🔶 为什么编程 Agent 如此愚蠢？

我第一次使用编程 Agent 时，感到如痴如醉。在使用 Agent 之前，我一直要在 IDE 和 AI 聊天界面之间复制粘贴。看到 Agent 直接编辑文件，并实时修复自己的错误，实在令人惊叹。

几天后，蜜月期过去了，我开始遇到频繁的 bug。Agent 会完全停止响应，直到我重启它。开发工作流显得原始得令人窒息，而 Agent 往往在工作才刚开始时，就宣布任务已经完成。

那是在 2025 年 2 月，编程 Agent 仍处于早期阶段。我当时认为，六个月后，Agent 在技术上会和底层 LLM 一样令人印象深刻。

但实际上，编程 Agent 一直都很糟糕。

AI 辅助开发显然取得了进展，但承担主要工作的仍是模型，Agent 依然是瓶颈。

Agent 不是模型 🔗︎

在围绕 AI 的各种炒作中，术语往往被扭曲。人们开始过度使用并混淆“模型”和“Agent”之类的术语。

我说“模型”时，指的是 GPT Astra、Claude Sonnet 和 GLM-5.3 这样的大语言模型（LLM）。模型会生成文本和图像，其中也包括相当不错的软件代码。

我说“Agent”时，指的是将模型连接到代码库和计算机系统的软件。它们是 Anthropic 的 Claude Code 或 OpenAI 的 Codex 这样的工具。

打个简单的比方：模型是大脑，Agent 是身体。模型输出文本流，而 Agent 则充当黏合剂，将这些文本接入系统中的正确命令和文件。

当前编程 Agent 的局限 🔗︎

Agent 不会管理任务 🔗︎

我对编程 Agent 最大的不满，是它们糟糕透顶的任务管理能力。

例如，我有一个开源 Web 应用，可以为文件上传生成可分享链接。我最近为它加入了使用密码短语保护链接的支持。这是一次相对简单的改动，总计新增约 1500 行代码。OpenCode 尽职尽责地将该功能拆分为 10 个子任务，但随后它却只是……一个接一个地完成它们：

为什么要把这些可尴尬并行的任务一个个串行执行？

呃……你是台计算机啊！你明明很擅长多任务处理。这就是我们不断给你增加 CPU 核心数的原因。你可以并行做多件事，而且上下文切换速度比人类快数百万倍。为什么要把这些可尴尬并行的任务一个个串行执行？

Claude Code 会多任务处理，但只是一点点。它会启动一两个子 Agent，但仍会等它们全部完成后才继续。每天好几次，我都会看到 Claude Code 干等数分钟，等待端到端测试完成；然后，只有等测试通过后，它才会说：“嗯，现在我该开始起草 commit message 了。让我看看 git 历史，以了解你的 commit message 约定。”

Agent 不会委派任务 🔗︎

当我使用一个前沿模型，而它需要在 5 万行代码中检查某个特定模式时，Agent 从来不会停下来问：“等等，这件事另一个模型可以更便宜、更快地完成。”它只会继续用这个缓慢且昂贵的模型硬做。反过来，Agent 也从不会说：“这个模型对于该任务来说太笨了，我换一个更聪明的。”

当然，我可以主动微观管理任务，并不断切换模型和思考等级，以匹配每个子任务的难度，但为什么这是我的工作？你还需要我替你管理线程池吗？你还指望我替你释放未使用的 RAM吗？

什么技术最适合为任务评估难度，并将这些需求匹配给模型？LLM！只要让 LLM 为这个任务挑选最便宜、最快的模型就行。为什么还需要我照看你？

我不断遇到这样的任务：95% 都是苦力活，但我仍然不得不把它们交给最聪明的模型，因为我自己拆分任务、代替 Agent 委派工作，所花的时间会太多。

谢谢你告诉我哪个是默认模型，Claude。

Agent 从没听说过 Agent 🔗︎

Agent 对自己一无所知。如果我问 Claude 如何使用 Claude 的功能，它必须上网搜索，才能弄明白这个“Claude”到底是什么。Claude 回答 C 语言编程问题时，比谈论它自己更得心应手（公平地说，大多数人类开发者也是如此）。

呃……你就是 Claude Code！你连自己的功能都不知道？而且不管搜索到的说明是否匹配你的版本号，你都直接去 Google？对于用户从未使用过的功能，你会随手下载 13 GB 的文件，却无法在安装包中留出 50 KB 的 gzip 压缩文本，向你自己解释你的功能？

想象一下，如果你请队友帮忙做一次代码审查，而他们先开始疯狂 Google，看看代码审查是不是开发者会做的事情。然后，第二天你请他们再做一次代码审查时，他们完全不记得昨天的对话，又跑回 Google，焦虑地输入："do software engineers do code reviews?"

Agent 不擅长沟通计划 🔗︎

我曾经很喜欢 Agent UX 中将“Plan”和“Execute”模式分开的功能。面对复杂任务时，我会请 Agent 制定计划，然后审阅计划、提出修改建议，并将执行工作委派给更快、更便宜的 Agent。

随着时间推移，我开始抗拒阅读这些计划。我经常跳过审阅，直接让 Agent 进入实现阶段。

我原以为是编程 Agent 让我变懒了，但后来我意识到，Agent 对计划的表达实在太差，读起来令人痛苦。

下面是一个例子：我要求 Codex + GPT-6 Astra 为我的媒体日记 Web 应用添加一项功能：

Codex，你不能只是列出一堆互不相干的细节，就把它称作计划。

那根本不是计划！那只是一堆低层设计决策的大杂烩。

如果我让一名合格的开发者规划这项功能，他们要么会从 UI 改动的高层计划开始，再逐步深入；要么会从数据模型的改动讲起，再逐步向上展开。如果开发者开始罗列关于功能的随机事实，我会认为他们仍在头脑风暴，之后再回来找他们。

Agent 总能找到借口停止工作 🔗︎

某天晚上睡觉前，我在一个编程 Agent 中启动了一项长时间任务。第二天早上回来时，我发现 Agent 甚至还没开始工作。我离开两分钟后，它就停下来问我应该如何命名一个 git 分支，然后整晚坐等我的回答。

如果有员工告诉我，他们整个班次都闲着，只是因为想让我决定某个无关紧要的细节，我会很快解雇他们。

只有在承担不必要风险时，Agent 才有用 🔗︎

开始使用第一个编程 Agent 时，我寻找过一项设置，用于控制 Agent 可以访问系统中的哪些文件。肯定会有某种文件系统权限控制，或受限 chroot 一类的防护措施，能够阻止一段随机且不可预测的软件肆无忌惮地探索我的整台电脑，对吧？

并没有。文档鼓励我给 LLM 写一封礼貌的信，恳请它不要读取某些文件或目录。我试过了，而 Agent 立刻无视我的请求，将私有应用密钥泄露给 OpenAI 和 Anthropic。

我原以为安全边界会是编程 Agent 最早实现的功能之一，但即使到今天，只有给 Agent 开放全部访问权限时，它们才真正可用。Agent 经常会绕过其自身厂商的沙箱。替代方案是每天坐在那里点击 500 次“允许”，而这甚至不是可靠的保护，因为你终究会误点。

真正令人抓狂的是，十多年来我们一直都有沙箱工具，可以限制编程 Agent 发生失误时的影响范围。我自己实现了一个沙箱，使 Agent 无法在仓库目录之外探索我的文件系统。我再也不用担心 Agent 意外泄露我的主目录，或删除机器上的关键文件，因为它们根本没有权限这么做。

“只要你……，编程 Agent 就完美了” 🔗︎

我知道有些读者会说，只要我从随机 git 仓库安装 20 万行技能文件，或者在配置文件里设置某个晦涩的功能标志，就能解决所有问题。

我讨论的是：在无需我安装随机插件或技能文件、也无需花数小时调整配置的情况下，编程 Agent 开箱即用时本应具备的能力。

我梦想中的 Agent 🔗︎

我希望所有编程 Agent 都能做到的事 🔗︎

我认为，到 2026 年，这些都应该是编程 Agent 的基本标配。

• Agent 将请求拆分成一系列任务，并为每项任务分配合适的模型。
  • Agent 针对成本、速度和正确性进行优化，并允许用户按任务调节这些参数（例如，花更多钱以更快获得结果）。
• Agent 编写以方便人类理解为目标的计划。
• Agent 在真正的沙箱中运行。
  • 沙箱使用操作系统级安全原语，在文件系统和网络层面建立边界。
  • 所有访问控制代码都应是确定性的，而不是 Agent 可以随意无视的谦逊建议。
  • 如果我问 Agent，一组用于 bash 命令的正则表达式是不是沙箱，它会回答：“不是。”
• Agent 应按环境实施沙箱隔离。
  • 默认情况下，Agent 仅能访问一个仓库或目录。
  • 我可以在每个会话中，分别授予 Agent 对其他仓库的只读或读写权限。
• Agent 是其自身的专家。
  • 如果我询问如何向 Agent 表达一项任务或工作流，它无需上网搜索就知道答案。
• Agent 可以使用任何 LLM 提供商，包括不限量套餐。
• Agent 是开源的。
• 在“Execute”模式下，如果我没有回答问题，且 30 分钟内没有与会话互动，Agent 会自行做出决定。
  • Agent 还应提供“AFK 模式”，跳过 30 分钟的等待时间。
• Agent 也允许我直接操控子 Agent。
  • 我应该能进入任意 Agent 会话并操控它，或告诉它短路并提前结束。
• 如果 Agent 告诉我，Fable 在我的 Max 套餐中不可用，那么在 bug 修复前，Agent 厂商的 CEO 必须一直被关在颈手枷中。

再多做一点梦 🔗︎

既然都在做梦了，以下还有一些我希望看到的额外功能，不过我也承认，其中有些过于偏向我的个人工作流。

• Agent 提供一个 Web 界面，让我统一查看所有会话，以及哪些会话需要关注。
  • Web 后端在本地运行，不要求我从互联网打开一条会在系统上执行任意命令的隧道。
  • Web 界面在手机上也能良好运行。
• Agent 持续维护任务完成时间的预计值（ETA）。
  • 每个子 Agent 也维护自己的 ETA。
  • Agent 会随着任务推进持续更新该估计。
  • Agent 会根据过去估计的准确性，调优其估算算法。
• Agent 审查自己的会话，并寻找改进机会。
  • 例如：“哇，过去五天里，我每天花掉 1000 美元 token，试图通过临时命令解析这个 20 GB 日志文件。我们来构建一个自定义工具，更高效地完成这件事。”
• Agent 自带优秀的、理解编程语言的 diff 视图。
  • 我不想为了看到 Agent 工作成果的有用 diff，而必须 push 到 GitHub。
• Agent 原生支持向网络请求注入密钥的代理。
  • Agent 可以发出需要凭据的请求，但无法将凭据泄露给另一台主机。
• Agent 会考虑

The first time I used a coding agent, I was mesmerized. Before the agent, I was copy/pasting between my IDE and an AI chat interface. It was amazing to see an agent edit files directly and fix its own errors in real time.

After a few days, the honeymoon wore off as I encountered frequent bugs. The agent would stop responding entirely until I restarted it. Development workflows felt stiflingly primitive, and the agent would often declare tasks finished when work had barely begun.

This was in February 2025, so it was still early days for coding agents. I figured that in six months, agents would be as technically impressive as the underlying LLMs.

Instead, coding agents just stayed bad.

AI-assisted development has clearly advanced, but the models are doing the heavy lifting while the agents remain the bottleneck.

The agent is not the model 🔗︎

In all the hype around AI, the terms tend to get distorted. People are beginning to overload and mix terms like “model” and “agent.”

When I say “model,” I’m talking about large language models (LLMs) like GPT Astra, Claude Sonnet, and GLM-5.3. Models generate text and images, including pretty good software code.

When I say “agent,” I mean the software that connects models to codebases and computer systems. These are tools like Anthropic’s Claude Code or OpenAI’s Codex.

As a simple analogy, the model is the brain, and the agent is the body. The model produces a stream of text, and the agent acts as the glue that plugs the text into the right commands and files on the system.

Limitations of current coding agents 🔗︎

Agents can’t manage tasks 🔗︎

My biggest gripe with coding agents is how atrociously they manage tasks.

For example, I have an open-source web app that generates shareable links for file uploads. I recently added support for protecting links with a passphrase. It was a relatively simple change, totalling about 1.5k lines of new code. OpenCode dutifully broke the feature into 10 subtasks, but then it just… did them all one by one:

Why are you doing these embarrassingly parallel tasks one at a time?

Umm… you’re a computer! You’re really good at multitasking. That’s why we keep giving you all those CPU cores. You can do multiple things in parallel and context switch millions of times faster than humans. Why are you doing these embarrassingly parallel tasks one at a time?

Claude Code multitasks, but only a little. It will spin up a subagent or two, but it still waits for all of them to finish before moving on. Multiple times per day, I’ll see Claude Code sit around for several minutes waiting for my end-to-end tests to finish, and then only after the tests pass does it say, “Hmm, now I should start drafting a commit message. Let me look at the git history to learn your commit message conventions.”

Agents can’t delegate 🔗︎

When I’m using a cutting-edge model, and it needs to check 50k lines of code for a particular pattern, the agent never stops and says, “Wait, this is something another model could do cheaper and faster.” It just plows on with the slow, expensive model. Conversely, the agent never says, “This model is too dumb for this task. Let me tag in a smarter one.”

Of course, I can actively micromanage the task and keep switching the model and thinking level to match each subtask’s difficulty, but why is that my job? Do you also need me to manage your thread pool for you? Do you expect me free your unused RAM for you, too?

You know what technology would be good at assigning a difficulty level to a task and then matching those requirements to a model? An LLM! Just ask the LLM to pick the cheapest, fastest model for the task. Why do you need me to babysit you?

I constantly run into tasks that are 95% gruntwork, but I still have to assign them to the smartest model because chopping up the task and delegating on the agent’s behalf would take up too much of my time.

Thanks for telling me which is the default model, Claude.

Agents have never heard of agents 🔗︎

Agents don’t know anything about themselves. If I ask Claude how to use the features of Claude, it has to search online to figure out what this “Claude” thing is. Claude is more comfortable answering questions about C programming than talking about itself (in fairness, same with most human developers).

Uh… you’re Claude Code! You don’t know any of your own freaking features? And you’re just Googling instructions regardless of whether they match your version number? You’ll casually download 13 GB of files for a feature the user has never used, but you can’t spare 50 KB of gzipped text in your install package to explain your own features to you?

Imagine if you asked your teammate for a code review, and they started furiously Googling to find out if code reviews are something developers do. And then when you asked them for another code review the next day, they had no memory of your previous conversation and ran back to Google and anxiously typed, "do software engineers do code reviews?"

Agents suck at communicating plans 🔗︎

I used to love the agent UX feature of separate “Plan” and “Execute” modes. For complicated tasks, I’d ask the agent to create a plan, then I’d review it, suggest changes, and delegate execution to a faster, cheaper agent.

Over time, I felt an aversion to reading the plans. I’d often skip my review and just let the agent move straight to implementation.

I thought coding agents had made me lazy, but I realized that agents just communicate their plans so poorly that they’re painful to read.

Here’s an example of me asking Codex + GPT-6 Astra to add a feature to my media journalling web app:

You can’t just list a bunch of disparate details and call it a plan, Codex.

That’s not a plan! That’s just a hodgepodge of low-level design decisions.

If I asked a competent developer to plan this feature, they’d either start with a high-level plan for UI changes and work their way down or describe changes to the data model and work their way up. If the developer started enumerating random facts about the feature, I’d assume they were brainstorming and come back later.

Agents take any excuse to stop working 🔗︎

The other night, I kicked off a long task in a coding agent before I went to bed. I came back the next morning to find that the agent hadn’t even started working. It stopped two minutes after I left to ask me what it should name a git branch and then sat all night waiting for my answer.

If I had a human employee tell me they sat idle their whole shift because they wanted my input on some superficial detail, I’d quickly fire them.

Agents are only useful when they take unnecessary risks 🔗︎

When I started using my first coding agent, I looked for the setting that controlled which files on my system the agent is allowed to access. Surely, there was some sort of filesystem permissions or limited chroot kind of protection that prevents a random and unpredictable piece of software from exploring my entire computer unfettered, right?

Not so. The docs encouraged me to write the LLM a polite letter kindly requesting that it not read certain files or directories. I tried that, and the agent immediately ignored my request, exfiltrating private application keys to OpenAI and Anthropic.

I thought that security boundaries would be one of the first things coding agents would implement, but even today, agents are only usable if you give them access to everything. Agents routinely bypass their own vendors’ sandboxes. The alternative is to sit there and click “Allow” 500 times a day, and that’s not even reliable protection because you’re bound to misclick eventually.

What makes this so maddening is that we’ve had sandboxing tools for more than a decade that can limit the blast radius of mistakes from coding agents. I rolled my own sandbox so that agents can’t explore my filesystem beyond the repo directory. I never have to worry about agents accidentally exfiltrating my home directory or wiping critical files on my machine because they just don’t have access to do that.

“Coding agents are perfect if you just…” 🔗︎

I know some readers will say that I can solve all of my problems if I just install 200k lines of skill files from random git repos or set some obscure feature flag in my config file.

I’m talking about my expectations of what coding agents should be able to do out of the box without me installing random plugins or skill files or spending hours tweaking the configuration.

My dream agent 🔗︎

What I wish all coding agents did 🔗︎

These are the basics that I think should be table stakes for coding agents in 2026.

• The agent splits requests into a series of tasks and assigns each task to the appropriate model.
  • The agent optimizes for cost, speed, and correctness and allows the user to adjust the dials per task (e.g., spend more for a faster result).
• The agent writes plans that optimize for human comprehension.
• The agent operates within a real sandbox.
  • The sandbox uses OS-level security primitives to create boundaries at the filesystem and networking level.
  • All access control code is deterministic, not humble suggestions that the agent is welcome to ignore.
  • If I ask the agent whether a list of regexes on bash commands is a sandbox, it replies, “No.”
• The agent applies per-environment sandboxing.
  • The agent has access to a single repo/directory by default.
  • I can give the agent read-only or read-write access to other repos on a per-session basis.
• The agent is an expert on itself.
  • If I ask the agent how to express a task or workflow to the agent, it knows the answer without having to search online.
• The agent can use any LLM provider, including unlimited plans.
• The agent is open-source.
• If I don’t answer a question in “Execute” mode, and I haven’t interacted with the session in 30 minutes, the agent makes the decision independently.
  • The agent also offers an “AFK mode,” which skips the 30-minute wait.
• The agent lets me drive the subagents, too.
  • I should be able to jump into any agent session and drive it or tell it to short-circuit and end early.
• If the agent tells me that Fable is not available on my Max plan, the agent vendor’s CEO must remain in stockades until the bug is fixed.

Dreaming a little bigger 🔗︎

As long as I’m dreaming, here are some additional features I’d like to see, but I recognize that some of these are overindexing on my personal workflows.

• The agent offers a web interface that shows me a unified view of all sessions and which ones require attention.
  • The web backend runs locally and doesn’t require me to open a tunnel from the Internet that executes arbitrary commands on my system.
  • The web interface works well on my phone.
• The agent maintains an ETA for task completion.
  • Each subagent maintains its own ETA as well.
  • The agent continuously updates this estimate as the task progresses.
  • The agent tunes its estimation algorithm based on the accuracy of its past estimates.
• The agent reviews its own sessions and looks for opportunities to improve.
  • e.g., “Wow, I blew through $1k/day in tokens the past five days trying to parse this 20 GB log file with ad-hoc commands. Let’s build a custom tool to do this efficiently.”
• The agent comes with a good language-aware diff view.
  • I don’t want to have to push to GitHub to see a useful diff of the agent’s work.
• The agent natively supports a proxy for injecting secrets into network requests.
  • The agent can make requests that require credentials but can’t exfiltrate the credentials to another host.
• The agent considers provider quota limits when selecting an appropriate model.
  • e.g., if my weekly quota resets in 3 hours, and we still have 90% of quota available, stop optimizing for cost.
• For tasks above a configurable complexity threshold, the agent automatically requests a code review from another model.
  • The two models iterate on reviews until they converge on the fixes.

So, why are harnesses so dumb? 🔗︎

Okay, getting back to the question in the title, I don’t have a satisfying answer.

My best hypothesis is that underinvestment in coding agents is an example of the principal-agent problem. The people setting the direction of AI tooling are executives at companies like Anthropic, OpenAI, and Google. Those executives are disconnected from the rank-and-file developers who use coding agents every day. Many of these executives are dreaming of a future where they can automate away human developers entirely.

AI executives, as well as their largest customers and shareholders, pay attention to metrics that are legible to them, such as slick demos and benchmark scores. Security and efficient use of human developer time aren’t relevant to the demos, and barely any of the benchmarks I’ve seen measure the agents themselves; they just measure the underlying models.

My hypothesis isn’t satisfying because AI companies clearly care at least a little bit about coding agents. I see a lot of features being added to Claude and Codex every month, though I can’t recall the last time one of them has improved my life.

Is there a better coding agent for me? 🔗︎

I’ve only tried Claude, Codex, OpenCode, Cline, and Pi. I use OpenCode and Claude Code as my daily drivers. If you’ve got a coding agent recommendation for me, comment below.

AI companies - if you want to acquire my imaginary coding agent for $50B, let me know. I’m ready to fork VS Code at a moment’s notice.