
  3) Retry-After integer ≥ 1  4) Redis down → requests succeed, warn logged.
Verify: `pnpm vitest run src/middleware` and `pnpm test:e2e -g rate` green; paste output.

TDD with agents

Tests are the ideal agent spec. Have the agent write tests from the acceptance criteria (no implementation, no mocking it), confirm they fail for the right reason, commit them, then implement until green without touching the tests. Anthropic also suggests one session writing tests and another writing the code. Anthropic docs 2026 Committing first matters because the most common agent cheat is editing the test, and a committed test makes that show up in the diff.

The verification loop

The habit with the most impact. Give the agent "a check it can run: tests, a build, a screenshot to compare". Without one, "you become the verification loop". Escalation: ask for the check in the prompt, then make it a session goal, then a Stop hook, then a fresh-context reviewer that tries to refute the result. Ask for evidence (command plus output, or a screenshot), not claims. Anthropic docs 2026

UI iteration from mocks

Paste the mock, implement, screenshot the result, list the differences, fix, repeat. This is Anthropic's example prompt. Anthropic docs 2026 The agent needs a browser tool (for example Playwright MCP) to see its own output. Layout usually converges in a few rounds, but polish still needs a human eye.

Parallel agents with git worktrees

A worktree is a separate working directory on its own branch that shares the repo's history. One agent per worktree means edits never collide. Claude Code has this built in: claude --worktree feature-auth creates .claude/worktrees/feature-auth/ on branch worktree-feature-auth, .worktreeinclude copies gitignored files like .env, and you're prompted to clean up on exit. Plain git works with any tool. Anthropic docs 2026

# Plain git (any agent)
git worktree add ../app-ratelimit -b feat/rate-limit
git worktree add ../app-flaky     -b fix/flaky-auth-test
cp .env ../app-ratelimit/; cp .env ../app-flaky/          # gitignored files don't follow
(cd ../app-ratelimit && pnpm install && claude)            # terminal 1
(cd ../app-flaky     && pnpm install && codex)             # terminal 2
git worktree list;  git worktree remove ../app-flaky       # when merged

# Built in (Claude Code)
claude --worktree rate-limit      # .claude/worktrees/rate-limit, branch worktree-rate-limit
echo ".claude/worktrees/" >> .gitignore;  printf ".env\n" > .worktreeinclude

Parallel sessions also enable a writer/reviewer split. A fresh session isn't biased toward code it just wrote. Anthropic docs 2026 In practice, each worktree needs its own dependency install and its own ports, and most people's review quality drops beyond a handful of concurrent agents. That last point is folk wisdom, not a measured result.

Background agents for well-scoped tickets

Background agents are best for work that is well specified, independently verifiable and low-risk: a bug with a repro, a dependency bump, tests for an untested module, docs, a small feature behind a flag. One pattern: plan locally, commit the plan, then claude --cloud "Execute the migration plan in docs/migration-plan.md". Anthropic docs 2026 The cloud environment must be able to build and test the repo. Issue text written by anyone is an injection surface (§6).

Code review by and of agents

Agents make good first-pass reviewers when run in a fresh context with only the diff and the criteria. Because a reviewer told to find gaps "will usually report some, even when the work is sound", limit it to correctness and requirements. Anthropic docs 2026 When you review an agent's PR, read the tests first (meaningful? weakened?), then the core change, then scope and new dependencies. The output reads fluently whether it's right or not.

Debugging, onboarding, migrations, docs

• Debugging: pipe in the real error (cat error.log | claude), give the symptom, the likely location and what "fixed" means, ask for a failing reproduction test first, and say "address the root cause, don't suppress the error". Anthropic docs 2026 For murky bugs, ask for ranked hypotheses with a cheap experiment for each, because agents lock onto their first theory.
• Onboarding Q&A: ask what you'd ask a senior engineer, for example "look through ExecutionFactory's git history and summarize how its API came to be". Anthropic docs 2026 Nothing is written, so the only risk is being misinformed. Ask for file:line citations.
• Migrations (fan-out): the agent produces a file list, a script loops claude -p "Migrate $file ... Return OK or FAIL." --allowedTools "Edit,Bash(git commit *)", and you test on 2–3 files before running everything. Claude Code also has /batch, which splits a change across subagents in worktrees. Anthropic docs 2026 Use deterministic codemods for purely syntactic changes.
• Docs, tests, scripts: good to delegate. Derive tests from the spec, not the implementation, or they'll lock in its bugs.
• Prototype vs production: decide which you're doing before starting. The failure is a prototype quietly becoming production (§8).

Context hygiene and course-correction

• /clear between unrelated tasks to avoid "the kitchen sink session". Compact with a focus (/compact Focus on the API changes). Scope investigations or hand them to subagents. Anthropic docs 2026
• Keep state in files (PLAN.md, a checklist) so a fresh or compacted session can resume from disk.
• Interrupt early (Esc). Rewind with Esc Esc or /rewind. "If you've corrected Claude more than twice on the same issue", clear and re-prompt. Checkpoints don't cover shell side effects and don't replace git, so commit at known-good points. Anthropic docs 2026

A day in the life (illustrative)

5. The skills that matter

Agent failure modes

6. Team adoption and governance

Rolling coding agents out to a team is a change-management and security project, not a tooling purchase. DORA's 2025 report frames AI as an amplifier of existing strengths and dysfunctions, and finds that platform quality and clear AI policies determine whether individual gains show up at the organisation level (see §7). Google Cloud 2025

Shared configuration in the repo

• Commit the agent config: AGENTS.md (one file every tool can read, with a CLAUDE.md that imports it if needed), shared skills, subagents, hooks, .mcp.json, and permission allow/deny lists in project settings. Personal preferences go in gitignored local files (CLAUDE.local.md, settings.local.json). Anthropic docs 2026
• Org-level policy where available: Claude Code supports a managed CLAUDE.md and managed settings (for example permissions.deny, enforced sandboxing) that users can't override. Anthropic docs 2026 Cursor has Team Rules. Cursor docs 2026
• Own the config like code: review changes to AGENTS.md and hooks in PRs, prune regularly, and add a line when the agent repeats a mistake.

Conventions for AI-authored PRs

• Accountability: a human author owns every PR, whoever typed it. "The AI wrote it" is never an answer in review or in an incident.
• Disclosure: mark agent-authored or agent-heavy PRs (label, trailer, or the tool's default attribution) so reviewers calibrate, and so you can measure later.
• Evidence in the description: what/why, how it was verified (commands and output, screenshots), risks, and assumptions made.
• Size and scope limits: one concern per PR. Reject unrelated refactors and drive-by reformatting.
• No self-approval loops: an agent's PR can't be approved by an agent alone. Keep required human review and branch protection. Copilot cloud agent, for example, works within branch protections and rulesets. GitHub docs 2026

Review standards

Volume is the risk: when PR counts double, rubber-stamping becomes the failure mode. Use an agent first pass for mechanical issues, a checklist for agent PRs (test changes, dependencies, scope, error paths), and CODEOWNERS-enforced scrutiny for auth, payments and infra.

Measuring impact (and the pitfalls)

Run it like an experiment where you can: staged rollout by team, a baseline period, and paired quality and throughput metrics. Never use lines of code, PR counts or AI-acceptance rate as targets (Goodhart's law applies fast).

Security

Prompt injection is the defining risk. A coding agent reads large amounts of text it didn't write: repo files, dependency source, issue and PR comments, web pages, MCP tool results. Any of it can contain instructions. Simon Willison's lethal trifecta is the clearest model: an agent that combines (1) access to private data, (2) exposure to untrusted content and (3) the ability to communicate externally can be tricked into exfiltrating that data. Willison 2025 A background agent that reads a public issue, has a token with org-wide repo access, and has open internet egress has all three. Vendor docs echo this. Codex warns that "prompt injection can cause the agent to fetch and follow untrusted instructions" when network or web search is enabled. OpenAI docs 2026 Claude Code warns that MCP servers fetching external content create injection risk. Anthropic docs 2026

On slopsquatting, the USENIX Security 2025 study by Spracklen et al. tested 16 code LLMs over 576,000 generated samples. It found package-hallucination rates of at least 5.2% for commercial models and 21.7% for open-source models, with 205,474 unique invented package names. Spracklen+ 2025 Those rates were measured on 2024-era models in a specific prompting setup, so treat them as evidence that the risk is real, not as current rates.

Cost management

Drivers: context per turn, model tier, reasoning effort, parallel agents, runaway loops. Controls: budgets and alerts, cheaper models for subagents and fan-out, --max-turns and timeouts in CI, concise memory files, usage dashboards. CI runs consume both Actions minutes and tokens. Anthropic docs 2026 Anthropic docs 2026 Concrete per-seat prices change often, so look them up rather than quoting from memory.

7. What the productivity evidence actually says

Expect to be asked "does AI actually make engineers faster?" The defensible answer is "it depends on the task, the developer, the codebase and the year, and the best evidence is mixed". Then show you know the studies.

8. Vibe coding vs agentic engineering

Vibe coding was coined by Andrej Karpathy in February 2025 for a style where you describe what you want, accept the AI's code without really reading it, and steer by running it and prompting again. Collins named it Word of the Year for 2025. Wikipedia 2026 Karpathy 2025 Simon Willison proposed vibe engineering (October 2025) for the opposite end: experienced engineers using agents to go faster while remaining accountable for the software, which leans heavily on tests, planning, documentation, version control, CI and code review. In a February 2026 update he noted that "agentic engineering" seemed to be becoming the more popular term. Willison 2025

Most engineers do both, on purpose: vibe-code a prototype to test an idea, then rebuild it properly. The skill is noticing when a vibe-coded artifact is about to become production.

Interview question bank