Why Is No One Building the Dream Coding Agent?#

2026-10-18

Lynch’s Complaints Are Mine Too#

On October 9, 2026, Michael Lynch published “Why are coding agents so dumb?” His point is that models have improved enormously, while the agents wrapped around them have barely changed since February 2025. When I covered the post in the October 11, 2026 AI news brief, I wrote that most of its complaints apply to my own setup too.

His examples are concrete:

• The agent splits work into ten subtasks that could run at the same time, then does them one by one.
• It uses the most expensive model even for simple work like finding one pattern in 50,000 lines.
• When it doesn’t know its own features, it searches the web, and it repeats the same search in the next session.
• An overnight task stopped two minutes in to ask for a branch name, then waited until morning.
• It read a file the docs said not to read, and private application keys ended up on a model provider’s servers.

Later in the post he lists 17 conditions for a “dream agent.” I wanted to use that list to check two things. First, as of October 2026, how well do the main coding agents (Claude Code, Codex, GitHub Copilot, Cursor; I’ll call them the major agents) and open-source agents such as Hermes Agent, OpenCode, and Pi meet these conditions? Second, if the unmet conditions exist because general-purpose products have to satisfy every user, could a new agent aimed at a specific group of users take that empty space?

For the second question, let me define one term up front. In this essay, a niche agent means a new coding agent that targets a specific group of users and leads with the needs that general-purpose agents leave unmet. It is a product aimed at a niche market, so the term refers to a product strategy, not a single feature. The users I have in mind are power users like Lynch and security-sensitive organizations.

Here is my conclusion up front. The gaps don’t come from a single cause. Some exist because they clash with serving everyone, some because they clash with the interests of model companies, and some because no one has solved them yet. A niche agent can win only in the second category, and even there only by putting an orchestration layer on top of official agents, not by building a new agent.

What the Dream Agent Asks For#

Lynch’s list has ten “table stakes” and seven “bigger wishes.” I regrouped them into four bundles by what they do.

Isolation: conditions that limit what the agent can touch.

• An OS-enforced sandbox: not a polite “please don’t read this file” or a regex list of shell commands, but file system and network boundaries enforced by the operating system.
• Per-repository access: one repository by default, with other repositories opened per session as read-only or read-write.
• A secret-injection proxy: the agent only sees a placeholder, and a proxy inserts the real value only into requests going to allowed hosts. The agent can use a secret but can’t exfiltrate it.

Orchestration: conditions for dividing work across tasks and models.

• Task splitting and model matching: break the work up, send simple tasks to cheap, fast models and hard ones to strong models, and let the user adjust per task.
• User-steerable subagents: the user can step into any subagent session to redirect it or end it early.
• Calibrated ETAs: ETA (Estimated Time of Arrival) here means when a task is expected to finish. Each task should show its remaining time, and the estimates should improve by learning how far off past estimates were.
• Quota-aware model selection: pick models based on remaining usage and reset timing. For example, use the expensive model more when plenty of quota is about to reset.
• Cross-model review: complex work gets reviewed by a different model, and the two iterate until they agree.

Autonomy and self-knowledge: conditions for keeping work moving without a human.

• Plans people can read: plans that go from the big picture down to details, with UI mockups, data flow diagrams, and decision trees.
• Deciding when no one answers: if a question asked during execution goes unanswered for 30 minutes, the agent decides on its own; in AFK mode it doesn’t wait at all.
• Knowing its own features: the agent knows its own features and configuration without searching the web.
• Reviewing its own sessions: the agent looks back over past sessions and improves. If it wasted tokens parsing logs ad hoc every time, it builds a dedicated tool.
• Accurate error messages: errors about plans and usage shouldn’t be vague or wrong.
• A unified local dashboard: one screen showing every session, including the ones that need a human response. It runs locally without an exposed tunnel and opens on a phone.
• Language-aware local diffs: explained below.

Openness: conditions for not being tied to one company.

• Provider freedom: any LLM provider works, including flat-rate unlimited plans.
• Open source: the code is public.

“Language-aware diffs” need a little explanation. A regular git diff treats code as a sequence of text lines and only compares which lines were removed or added. A language-aware diff parses the code with the language’s grammar and compares it structurally. Take wrapping two existing lines in an if block:

// before
const result = compute(a, b);
save(result);

// after
if (enabled) {
  const result = compute(a, b);
  save(result);
}

A line-based diff shows the two re-indented lines as deleted and rewritten. A structural diff shows only that if (enabled) { and } were added. Agents change hundreds of lines at a time and often touch formatting, so in a line-based diff the real changes get buried in noise. Lynch wants to see diffs like this locally, without pushing to GitHub.

October 2026: Fewer Gaps Than Expected#

The table below reflects mid-October 2026, checked mainly against each tool’s official documentation and changelogs, with some third-party sources filling in. Instead of listing every tool, it shows only the implementation closest to each condition.

Of the 17, only four are untouched. That was far fewer than I expected. The “partial” entries, though, tend to look alike.

The defaults are off. Claude Code’s official docs state that its sandbox is off by default. GitHub Copilot’s local sandbox reached general availability on October 7, and it is also off by default. In Claude Code, the timeout that lets the agent move on when a question goes unanswered also has to be turned on by the user in /config.

The scope is narrow. Claude Code’s sandbox only wraps shell commands. The file read and edit tools, MCP (Model Context Protocol) servers, and hooks run outside it. The docs say plainly that “a denyRead entry doesn’t stop the Read tool.” Lynch’s incident, where the agent read a file it was told not to, would have to be blocked by permission rules rather than the sandbox if it happened through the file tools, even with the sandbox on. The mask feature for substituting secrets, added in version 2.1.221 in early August, also applies only to shell commands. Copilot’s docs likewise say its built-in file tools run inside the same process, so the OS sandbox can’t constrain them; the tools check the policy themselves on a best-effort basis.

It runs once and stops. HydraFusion, a GitHub Copilot research preview, picks an execution pattern per task. One model handles it (Single), a cheap model drafts and escalates to a stronger one if the draft falls short (Cascade), or a different model critiques the draft (Critique). It is the closest thing to Lynch’s “per-task model matching” and “cross-model review.” But according to the official docs, in Critique the original model revises once and that’s it, and users can’t choose which models are used.

Open-source agents have the opposite shape. Provider freedom and open source come built in, but isolation is weak. OpenCode and Cline stop at app-level permission rules. Hermes Agent is meaningfully isolated only when you pick a container backend such as Docker, and Pi deliberately ships without a permission system, pointing users to micro-VM extensions such as Gondolin instead.

In the brief, I wrote that Microsoft’s MXC, Copilot’s local sandbox, and HydraFusion were “exactly the answers to the list this post asks for.” After filling in the table, that turned out to be only half right. They point in the right direction, but on defaults, scope, and number of iterations they still fall short of what Lynch asks for.

The First Gap: Defaults Built to Satisfy Everyone#

It isn’t hard to see why sandboxes are off by default. Enforcing boundaries at the OS level breaks tools that need to reach outside them: build tools, package managers, the keychain, SSH agents, Docker. A product can’t survive if huge numbers of users start with “nothing works.” So vendors leave the default off, and even after you turn it on they leave exits open. Claude Code can retry a command that failed inside the sandbox outside of it, and where the sandbox can’t start, it runs commands without protection by default. Both can be blocked in settings, but blocking them is the opt-in.

I’ve lived the logic of this default myself. I turned on Claude Code’s sandbox, found it got in the way, turned it off, and managed the risk by reading responses carefully. I reexamined that decision in The Sandbox I Turned Off Because It Got in the Way. If a power user like me turns a feature off, it’s hard to justify leaving it on by default for ordinary users.

Autonomous decisions follow the same pattern. In version 2.1.200, Claude Code stopped question dialogs from auto-continuing without an answer by default, and made the idle timeout something users turn on themselves. The more users a product has, the bigger the liability when “the agent decided on its own.” Waiting by default and making autonomy an explicit user choice is a reasonable call for a general-purpose product.

Priorities in policy management also come from serving a broad market. Organizations pay, so sandbox policies are polished first in forms that administrators deploy centrally. MXC has announced integration with Microsoft’s device management tools, Intune and Entra. Meanwhile, the screen where an individual picks “read-only for this repository” per session gets pushed back.

So far, the hypothesis that “the gaps come from clashing with general-purpose goals” holds exactly. But this category has a catch. The major agents already have the switches. There are settings that strictly enforce the sandbox, and there is a question timeout. Much of what Lynch wants is “different defaults,” and different defaults take a settings file, not a product. A niche agent that leads with “strict defaults” would effectively be selling a settings file, and the difference would vanish the moment a major agent added a preset in its next release.

The Second Gap: Features Model Companies Have No Reason to Build#

Choosing models based on remaining usage, routing work to other companies’ models, and handing review to another company’s model are different in kind. They are less technically hard than at odds with the interests of the companies building the agents.

Claude Code only uses Claude models. A company that makes models has little reason to hand work to a competitor’s model inside its own agent. Quotas are similar. Claude Code shows usage with /usage, but doesn’t use that information to choose a model. Usage limits also overlap in five-hour windows, weekly windows, and per-model buckets, which makes them hard to compute from the outside. A feature that helps users see their quota precisely and use less of it points in the opposite direction from the provider’s revenue. That last part is my inference.

So the companies filling this gap are the ones that don’t make their own models. HydraFusion, described above, is one. On October 7, GitHub shipped a Copilot CLI feature that discovers local model runtimes such as Ollama, and previewed routing that sends simple tasks to local models. In an August 6 post, Cursor explained how Cursor Router works: it scores each turn’s complexity between 0 and 1, sends low scores to a cheaper model, and sends high scores to the frontier model that has performed best on that kind of task.

There is one exception. OpenAI itself released codex-plugin-cc, a plugin that runs code review with Codex inside Claude Code. I read it as a distribution strategy: get inside a competitor’s agent and have people use your model there. It also shows that each company moves only when the move widens where its own models get used.

Lynch attributed the underinvestment in agents to executives’ incentives, which focus on “benchmarks and demos that measure models rather than agents.” As I see it, his hypothesis fits this category best. And this is also the only category where a niche agent can enter without colliding head-on with the major agents. It isn’t empty, though. GitHub and Cursor, both model-neutral, are already moving into it.

The Third Gap: Problems No One Has Solved Yet#

The last category is hard no matter who builds the agent.

You don’t know how hard a task is until you try it. Even Cursor Router estimates quality after the fact. According to Cursor, a user moving on to the next task is a good signal, and correcting the agent is a bad one. Cost is another issue. As the September 27 brief covered, agent work involves vastly more input tokens than output tokens, and much of that input is discounted through the prompt cache. Switching models mid-session throws that cache away and forces the long context to be read again. Cursor also says it accounts for cache misses caused by switching models. That is why the unit of model switching ends up being the subagent, not the turn.

ETAs have no numbers to stand on. An agent can’t know in advance how many tool calls it will make, or how many times it will retry after a test fails. On the Cursor forum, one answer went as far as saying ETAs for long-running agents are practically impossible. The only realistic path is the one Lynch describes: calibrating against past records.

Iterating until agreement can’t guarantee an end. If the two models never agree, the cost keeps growing. I suspect that’s why HydraFusion revises only once.

An OS sandbox has trouble confining the agent itself. The agent process has to call the model API, so it must hold credentials and network access. File tools running inside that process stay outside the OS sandbox, and confining the whole thing takes a container or a VM. Hermes’s Docker backend and Pi’s Gondolin take this approach. Isolation features also differ from one operating system to another, so it’s hard to enforce the same policy at the same strength on macOS, Linux, and Windows. In July, sandbox escapes were reported all at once in Cursor, Codex, Gemini CLI, and Antigravity. What several of them had in common was a trusted component outside the sandbox executing files the agent had written.

Plans and diffs carry a different kind of cost. Language-aware diffs require maintaining a parser for each language. Plans that go from the big picture to details depend more on the model and prompt than on the renderer, and, as with the “Plan mode is dead” post introduced in the same brief, there is skepticism about long planning documents themselves.

Self-knowledge fights the release cadence. The Claude Code I use has a built-in subagent for explaining its own features, and its tools include web fetch and web search. It ends up looking up web docs, so Lynch’s complaint still stands. For a tool that ships a new version almost every day, what the model learned at training time goes stale quickly. Bundling all the docs adds size and context cost. Gemini CLI and Pi answer from bundled documentation, but I haven’t verified whether their answers match the exact version.

Targeting a specific group of users doesn’t solve anything in this category. It has to be won with technology, and a niche agent has no reason to be better positioned than the major agents.

If You Built a Niche Agent#

Once the gaps are sorted into three categories, a niche agent’s target narrows to the second one. Looking at whether it makes sense to build a new agent to enter that space, I see five obstacles.

First, you can’t use the most popular subscription. Lynch wants to plug in flat-rate unlimited plans. But Anthropic keeps the usage included in Claude subscriptions inside its own products. This year it has closed off third-party tools sending requests with Claude subscription credentials, through server-side blocks and terms changes, and tools like Hermes Agent that connect a Claude account draw on separate extra-usage credits rather than the included subscription usage. GitHub, by contrast, has officially supported Copilot subscriptions in OpenCode since January, and OpenAI is opening subscription usage to third parties through Sign in with ChatGPT. I covered this split in Why an AI Subscription Isn’t a Cheap API and Will the Day Come When My Users’ Subscriptions Pay for My App’s AI?. As far as Claude is concerned, a new agent with its own loop has to start from API costs.

Second, the major agents absorb features quickly. Claude Code’s changelog alone shows the question-wait behavior in 2.1.200, a cap on concurrently running subagents (20 by default) in 2.1.217, and secret masking in 2.1.221. Features in the first category become a single setting in a major agent within months.

Third, the open-source general-purpose agent slot is already taken. OpenCode and Hermes Agent already have large communities, and Pi, now under Earendil, shipped 1.0 on October 1. “A configurable open-source agent that works with any model” is no longer a new proposition.

Fourth, tools without a business model are the first to go. Roo Code, which had built up a large install base as a VS Code extension, shut down its service in May 2026, and the company behind Vibe Kanban, which managed multiple coding agents on a kanban board, closed. The survivors chose one of three paths: reselling model usage (OpenCode), selling to enterprises (Factory), or joining or being acquired by another company (Pi, and Kilo Code, which Anaconda acquired). This combines third-party reports and comparison material, so details may differ.

Fifth, the people who want this list most build it themselves. Lynch didn’t trust vendor sandboxes either, so he built his own. Power users assemble before they buy.

Weighing these against each approach gives the following.

The form that remains viable is the orchestration layer: run unmodified Claude Code, Codex, and Copilot CLI on each user’s own subscription, and on top of them split the work, view quotas together, and have them cross-review each other’s results. Running an official runtime is different from impersonating an official client, so the terms-of-service risk is low, and the effort can concentrate on the second category. There’s competition here too. Conductor already ships an app that runs Claude Code and Codex in parallel across Git worktrees, and in June Niteshift, a model-neutral coding platform pitched as a bet against Big AI lock-in, raised a seed round. I see it as a space that makes sense for a personal tool or an open-source project rather than one big enough to build a large company on.

How I Fill the Gaps#

This conclusion leads back to the same place as my April essay, How to Add Coding Runtimes to an AI Agent Web Service. There I wrote that you don’t need to build a coding loop from scratch: the runtime is the execution engine, and what a product should own is the operations layer. This research adds one more reason to that view. Whatever you gain by building a new loop, the major agents will soon match, and the differences they won’t match live not in the loop but above it.

My own setup already works this way.

• The self-knowledge gap: this blog’s repository has skills and agent memory files covering how to write posts, translate them, and put together news briefs. The agent doesn’t know its own features, but it does know how to work in this project without searching the web.
• The rule-enforcement gap: rules that live only in documents keep getting broken in long sessions, so I’m moving some of them into Claude Code Mods. I described the process in Rules from Memory to Code.
• The isolation gap: I’ve made a plan to turn the sandbox I had disabled back on, depending on the kind of work.
• The dashboard gap: for my personal remote development environment, I paired Hermes Agent with Discord instead of a web dashboard. No dashboard port is exposed; the server only keeps an outbound connection to Discord, so it meets Lynch’s “no tunnel” requirement in a different way. The setup is in An Agent That Keeps Working After the Laptop Closes.

In my setup, the second-category slots, cross-model review and quota-aware model selection, are still empty. How far wiring official runtimes together can fill them is the next thing I’m considering looking into.

Closing#

Lynch traced the missing dream agent to executives’ incentives. Sorting the gaps into three categories, that explanation fits only one of them. Model companies not routing to competitors’ models is indeed an incentive problem. But sandboxes being off is the price a product pays for serving everyone, and ETAs are missing because no one knows how to do them yet.

So my answer to the title’s question is this. The dream coding agent is probably not a product one company can build and sell. Some slots collide with defaults meant for every user, some collide with the business of the company building the agent, and some need technology that doesn’t exist yet. For now, the closest thing to the dream agent will be a working environment each of us assembles on top of official runtimes used as the engine. Just as Lynch built his own sandbox.

References#

• Michael Lynch — Why are coding agents so dumb?
• Claude Code — Configure the sandboxed Bash tool
• Claude Code — Changelog
• OpenAI Codex — Sandboxing
• GitHub Docs — About cloud and local sandboxes
• GitHub Changelog — Local sandboxing for GitHub Copilot now generally available
• GitHub Docs — HydraFusion
• GitHub Changelog — Discover local models in GitHub Copilot CLI
• Cursor — How Cursor Router chooses the right model for the task
• Cursor — Changelog 2.2
• Windows Developer Blog — Microsoft Execution Containers
• Hermes Agent — Security
• Hermes Agent — Skills
• Hermes Agent — Web Dashboard
• Hermes Agent — AI Providers
• OpenCode — Web
• Gondolin
• difftastic
• OpenAI — codex-plugin-cc
• GitHub Changelog — GitHub Copilot now supports OpenCode
• Anthropic — Consumer Terms of Service
• A timeline of Anthropic’s third-party access restrictions (third-party)
• BleepingComputer — Cursor, Codex, Gemini CLI, Antigravity hit by sandbox escapes
• Roo Code shutdown overview (Kilo Code)
• Conductor — Parallel agents
• TechCrunch — Niteshift