Before suggestion, only objection
Every agent that reads a repository, edits a file, runs a test and asks permission before doing anything riskier is often described as though it appeared suddenly, sometime around 2023. It did not. It is the newest configuration of an argument that developer tooling has been having with itself for roughly fifty years: how much of the work of programming can safely be handed to a machine, and how much of that handoff needs a human to check it first.
The earliest tools in that argument could not write anything at all. They could only look, and object. In 1978, Stephen C. Johnson at Bell Labs wrote lint, a static checker for C that flagged suspicious type conversions, unused variables, and non-portable constructs; it shipped publicly with Version 7 Unix the following year [1]. Lint could not be wrong in the way a generated line of code can be wrong, because it never generated anything. It read a finished program and printed a list of things that might be mistakes, on paper, after the programmer had already moved on to the next file. The tool and the act of writing code were entirely separate; the machine’s role was strictly retrospective and strictly advisory, and a programmer was free to ignore every warning it printed.
That separation is worth holding onto, because almost everything that follows in this history is a story of it eroding, one boundary at a time. The next boundary to go was the boundary between “after you’re done” and “while you’re typing.”
The dropdown decade
Through the 1980s and into the 1990s, integrated development environments began doing something lint’s generation of tools did not: watching a program while it was still being written, and offering to finish part of it. Name-completion features in IDEs of that era matched what a programmer had typed so far against symbols already known to the environment — variable names, method signatures, keywords in scope — and offered a short, ranked list to choose from. This is a modest-sounding change, and it is easy to understate how large it actually was. Lint’s relationship to the programmer was adversarial in the mildest possible sense: it found fault. A completion dropdown’s relationship was cooperative: it guessed intent, mid-sentence, and let the programmer accept or reject the guess with a single keystroke.
Two properties of that first generation of autocomplete are worth naming precisely, because they define the ceiling every dropdown-style tool operated under. First, everything it suggested had to already exist somewhere the tool could see — a symbol table, an imported library, a prior definition. It could not propose code that had never been written. Second, its unit of suggestion was small: a name, sometimes a method signature, rarely more than a line. Within those two limits, the tool was reliable in a way later generations would struggle to match — a suggested symbol either existed or the dropdown would not have offered it.
Statistical suggestion: Codex, Copilot, and the ghost-text era
The limit on what could be suggested broke first. In July 2021, OpenAI released a paper describing Codex, a GPT-family model fine-tuned on public GitHub code, evaluated against a new benchmark called HumanEval that tested functional correctness on hand-written programming problems rather than similarity to a reference solution. Codex solved 28.8% of HumanEval’s problems on a single attempt, and the paper reported that repeated sampling raised that figure to 70.2% of problems solved within 100 samples per problem [4]. That second number is doing more work than it first appears to: it is a demonstration that the model often contains a correct solution somewhere in its distribution, even when its single most likely answer is wrong — a fact that would become structurally important a few years later, once agentic systems started using multiple attempts and self-checking rather than one.
GitHub shipped this capability as a product within weeks. On June 29, 2021, GitHub announced a technical preview of Copilot, an editor extension built on Codex and described in the announcement as suggesting “whole lines or entire functions” rather than single names [2]. This is the moment the dropdown’s second limit broke: the unit of suggestion was no longer a symbol pulled from a table, but an arbitrary, freshly generated span of code, rendered inline as greyed “ghost text” a programmer could accept with one keystroke or ignore by continuing to type. Twelve months later, on June 21, 2022, GitHub took Copilot out of preview and priced it at ten US dollars a month, reporting that during the preview period Copilot had been used by more than 1.2 million developers and that, in files where it was enabled for popular languages, GitHub’s own measurement found close to 40% of code was being written by Copilot [3]. That adoption figure is GitHub’s own reported measurement of its own product, not an independent audit, and it is best read as a vendor claim about engagement rather than a claim about code quality or correctness.
Conversation without hands
A second, parallel channel opened at the end of 2022, when general-purpose conversational access to large language models reached a broad public audience. Programmers adopted it immediately for work adjacent to but distinct from ghost text: pasting a whole function and asking for an explanation, describing a bug in prose and asking for a fix, requesting an unfamiliar API’s usage pattern in natural language rather than searching for it. Within a year, a wave of IDE-embedded chat panels made this pattern native to the editor rather than routed through a separate browser tab.
What both of these interfaces shared, and what is easy to miss in retrospect, is that the human remained the actuator. A ghost-text suggestion had to be accepted by a keystroke; a chat answer had to be copied, pasted, and run by hand, and any resulting error had to be copied back in by hand. The model could generate arbitrarily good code, and it still could not open a file, run a command, or discover on its own that its suggestion had failed. That gap — between generating a plausible answer and acting on the world to find out whether the answer was right — is the one the next generation of tools was built to close.
The agentic turn: tools, memory, and a gate that has to be answered
Closing it meant giving the model something it had never had: hands. On March 12, 2024, Cognition announced Devin, describing it as “the first AI software engineer,” a system with its own shell, code editor, and browser inside a sandboxed environment, capable of planning and executing multi-step engineering tasks without a human carrying each intermediate step [6]. Cognition’s launch post reported that Devin resolved 13.86% of issues on a subset of the SWE-bench benchmark unassisted, against a previous best of 1.96% [6] — both of those percentages are the vendor’s own reported figures, not an independently reproduced result, and they should be read as a claim rather than a settled fact.
That distinction matters here specifically, because Devin’s launch is also a clean, documented example of what happens when a vendor’s demonstration outruns independent verification. Within weeks, an independent developer analyzing Cognition’s own published Upwork demonstration reported that Devin had been given only a fraction of the original client’s request, that the deliverable it produced diverged substantially from what was asked, and that a bug it “fixed” was one it had introduced itself in a file of its own creation rather than a pre-existing defect in a real repository — while a human reviewer completed the actual underlying task in roughly thirty minutes [7]. None of this disproves that agentic coding tools work; it demonstrates that a headline capability claim from a single vendor demonstration is not evidence on its own, and that the appropriate response to such a claim is independent reproduction, not repetition.
Anthropic’s own entry into this space was framed more narrowly. On February 24, 2025, alongside Claude 3.7 Sonnet, Anthropic introduced Claude Code as a limited research preview, described as “an active collaborator that can search and read code, edit files, write and run tests, commit and push code to GitHub, and use command line tools — keeping you in the loop at every step” [9]. That last clause is the load-bearing one, and it marks the real structural change of this period, distinct from any single vendor’s capability claims: the tool now had the ability to act, and the product decision made in response was not to let it act unsupervised, but to insert a checkpoint before consequential actions and ask. Anthropic’s own announcement also reported that, in internal testing, Claude Code completed some tasks in a single pass that would otherwise take a developer more than 45 minutes — again a vendor-reported figure describing the company’s own testing, offered here as a claim about what Anthropic observed rather than an independently audited benchmark result [9].
The reason a permission gate became the central design decision of this era, rather than an afterthought, is a security argument as much as a product one. Independent security researcher Simon Willison named the underlying risk directly in June 2025 as the “lethal trifecta”: an agent that can be exposed to untrusted content, that has access to private data, and that can communicate externally, can be steered by instructions hidden in that untrusted content — and he pointed specifically to a 2025 exploit against a GitHub-connected agent as a real instance of exactly this pattern [15]. A coding agent with shell access, repository access, and the ability to open network connections satisfies all three conditions by default. Gating consequential actions behind an explicit approval step is not a convenience feature bolted onto an agentic coding tool; it is the direct engineering response to a named and documented class of attack.
Measuring autonomy: benchmarks built to be failed
None of this would be measurable without benchmarks built specifically to resist being solved by pattern-matching alone. SWE-bench, published in October 2023, drew 2,294 task instances from real GitHub issues and their corresponding merged pull requests across twelve Python repositories: a model is given an issue description and a codebase snapshot and must produce a patch that passes the project’s own test suite [5]. This was deliberately harder than HumanEval’s self-contained problems, because a real issue usually requires locating the relevant code inside a large, unfamiliar repository before any fix can even be attempted. The best model evaluated in the original SWE-bench paper, Claude 2, resolved only 1.96% of instances — a figure that is frequently misquoted as a criticism of that specific model, when its more durable use is as a baseline showing how much headroom existed between “can generate plausible code” and “can resolve a real, unseen software issue end-to-end” [5].
A second, independently run measurement effort took a different approach: instead of asking whether an agent could solve one fixed set of tasks, it asked how long a task an agent could complete autonomously with 50% reliability, using human professional completion time as the unit. METR’s March 2025 study, compiled from 170 tasks and more than 800 human timing baselines across software engineering, cybersecurity and general reasoning work, reported that this “50%-task-completion time horizon” for frontier agents had been doubling approximately every seven months for six years running, and that the finding was robust to an order-of-magnitude error in the underlying measurements, which would only shift the projected timeline by around two years [14]. Writing the trend as a simple exponential makes its shape explicit:
where
Anatomy of the current generation: permissions, hooks, subagents, memory, protocol
The specific architecture Claude Code settled into by 2026 is worth describing on its own terms, because it is the concrete answer this generation of tools gave to the problem the rest of this article has been tracing. Four mechanisms carry most of the weight.
Permissions are tiered rather than binary: read-only actions such as file reads generally proceed without interruption inside the working directory, while shell commands require approval except for a built-in allowlist of read-only commands, and an operator can check permission policy into version control so an entire team inherits the same rules [10]. Hooks let a team attach deterministic shell commands to specific points in the agent’s lifecycle — before a tool runs, when a permission decision is about to be requested, at session start or end — so that certain actions happen every time regardless of what the model itself decides, which matters precisely because a model’s judgment, however good, is not an enforcement mechanism [11]. Subagents let a side task run in its own isolated context window, with its own restricted tool access, so that a large exploratory search does not consume the token budget or the trust boundary of the main session, and so independent investigations can run in parallel rather than one after another [12]. And memory is split deliberately into two kinds: files a person writes once and the agent reloads every session, and short notes the agent writes to itself about corrections and preferences it has been given, capped in size specifically so that memory does not silently grow until it crowds out everything else the agent needs to hold in mind [13].
None of those four mechanisms would extend past the tool that shipped them without a shared way to connect an agent to systems its vendor did not build in advance. Anthropic published the Model Context Protocol in November 2024 as an open specification, describing two roles — a host application and the servers it connects to — through which any compliant agent can reach an external data source or tool without a bespoke integration being written for that specific pairing [8]. Its adoption outside Anthropic’s own products, by other editors and coding tools announced in the same release, is the detail that distinguishes it from an internal feature: it was built, and used, as a shared protocol rather than a proprietary hook.
What actually changed, in three axes
Collecting fifty years of tools into a single before-and-after undersells what happened, because the change ran along three separate axes that did not move together. The first is perceptual: what the tool could see grew from a single finished file, to a file being actively typed, to a whole repository plus arbitrary external context reachable through a protocol. The second is what the tool could do: from printing an opinion, to offering a name already known to exist, to generating an unprecedented span of code, to editing a file, running a command, and observing the result. The third, and the one this history keeps returning to, is who decided whether an action happened: originally always the programmer, reading a warning at their own pace; then the programmer again, accepting or rejecting a suggestion keystroke by keystroke; and now, for a defined class of lower-risk action, a policy decided in advance, with a live approval step reserved for what that policy flags as consequential.
It is tempting to describe this as a straight line toward more autonomy, and vendor announcements tend to describe it that way. The more accurate description, visible once permissions, hooks, and the lethal-trifecta security argument are all held in view together, is that autonomy and supervision grew in the same period, as two sides of the same engineering problem: neither Claude Code’s permission tiers nor its hooks system would need to exist if the tool had stayed as constrained as a 1990s autocomplete dropdown. The capability and the gate were built at the same time, by the same design process, because one made the other necessary.
Predictions, with the observations that would falsify them
The following are forecasts, separated deliberately from the sourced history above. Horizon: August 2029, three years out.
One. The task-completion time-horizon trend METR reported will continue at a broadly similar doubling period, putting a 50%-reliable frontier coding agent in the range of a full working day of unassisted human-equivalent software task by the horizon date. Disconfirmed if two or more independent measurement efforts using comparable methodology report a doubling period materially longer than twelve months, sustained across at least two reporting cycles.
Two. Permission-gating, hook-style deterministic enforcement, and MCP-style shared tool protocols will converge into something closer to an industry norm rather than a single vendor’s feature set, the way version control and continuous integration did before them. Disconfirmed if, by the horizon date, the leading agentic coding tools still rely on incompatible, non-interoperable tool-connection protocols with no meaningful cross-vendor adoption of a shared standard.
Three. Vendor demonstrations of new agentic capability will keep outrunning independent reproduction, and the corrective mechanism will remain the same one that surfaced Devin’s Upwork claims: individual practitioners re-running the demonstrated task themselves. Disconfirmed if an industry-standard, vendor-neutral reproduction body becomes the primary way capability claims are checked before wide reporting, rather than after.
What to take away
The tool that reads a repository, edits a file, runs a test, and asks before doing anything riskier is not a break from what came before it; it is what fifty years of the same underlying negotiation looks like once the machine can finally act as well as suggest. Lint could only object, after the fact, on paper. Autocomplete could suggest a name already known to exist. Ghost text could generate a line that had never existed anywhere before. What changed last, and what makes the current generation different in kind rather than only in degree, is that the tool can now act on its own suggestion — and that the same engineering decision that made that possible also built the gate that asks permission before it does.
Read against that lineage, an agent’s permission prompt is not a limitation grudgingly imposed on an otherwise-finished capability. It is the current, tentative answer to the question every tool in this history has had to answer for itself: how much of this should happen without a person checking first — and the honest answer, so far, has kept changing every few years.
