Coding Agents: When AI Changes the Code Itself

A code completion assistant suggests a few lines and you press Tab. A coding agent takes one sentence from you, reads ten files, changes six, runs the tests and says "done." If all goes well, an hour of work is finished in minutes. If not, you're facing a big change and don't know where to start reading it.

A coding agent is a tool that, given a goal, reads project files, changes them and runs commands such as the test suite on its own. The difference between a good and a bad result is usually not the model; it's the workflow. If you're not familiar with the concept of agents, first read what is an AI agent.

What exactly does a coding agent do?#

It works with four tools: reading files, searching the project, editing files and running terminal commands. With these, in a loop of thinking, acting and observing, it finds bugs, adds features or writes tests.

It comes in three common forms:

How do you prepare the project before the first run?#

With a clean Git state, a separate branch, runnable tests and an environment with no real keys:

1. Keep Git clean. No uncommitted changes should be left before you start.
2. Create a separate branch. If the work goes badly, you discard the whole branch.
3. Make sure tests run. The agent uses tests to know whether its work is right; a project without tests means the whole review burden falls on you.
4. Use a local environment with test data. A .env file with real keys and a connection to the production database should not be reachable by the agent.
5. A project instructions file. Most tools read a text file in the project root; some use a file like AGENTS.md and some their own file. Put the test command, naming rules and folders that must not be touched there.

git status
git switch -c agent/fix-discount-total
php artisan test

What permission level should you give the agent?#

Free reading, editing and running tests from an allowlist, and anything irreversible only with your approval. Serious tools have several permission modes, from "ask before every action" to "do whatever you want." The second is faster, but:

If you connect the agent to other tools such as a database or a code repository through MCP, the same rule applies there: read-only unless truly necessary.

What is a safe routine for a task with an agent?#

Four steps: first a plan, then changes in small steps, then a review of the changes, and finally a small Git commit.

1. Plan first, then change#

Goal: the order total is calculated incorrectly when a percentage discount code is applied; find the cause.
Do not change any files for now. Only:
1. Read the relevant files and tell me the likely cause.
2. Write the change plan step by step and say which files will change.
3. Say which test shows the error or what test should be added.
Do not modify existing test files without permission.

If the agent misunderstood the cause, this is the cheapest place to correct it, not after six files have changed.

2. Change in small steps#

After approving the plan, ask it to proceed step by step and run the tests after each step. If a test stays red and the agent tries the same approach several times in a row, stop it and look yourself.

3. Review the changes#

Don't believe the "done" report; look at the changes themselves:

git diff --stat
git diff -- tests/
git diff -- composer.json composer.lock

The second command shows whether tests were changed, and the third shows whether a new package was added.

4. Commit small#

Commit each completed task separately. Small commits make both review and rollback easier.

Where do agents usually go wrong?#

Where the goal or scope is vague, and where "tests turned green" replaces "the code became correct":

For the last one, AI code review helps, but it doesn't replace your own eyes.

WordPress and Laravel tips#

• WordPress: in every form and AJAX request the agent creates, check for a nonce, a capability check with current_user_can and output escaping. Don't let it edit WordPress core or someone else's plugin; changes belong only in your own plugin or a child theme.
• Laravel: read migrations line by line and allow a command like migrate:fresh only on a test database. If config or routes files change, ask why. More experience in AI in a Laravel project.

Where this is heading#

Coding agents are doing longer tasks more independently and increasingly run in the background or on several tasks at once. As a result, the developer's share shifts from "writing" to "defining the task precisely and reviewing," and automated tests and automated checks before merging go from a nice-to-have to a prerequisite.

To prepare:

• Raise the test coverage of your projects, starting with sensitive areas like payments.
• Write a project instructions file and keep it up to date like code.
• Practice reading a diff quickly and carefully; this skill is becoming more valuable.

Summary#

• A coding agent reads files, changes them and runs commands; the workflow matters more than the model itself.
• Clean Git, a separate branch, runnable tests and an environment without real keys.
• Get a plan and approve it first, then change in small steps.
• Review the changes with git diff, especially tests and new packages.
• Irreversible actions and anything involving the production server always need your approval.