Software Development Agents: What Works and What Doesn't - Robert Brennan, AllHands/OpenHands

Software development is undergoing a fundamental shift. The role of a software engineer is evolving from writing code to thinking critically about user needs, business objectives, and system architecture. While AI is adept at the inner loop of writing and running code, the high-level, empathetic, and strategic tasks remain the domain of human engineers. In this new paradigm, we will spend less time squinting at an IDE and more time thinking about the bigger picture.

Understanding AI Coding Agents

An AI coding agent is defined by its “agency”—the ability to take action in the real world. It uses the same core tools as a human developer: a code editor, a terminal, and a web browser.

This distinguishes them from more tactical code generation tools. The evolution has been from simple autocompletion (like GitHub Copilot) to more asynchronous, powerful agents (like OpenHands and Devin). These agents can be given a high-level task and will work autonomously for several minutes to produce a complete solution, such as a pull request.

How Agents Work Under the Hood

The core of an agent is a loop between a Large Language Model (LLM), which acts as the brain, and the external world.

1. The LLM decides on the next action to move closer to its goal (e.g., read a file, run a command).
2. The agent executes the action using its tools.
3. The output or result from the action is fed back into the LLM.
4. This loop repeats until the task is complete.

The primary tools present interesting technical challenges:

• Code Editor: To work efficiently, agents use diff-based or find-and-replace editing rather than rewriting entire files. They can also use Abstract Syntax Trees (ASTs) to navigate the codebase more effectively.
• Terminal: Challenges include handling long-running commands, managing parallel processes, and interacting with background services like a web server.
• Web Browser: Simply passing raw HTML to the LLM is inefficient. Better approaches involve using accessibility trees, converting content to Markdown, or providing the LLM with labeled screenshots to identify elements for interaction. This remains an active area of research.

Security and Sandboxing

Running autonomous agents requires a strong focus on security. It is crucial to ensure they cannot perform dangerous actions on a developer’s workstation.

• Sandboxing: All agents should run inside a secure, isolated environment, such as a Docker container, to prevent unintended consequences like rm -rf on a home directory.
• Scoped Credentials: When granting agents access to third-party APIs (e.g., GitHub, AWS), always follow the principle of least privilege, providing tightly scoped, temporary credentials.

Best Practices for Working with Agents

To use agents effectively, it’s important to build the right intuition and habits.

• Start Small: Begin with tasks that are quick to complete, have a clear definition of done, and are easy for a human to verify. Good starting points include fixing failing tests, resolving lint errors, or handling merge conflicts. As you build intuition, you can delegate larger tasks.
• Be Clear and Specific: Don’t just tell the agent what you want; tell it how you want it done. Mention specific files, functions, frameworks, or development strategies (e.g., “use test-driven development”). This improves accuracy, reduces exploration time, and lowers inference costs.
• Remember: Code is Cheap: In an AI-driven world, code is disposable. Use agents for rapid prototyping and experimentation. If an agent’s output isn’t right, don’t be afraid to discard it and start fresh with a more refined prompt. This requires developing a new muscle memory for throwing work away.
• Review All AI-Generated Code: This is the most critical practice. Never automatically merge code from an AI agent. Blindly accepting AI contributions leads to tech debt, duplicate code, and an unmanageable codebase. Always pull the code, run it, and review it to ensure it solves the problem correctly. Trust, but verify.

Human Accountability is Non-Negotiable

An early learning from OpenHands was that pull requests created by the bot persona were often ignored and lacked ownership. If a test failed or a bug was introduced, no one felt accountable.

The solution is to ensure the human engineer who initiates the agent’s task is the owner of the resulting pull request. Their face is on the PR, and they are responsible for its quality, for getting it merged, and for any downstream consequences.

Common and Effective Use Cases

While agents are generalists, they excel at specific, well-defined tasks.

• Resolving Merge Conflicts: A rote, tedious task that agents can handle with high accuracy.
• Addressing PR Feedback: Agents are excellent at implementing changes based on clearly articulated feedback from a human reviewer.
• Fixing Small Bugs: Correcting minor bugs without needing to open an IDE.
• Infrastructure Changes: Handling esoteric syntax for tools like Terraform, often by looking up documentation.
• Database Migrations: Agents tend to be better at following best practices, like setting up indexes and foreign keys correctly.
• Expanding Test Coverage: A safe and valuable task to improve codebase quality.
• Building Internal Apps: For non-production, internal tools, agents can be used to rapidly build applications from scratch with less stringent code review.

• Tags:
• AI Agents
• Software Development
• Code Generation
• Developer Productivity
• OpenHands
• AI-Driven Development