A general AI agent with a shell can edit code. It is not very good at it. Coding agents like Claude Code and Codex are much better, because that is the only thing they are built to do: read a repository, plan, edit, run the checks, fix, repeat.
So instead of teaching every agent to code, we let them hand the code to a coding agent. This article explains how that works in AgenticOS, the open-source system for company agents we build at Vstorm, what it needs, and what a real task looked like. Drafted with AI assistance, edited and verified by the author.
The idea in one paragraph
In AgenticOS an agent is something your team builds in the browser: instructions, a model, knowledge and a set of tools it may use. The coding agent is one of those tools. When an agent decides a task is software work, it hands the whole task to Claude Code or Codex, which runs in the agent's own sandbox until the task is done. The person in the chat watches it work, step by step, and gets back the answer, every step it took and the files it changed.
From the agent's side, the coding agent is a colleague it delegates to. From your side, it is Claude Code or Codex working on your files, with your rules, where your team can see it.
What Claude Code and Codex are
If you have not used them: Claude Code is Anthropic's coding agent and Codex is OpenAI's. Both run in a terminal, read and edit the files of a project, run commands and tests, and keep going until a task is done. Developers usually run them on their own laptop. AgenticOS runs them on a server, inside a sandbox, on behalf of an agent.
Switching it on
The coding agent is a capability in an agent's Toolbox.
It needs three things:
- A sandbox. The coding agent needs a computer to work on, so the agent must have the sandbox capability with shell commands on. Publishing an agent without it is refused. The default runtime has Claude Code and Codex installed.
-
A harness and a credential. Choose Claude Code or Codex. Claude Code takes an Anthropic API key, or the token
claude setup-tokenprints for a Claude Pro or Max subscription. Codex takes an OpenAI API key, or a ChatGPT sign-in. The credential lives in AgenticOS's encrypted vault and reaches the task through its environment, never on a command line. - A decision about approval. By default the coding agent runs without asking. Set Human approval to Always ask and a person confirms each task before it starts.
You can also pick the model (for example Claude Sonnet or Opus for Claude Code), a timeout for one task (15 minutes by default, up to 60) and, for Claude Code only, read-only access, where it can read the code and answer but not change anything.
Why it can work without stopping to ask
When you run Claude Code or Codex on your laptop, they ask permission before running commands. On a server nobody sits at that terminal, so AgenticOS starts them with their own prompts off. That sounds alarming until you look at where it runs: the container is the boundary. The coding agent can change any file and run any command, but only inside the agent's sandbox. Whether a task happens at all is the person's call, through Always ask.
Read-only mode is enforced by the harness, not by a list of allowed commands. A list of "safe" shell commands does not stay safe: git log --output=<file> looks like reading and writes a file. So Claude Code in read-only mode runs in plan mode with no tool that writes. Codex has no equivalent that works inside our container, so it only offers edit mode.
Watching it work
The harness runs detached in the sandbox and writes its events to a file, which AgenticOS reads every second and a half. Each step reaches the chat as it happens, in a panel under the Claude Code or Codex mark: the file it reads, the edit, the command, what it says between them. If you stop it, or it runs past its timeout, its whole process group is stopped.
Tasks in one conversation continue one session. The second task in a chat knows what the first one read. A chat never continues another chat's session, even in a sandbox several chats share.
A real task
Here is one run, from a demo organization I set up with a synthetic US team. The project is called Fall launch, and it holds a brief, a brand book, a channel plan and a launch plan another agent wrote earlier the same day.
Jordan, in the project chat, asks the Coder agent:
Build the launch page from launch-plan.md with @coding agent: one HTML file in the project, Ledgerly colors from brand-book.md, the headline from brief.md and a sign-up button.
The agent writes the brief
The Coder agent does not forward that sentence. It reads the project's files first and writes Codex a proper brief: one self-contained HTML file, the three colors from the brand book with a contrast check, the voice rules, the sections, and one important constraint it found in the brief. Every time-saved claim needs a customer quote, and there is none in the workspace, so "Close the month in two days, not ten" must not appear on the page.
The constraint was in a file the person never mentioned. The agent found it and passed it on.
What came back
Codex worked through eight actions and wrote launch-page.html into the project.
The Coder agent then reported back to Jordan:
- Colors: only the three brand colors, with the button text at a 4.65:1 contrast ratio.
- Headline: the product description from the brief, "Ledgerly Autopilot reconciles invoices, payments and bank lines on its own."
- Left out: budget, channels, internal goals and any made-up stats or testimonials.
- Checks: the HTML is well-formed, only the brand colors appear, none of the banned words.
And two decisions it would not make alone. The brief's own headline is a time-saved claim, so it left it off and marked in the HTML where it goes once someone supplies an approved quote. And the real sign-up URL was not in the workspace, so both buttons point to a placeholder until someone sends it.
One thing did not work. The agent wanted to screenshot the page to check it visually, and the sandbox ran out of disk space. It said so plainly and called the page a draft until someone opened it in a browser. That is the behaviour you want, and also a reminder that a sandbox needs room.
On a subscription
If your team already pays for Claude or ChatGPT, the coding agent can run on that plan instead of a metered API key. For Codex, a person signs in with ChatGPT once in AgenticOS. For a task, that sign-in is written to a Codex home of the task's own, outside the project's files, and removed afterwards. Because whatever Codex runs could read it, the sign-in is only handed over when the person running the agent may see it in the vault themselves. Running an agent is never a way into somebody else's subscription. And it is only handed over in a sandbox nobody else's tasks share. In a project's shared container, another person's task could read it, so there you use an API key. A Claude Pro or Max token, by contrast, is stored like a key and used by every run, whoever asked. Both vendors' plan terms may not allow a personal subscription on a shared deployment, so check them.
Your other agents do not have to use the same provider. AgenticOS works with 28 model providers (counted at the release that ships the ChatGPT plan), including your own models through Ollama or an OpenAI-compatible server such as vLLM, so a team can keep everyday agents in-house and use a subscription only for the coding work.
In a project
A project gives every chat the same container. So the files the team uploaded, the plan another agent wrote and the page Codex built all sit in one place, and the next chat picks up where this one stopped. That is what turned the demo from three separate answers into one piece of work.
Limits
- No sandbox, no coding agent. A project that keeps its files without a container has no shell, and the coding agent is left out of runs there.
- Codex has no read-only mode inside AgenticOS.
- A subscription belongs to one person. For agents the whole company runs, an organization API key is the better fit.
- It runs your code. Edit mode can run any command in the sandbox. Decide who may start a task, and use Always ask where it matters.
Try it
AgenticOS is open source (Apache-2.0) and runs on your own servers:
- https://github.com/vstorm-co/agenticos
- The coding agent reference: https://vstorm-co.github.io/agenticos/reference/capabilities/#coding-agent
If you hand your agents to Claude Code or Codex, I would like to hear what the first task was.
I'm Kacper, Principal Engineer and Open Source Tech Lead at Vstorm. I build AI agents and open-source tools in the Pydantic AI ecosystem. Find me on LinkedIn or GitHub.
Top comments (0)