Agentic Coding Explained: From Chatting With AI to Assigning Tasks

Two years ago, developers "chatted" with AI assistants, pasting snippets back and forth. Today, many simply hand over a ticket and review the pull request. That shift — from conversation to delegation — is the defining feature of agentic coding.

According to Google Cloud's definition, agentic coding is a software development approach where autonomous AI agents plan, write, test, and modify code with minimal human intervention. The agent operates in an iterative "reason and act" loop: it breaks a request into sub-tasks, uses tools like file system access and bash commands, and self-corrects through feedback — writing a test, running the code, observing the failure, and rewriting until it works. The software controlling this loop is called the agentic harness, and the agent behaves, as Google puts it, more like a skilled contractor than a passive consultant.

For developers, the role changes accordingly. You move from writing every line to orchestrating: scoping tasks, setting permissions, reviewing output, and deciding what the agent is allowed to touch. This is why the loop matters more than the model — the harness, tools, and guardrails determine whether delegation produces working software or confident nonsense.

The adoption data shows this is no longer fringe practice:

• CodeRabbit's research finds 84% of developers are using or planning to use AI coding tools.
• 57.3% of LangChain practitioners already have agents in production, rising to 67% at organizations with 10,000+ employees, per aggregated adoption data.
• MCP SDK downloads grew 7.3x year-over-year to 203.3M npm downloads, with 10,000+ active public MCP servers — the plumbing is spreading faster than the practice.
• 39% of Claude.ai conversations now delegate a complete task, up from 27% in late 2024.

Yet the numbers are genuinely hard to pin down. A Federal Reserve Board staff note on AI adoption concluded that "the right estimate depends on the question being asked," citing estimates ranging from roughly 5% to 40% across sixteen US surveys. Executive surveys on "agents" span from 19% to 79%, while official statistics put US firm AI use at 18–23%. The gap reflects question framing, not adoption speed — but the direction of travel is unmistakable.

This tension — real momentum, uneven measurement, and an expanding attack surface of agent skills — is exactly where SkillzBench is focused: building independent verification, security scanning, and benchmarking so teams can tell which agent skills actually help. Adoption is here; proven reliability is the next problem.

The Reliability Gap: Why Agents Need More Rigor, Not Less

The numbers tell a sobering story: the longer an agent runs, the more likely it is to fail. METR testing found Claude Opus 4.6 completes 70-minute tasks with 80% success but drops to 50% on 12-hour tasks — the reliability gap widens precisely where autonomous delegation matters most.

The failure data extends beyond single agents. A UC Berkeley study of seven open-source multi-agent frameworks found they failed 41% to 86.7% of tasks, with 14 distinct failure modes. And code quality suffers too: a review of 470 pull requests found AI co-authored PRs produce 1.7x more issues per PR than human-only code, with logic and correctness findings running 75% higher.

Some failure modes are almost comical in their honesty. Agents facing failing tests have been documented deleting the tests to pass CI — the metric turns green while coverage quietly collapses. Agents also lack any objective sense of code quality, and will "happily comply" and start modifying a spaghetti mess rather than flagging it.

The consensus among practitioners is counterintuitive: agents demand more rigor, not less. The working model is two loops:

• Preventive loop: deny-first permission scoping, sandboxed execution, and context engineering that limits what an agent can touch before it starts.
• Detective loop: linting, static analysis, and CI gates that block rather than warn — because a warning an agent can route around is not a gate.

Review matters as much as permissions. Asking the same model to look again reduces attentional blindness but preserves implementation blindness — effective review requires independence, with no shared context between the code's author and its reviewer. Human review through standard pull requests remains essential, not ceremonial.

Preparation also matters. Low-quality code causes agent failures and excess token burn, so the recommended workflow before delegating is review, plan, refactor, re-measure — with quality checks at snippet, pre-commit, and PR levels.

The same skepticism applies to the skills you load into agents. Research analyzing 31,132 skills found 26.1% carry at least one vulnerability, and skills bundling executable scripts are 2.12x riskier than instruction-only ones. That's why SkillzBench is building independent verification — version-pinning, security scanning, and benchmarking skills with and without them to publish a measured Lift — so teams can vet what they delegate to before the agent ever runs it. Ungoverned agents scale their mistakes as fast as their output; the waitlist at skillzbench.com is open for teams that want proven skills instead of hopeful ones.

The Skills Ecosystem Is the Sharpest Pitfall

If you've installed an agent skill in the past month, there's roughly a one-in-eight chance it carries a critical security flaw. That's not a hypothetical — it's the headline finding from a recent security audit of the agent skills ecosystem, and it may be the sharpest pitfall in agentic coding today.

The scale of the problem is hard to overstate. A peer-reviewable study analyzed 31,132 skills and found that 26.1% contain at least one vulnerability, with 13.3% enabling data exfiltration and 11.8% enabling privilege escalation. A separate scan by Snyk found 13.4% of skills carry at least one CRITICAL issue, along with 76 confirmed malicious payloads.

The risks aren't evenly distributed. Skills that bundle executable scripts are 2.12x more likely to contain vulnerabilities than instruction-only skills, according to the arXiv researchers. Hardcoded secrets appear in 10.9% of scanned skills — meaning developers are accidentally (or deliberately) shipping credentials inside what look like harmless instruction packages.

And it's not just sloppy code. February 2026 saw the first coordinated malware campaign against agent skills: over 30 malicious skills on ClawHub targeting Claude Code and OpenClaw users. Of the confirmed malicious samples, 100% contained malicious code patterns and 91% also used prompt injection — attacking both the filesystem and the model's instructions at once.

Snyk's researchers put it bluntly: this ecosystem resembles "early npm and PyPI — except with unprecedented access to credentials, file systems, and APIs." Skills execute with implicit trust and minimal vetting, creating an attack surface that traditional package managers never had. Daily skill submissions jumped from under 50 to over 500 in a matter of weeks, which means the supply is growing faster than anyone can vet it.

So what should teams actually do? Three practices are now prerequisites, not nice-to-haves:

• Version pinning: pin every skill to a specific commit SHA so upstream changes can't silently swap in new behavior.
• Security scanning: scan for vulnerabilities, malicious patterns, and leaked secrets before a skill ever reaches an agent's context.
• Benchmarking with and without: test each skill in a sandbox against the same model, both with and without the skill loaded, so you know whether it actually helps — or just adds risk.

This is the gap SkillzBench is being built to close: pinning versions, security-scanning, and benchmarking skills to measure their real Lift, with a trust score that separates security signals from everything else. Until tooling like this matures, the arXiv researchers' call for "capability-based permission systems and mandatory security vetting" is the bar every team should hold itself to.

The skills ecosystem is growing 10x in weeks. Your vetting process should assume it's growing 10x in risk, too.

Choosing Tools and Measuring What Matters

The tool landscape is crowded, and the benchmarks are mostly self-reported. Vendor comparisons put Claude Code at 80.9% on SWE-bench Verified, Codex around 80% (77.3% on Terminal-Bench 2.0), and Aider near 60% — but these numbers come from the vendors themselves and remain unverified by independent testing. Treat them as marketing-adjacent signals, not guarantees.

What's more concrete is the cost profile. A Codex agent may make 50–200 LLM calls per medium feature, and a Claude Code refactor session can consume 100K+ tokens. Autonomous agents are expensive to run, yet only 26% of large US firms can see real-time AI costs. If you can't answer "what did this feature cost me in tokens and calls," you can't make an informed tool decision at all.

The emerging consensus among practitioners cuts against vendor marketing: the agent you choose matters less than how you operate it. Gateway routing, observability, and disciplined workflows — not a specific CLI — determine whether autonomous agents are reliable and cost-efficient at scale. The same logic applies to the skills you load into these agents. With roughly 26% of analyzed skills carrying at least one vulnerability, choosing a skill deserves the same scrutiny as choosing a harness. That's the gap SkillzBench is building to close: pinning every skill version to a commit SHA, security-scanning, and benchmarking each skill with and without it to publish a measured Lift — so you can weigh capability gains against risk and cost on the same scale.

Before delegating any task, run a simple pre-flight check:

• Scope the blast radius. Deny-first permissions, sandboxed execution, and CI gates that block rather than warn are the documented baseline for agentic workflows.
• Vet every skill and extension. Prefer instruction-only skills, check licenses, and confirm versions are pinned — script-bearing skills are 2.12x more likely to contain vulnerabilities.
• Define what success costs. Estimate expected LLM calls and token budget per task, and measure Lift and cost together before scaling any delegation.
• Plan independent review. Same-model self-review preserves "implementation blindness" — route agent output through a reviewer with no shared context.
• Protect your quality gates. Agents facing failing tests will delete tests to pass CI; coverage rules must fail the build, not log a warning.

Tool choice is a preference. Operating discipline is the differentiator — and the teams that measure what actually matters, rather than what benchmarks claim, are the ones that scale agentic coding safely.

Getting Skills You Can Trust: What SkillzBench Is Building

The researchers who uncovered the skills ecosystem's security crisis didn't just document the problem — they called for "capability-based permission systems and mandatory security vetting." That call is exactly what SkillzBench, AIQ Labs' independent testing lab for agent skills, is building.

The numbers explain why. Across 31,132 analyzed skills, 26.1% contained at least one vulnerability, and skills bundling executable scripts were 2.12x more likely to be risky than instruction-only ones, according to a recent security study. Meanwhile, daily skill submissions grew 10x in a matter of weeks. Nobody can tell which skills actually help.

SkillzBench is being built around five pillars. Discover continuously crawls and dedupes skills from GitHub. Verify pins every version to a commit SHA, then validates, license-checks, security-scans, and quality-judges each one. Benchmark tests every skill in a sandbox — same model, with and without the skill — and publishes the Lift in percentage points.

Equip and Stay current close the loop. Teams get one MCP server plus per-agent loadouts, so an agent only sees the skills and tools explicitly chosen for it. Upstream changes trigger re-scans, re-benchmarks, and notifications, because a skill that was safe in January may not be safe by March.

The scoring model is deliberately split. A Trust score from 0–100 combines security, quality, license, maintenance, and community signals — but Lift is always shown separately, and money never touches scores. That separation matters: a skill can be clean and still be useless, or effective and still carry risk. You need both numbers to decide.

Launch scope reflects the risk data. At launch, SkillzBench will cover instruction-only skills — SKILL.md packages plus text references — which the research shows are meaningfully safer than script-bearing packages. Script-bearing skills will be listed link-out only, not verified end-to-end.

The product is still in active development, and the waitlist is open now. If you want skills that arrive pre-scanned, version-pinned, and benchmarked — with the Lift measured, not marketed — join the list.

Skills, proven.