Can AI Agents Build Websites Autonomously?

The Hype vs. The Reality of Autonomous Agents

Depending on who you ask, AI agents are either already building production software while you sleep, or they're just chatbots with a new marketing name. The truth, as usual, sits uncomfortably in between — and it matters a lot if you're deciding whether an agent can build your next website.

The adoption numbers suggest the "era of AI agents" is genuinely here. According to LangChain's State of AI Agents survey, 51% of professionals already run agents in production, and 78% have active plans to implement them. Microsoft went as far as declaring that "we've entered the era of AI agents" at Build 2025, pointing to 15 million developers using GitHub Copilot.

Yet the same survey reveals a striking contradiction: very few teams allow their agents to read, write, and delete freely. Most restrict agents to read-only permissions or require human approval for significant actions. So agents are everywhere, but they're on a short leash.

The skeptics have a point, too. IBM's experts argue that what the market calls "agents" is really just rudimentary planning and tool-calling bolted onto LLMs — with one researcher quipping, "You've renamed orchestration, but now it's called agents."

Where you land depends on which evidence you weigh:

• Capability is real: Rakuten used Claude Code to complete a task in a 12.5-million-line codebase in seven hours of autonomous work with 99.9% numerical accuracy.
• Control is deliberate: most teams require human approval for write and delete actions, even in production deployments.
• Quality, not cost, is the dominant concern — performance worries outweigh cost and safety by more than 2x.
• Security gaps persist: 24% of surveyed MCP servers ship with no authentication at all.

That last point matters for anyone wiring an agent to external tools and skills. Published research has found that roughly 26% of agent skills carry at least one vulnerability — which is why SkillzBench is building a directory where every skill is security-scanned, version-pinned, and benchmarked in a sandbox before you equip it.

So the honest question isn't whether agents can build websites — it's what they can build on their own, where they reliably break, and how much human oversight a responsible team should keep in the loop. The answer is more interesting than the hype.

What Agents Can Already Build: The Delegation Shift

The most striking evidence that AI agents can build autonomously isn't a demo video — it's production code shipping from companies you'd never call experimental. Rakuten used Claude Code to complete a task inside a 12.5-million-line codebase in seven hours of autonomous work, with 99.9% numerical accuracy. That's not autocomplete; that's delegation.

Replit points the same direction from the other end of the spectrum. According to LangChain's State of AI Agents survey, it lets users build and deploy fully functional apps in minutes, and it ranks among the most-talked-about agent applications alongside Cursor and Perplexity. Meanwhile, TELUS reports shipping engineering code 30% faster with Claude Code, saving over 500,000 hours.

The deeper shift is happening in the terminal. As Firecrawl's trend analysis documents, CLI agents like Claude Code and Cursor's composer now run autonomously for hours at a stretch — coordinating changes across dozens of files, executing shell commands to verify their own work, and committing the results. GitHub Copilot is evolving the same way, moving from in-editor assistant to an asynchronous coding agent integrated directly into the platform.

What these tools have in common is a changed division of labor:

• The agent writes, tests, and commits code across many files without step-by-step prompting
• The human defines the task, reviews the output, and sets the boundaries
• Verification happens inside the loop — agents check exit codes and run tests before declaring done

This is why analysts describe software development as moving from writing code to orchestrating agents that write code. The skill that matters increasingly isn't syntax fluency; it's knowing what to delegate, how to specify it, and what to trust.

That last part — what to trust — is where the picture gets complicated. An agent is only as reliable as the instructions and tools it's given, and the ecosystem of agent skills and MCP connectors is growing faster than anyone can vet it. SkillzBench is being built to close that gap: a free, independent directory that security-scans, version-pins, and benchmarks agent skills in a sandbox so you can see which ones actually help. Since agents now verify their own work, the humans doing the orchestrating need a way to verify the agents.

Why Full Autonomy Still Needs Human Guardrails

For all the impressive demos, the teams actually running agents in production are keeping humans firmly in the loop. The data shows why: quality concerns outweigh cost and safety by more than 2x, with 45.8% of small companies citing performance quality as their primary worry versus 22.4% pointing to cost, according to LangChain's survey of practitioners. Businesses aren't afraid agents will be expensive or dangerous — they're afraid the output won't be good enough to ship.

The unglamorous reality is that autonomy is mostly plumbing. MIT Sloan research on real-world deployments found that roughly 80% of the work in one agent implementation was data engineering, governance, and workflow integration — not the agent itself. Very few teams let agents "read, write, and delete freely"; most restrict permissions to read-only or require human approval for significant actions.

Security adds another layer of caution. With 17,000+ MCP servers now publicly listed and adoption still climbing, industry analysis found that 24% of surveyed MCP servers ship with no authentication at all. Every tool you connect to an agent is a potential attack surface, and the quality of those connections directly determines the quality of what the agent builds.

The practical model that emerges from the research is scoped autonomy with human oversight — agents handling well-defined, verified tasks while humans orchestrate, review, and approve. This is what IBM's Vyoma Gajjar means when she argues that sandbox stress-testing, rollback mechanisms, and audit logs are prerequisites for autonomous decision-making, not afterthoughts.

For business owners, that translates into a simple discipline:

• Scope each agent to a bounded task with clear success criteria
• Require human approval before write or delete actions
• Vet every skill and tool you connect — an agent is only as good as its inputs
• Treat monitoring as a permanent operational expense, not a one-time project cost

That last point matters most: the quality of what you connect to an agent determines its output. Published research has found that roughly 26% of agent skills carry at least one vulnerability, which is why verification can't be optional. SkillzBench is being built to address exactly this — a free, independent directory that security-scans, license-checks, and benchmarks every skill in a sandbox, with per-agent loadouts so your agent only sees the tools you've deliberately chosen. The goal isn't unsupervised building; it's trusted building — and that starts with what you let the agent see.

How to Put an Agent to Work on Your Site Safely

So your agent can build — the real question is how to let it build without handing over the keys. The evidence points one direction: teams that succeed with agents don't remove humans, they scope the work.

Start small and verifiable. Give your agent one well-defined task — a component rebuild, a bug fix, a content migration — where success is measurable. Rakuten's Claude Code run completed a task in a 12.5-million-line codebase with 99.9% accuracy, but only because the task was scoped and the output could be checked. Agents struggle with exceptions, and their decision-making remains poorly understood — so verify everything.

Require human approval for anything significant. According to LangChain's survey, very few teams let agents read, write, and delete freely; most allow read-only permissions or gate destructive actions behind human sign-off. IBM's Vyoma Gajjar makes the same point: sandbox stress-testing, rollback mechanisms, and audit logs are prerequisites before you expand autonomy.

Budget for the long haul. MIT Sloan's Kate Kellogg argues monitoring must be a permanent operational expense, not a one-time project cost. In one documented deployment, 80% of the work was unglamorous — data engineering, governance, workflow integration. Treat agent oversight the same way.

Vet everything the agent connects to. This is where most risk hides: 24% of surveyed MCP servers ship with no authentication, and published research found roughly 26% of agent skills carry at least one vulnerability. An agent connected to unvetted tools is a supply-chain problem wearing a friendly face.

Your safety checklist:

• Scope tasks so output is verifiable against tests, exit codes, or review
• Require human approval for writes, deletes, and deployments
• Treat monitoring and re-scanning as an ongoing operational cost
• Security-scan and license-check every skill and tool before connecting it

This is also where agent skills come in. Skills — instruction packages for tools like Claude Code, Codex, Cursor, and Gemini CLI — are how you extend what your agent can build. SkillzBench is building a free, independent answer to the trust problem: a directory that pins every skill version to a commit SHA, security-scans and license-checks each one, and benchmarks skills in a sandbox with and without the skill to publish the measurable Lift. Its per-agent loadouts mean each agent only sees the skills and tools you explicitly choose for it — nothing more.

Everything — the directory, the free MCP connector, benchmarks, and alerts — will be free, with Lift always shown separately from ratings and money never touching scores. Skills, proven — join the SkillzBench waitlist to be first in line when it launches.

The Agentic Web: Where Website Building Goes Next

The most interesting shift isn't that agents can build websites — it's that websites themselves are learning to talk to agents. At Microsoft Build 2025, the company laid out its vision for an open agentic web, where agents perform tasks on users' behalf and sites expose their content through a new project called NLWeb, which Microsoft says "can play a similar role to HTML for the agentic web."

For non-technical readers, that analogy is worth pausing on. HTML made web pages readable by browsers; NLWeb aims to make them readable by AI agents, using the Model Context Protocol as the shared language. The ecosystem is already standardizing fast: industry tracking counts more than 17,000 publicly listed MCP servers, and 72% of adopters expect their usage to increase.

What this means for your website

In an agentic web, your site won't just be visited by humans — it will be browsed, summarized, and acted on by agents. That changes what "building a website" means:

• Structure content so agents can discover and use it, not just render it
• Publish through MCP-compatible interfaces rather than HTML alone
• Treat agent traffic as a real audience with its own design requirements
• Assume your competitors' sites are agent-accessible even if yours isn't yet

The parallel shift is happening on the building side. Software development is moving "from an activity centered on writing code to one grounded in orchestrating agents that write code," as one trend analysis puts it. The people who benefit most aren't the best coders — they're the best orchestrators, equipped with the right verified tools.

That word "verified" matters. Quality concerns outweigh cost and safety concerns by more than 2x among teams deploying agents, per LangChain's survey of practitioners, and 24% of surveyed MCP servers ship with no authentication at all. Equipping an agent with a skill you found on GitHub is easy; knowing it actually helps — and doesn't expose you — is the hard part.

This is exactly the problem SkillzBench is being built to solve: a free, independent directory of agent skills where every skill is version-pinned, security-scanned, license-checked, and benchmarked in a sandbox so you can see the measurable Lift before you equip anything. A free MCP connector will let you hand each agent only the skills you've chosen for it — no more, no less.

The agentic web is arriving whether or not your site is ready. The readers who come out ahead will be the ones who learn to equip their agents deliberately — with skills that are proven, not just popular.

Skills, proven. Join the SkillzBench waitlist at skillzbench.com to get early access to the free skills directory, benchmarks, and MCP connector as they launch.