The most visible change in software development in recent years is not a new framework or language, but the move from AI autocomplete to agentic coding systems. These tools read an entire codebase, plan changes across several files, run tests and present the result as a pull request. Here is what that means for productivity, security and teamwork.
What does "agentic" mean in practice?
An agentic AI system differs fundamentally from a reactive assistant. When GitHub launched the technical preview of Copilot in June 2021, the tool drew on the surrounding code to suggest whole lines or entire functions. Accepting a suggestion, and everything after that, was up to the developer.
Today's agents work in a loop: they take a task in natural language, explore the repository, plan the change, edit several files, run commands such as tests or linters and correct themselves based on the output. Anthropic describes Claude Code as an agentic coding tool that reads your codebase, edits files, runs commands and creates commits and pull requests. According to GitHub's documentation, its Copilot agent can research a repository, plan changes and implement them in the background in a cloud development environment, run tests and linters there and open one pull request per task.
The decisive difference is autonomy: an agent completes several steps on its own before a human sees the result. That shifts responsibility towards review, permissions and quality assurance.
What research says about productivity
The real gain is hard to measure. For a study published in July 2025, the research organisation METR had 16 experienced open-source developers work on 246 real issues in large repositories they knew well. Each issue was randomly assigned to be done with or without AI tools. The result: with AI, they took 19% longer. Beforehand they had expected a 24% speed-up, and even afterwards they believed AI had made them about 20% faster.
METR stresses that this is a snapshot of early-2025 tools in one setting, and now notes that the figures no longer reflect the current impact of AI models; newer data followed in February 2026. The key lesson still holds: feeling faster is not the same as being faster. Before introducing agentic tools, decide how you will measure success, for example ticket lead time, review rounds or defects after deployment.
Prompt engineering as a developer skill
In professional teams, prompts are not throwaway inputs. With agents, the context you provide permanently often matters more than any single instruction. Claude Code, for instance, reads a CLAUDE.md file in the project at the start of every session, where teams record coding standards, architecture decisions, preferred libraries and review checklists. It can also read an existing AGENTS.md written for other coding agents. Such files belong in the repository and get the same review as code.
It pays to treat prompts and project rules like code:
Version them: project rules, recurring prompts and agent configuration live in the Git repository, so changes are traceable and can be rolled back.
Be specific: instead of "build a contact form", a good task states the goal, the files involved, the acceptance criteria and the areas that must not be touched.
Make it verifiable: every task ends with an objective check, such as an automated test, a linter run or a build that the agent can run itself.
Retest after changes: when the model or tool version changes, rerun known reference tasks, as behaviour can shift.
Multi-agent workflows
The next step is several specialised agents working on one task: one analyses the requirements, another writes the code, a third adds tests, a fourth reviews the result. In Claude Code, multiple agents can work on different parts of a task in parallel, with a lead agent coordinating the work, assigning subtasks and merging the results. For custom workflows, Anthropic offers the Agent SDK, which gives full control over orchestration, tool access and permissions.
In an agency team, an experienced developer defines the task, constraints and acceptance criteria, and agents handle clearly scoped parts of the implementation. The human becomes more of an architect and reviewer. Agents do well with clearly scoped tasks that have tests, such as migrations, missing test coverage or repetitive changes across many files. Vague requirements, grown legacy logic and decisions with business consequences still need human judgement. Whether custom software gets built faster this way depends mainly on the quality of the specification.
New security risks
Agentic AI brings risks that go beyond classic programming mistakes. GitHub's own documentation states that Copilot can produce incorrect or suboptimal code, including code that contains security vulnerabilities, and that output should be reviewed and tested before it is used in production. Three risks deserve particular attention:
Invented dependencies: language models sometimes suggest packages that do not exist. A study presented at USENIX Security 2025 analysed 576,000 generated code samples from 16 models and found an average of at least 5.2% hallucinated packages for commercial models and 21.7% for open-source models, with 205,474 unique invented package names. The authors describe this as a new form of package confusion attack and a threat to the software supply chain. Every new dependency therefore needs a deliberate check.
Too much latitude: the OWASP GenAI Security Project lists "Excessive Agency" as a separate risk in its 2025 Top 10 for LLM applications. Its root causes are excessive functionality, excessive permissions and excessive autonomy. OWASP recommends limiting extensions to the minimum necessary, granting least privilege and requiring a human to approve high-impact actions.
Manipulated input: among the triggers for damaging actions, OWASP lists direct and indirect prompt injection and, in multi-agent systems, a compromised peer agent. An agent reading tickets, web pages or third-party documentation may find hidden instructions there.
The critical question is: if the machine writes the code, who checks the machine? A proven approach combines automated checks in the CI/CD pipeline (static analysis, dependency and secret scanning, tests) with human code review, which must not be skipped in security-critical areas such as authentication, payments or personal data. Swiss companies should also consider data protection: before an agent gets access to a repository, log files or a test database, clarify which data goes to the provider and whether real personal data is involved. Anonymise test data wherever possible.
Getting started in five steps
Choose a pilot: start with an internal or non-critical repository and clearly scoped tasks, such as missing tests or dependency updates.
Write down the rules: store coding standards, test commands and areas the agent must not touch as a file in the repository.
Limit permissions: agents work in an isolated environment, without access to production systems and with write access only to their own branches. Merging into the main branch stays with humans.
Secure the pipeline: every agent pull request goes through the same automated checks as human code, plus a review of new dependencies.
Measure, then decide: after a few weeks, compare lead time, review effort and defect rate with the pre-pilot figures before deciding whether to expand.
What this means for your team
The core competency is shifting from pure implementation towards specification, orchestration and review. Precise task descriptions, critical evaluation of AI output, an understanding of model limitations and security awareness all gain importance. Solid craftsmanship remains the foundation: only developers who can judge code themselves will notice when an agent delivers code that looks plausible but is wrong.
Common early mistakes include handing all entry-level tasks to agents and neglecting junior developers' training, reviewing agent pull requests less thoroughly than human ones, and judging success by gut feeling rather than metrics. For a comparison of the most widely used tools, see our article on Claude Code, Cursor and GitHub Copilot.
Through our digital consulting, Sidora AG supports teams with tool selection, process design and securing agentic workflows. For integrating your own AI agents into business processes, see our AI solutions.
