Coding agents for people who don't write code

Short answer

A coding agent is a model in a loop that can read files, run commands and edit what it finds, in a folder you choose. You do not need to write code to use one. You do need to work on copies, pick projects whose results you can check without reading code, and start with the settings that ask before they act. Passing the agent's own tests (the checks it writes for its own code) is not proof it did what you wanted. The projects, settings and prompt below are our suggestions.

Who this is for. Anyone who is not a programmer and has a job with files in it, such as merging spreadsheets, sorting a folder or building a small tool.

Which shape to pick

Claude Code, Codex and Cursor are examples of coding agents. They run in three shapes:

• Terminal (the text window where you type commands) or desktop app. Works in a folder on your computer and can reach anything your account can touch. Most flexible, and the one to be most careful with.
• Editor. An agent inside a code editor, built for programmers, with more to learn.
• Cloud. Runs on the vendor's machine against a copy of a project and reaches only what you upload or connect. Less access to your own files, which we read as safer.

For most first projects, a desktop app working in one dedicated folder is enough.

Two warnings

We found no independent study of non-programmers using coding agents. These come from professional code.

• Passing tests is not enough. Code that passes the agent's own tests is often not code a reviewer would accept; the study and a review routine are on Checking agent work. Do your own check from the table below.
• AI-written code can be insecure. Veracode tested over 100 AI models. When a secure and an insecure option existed, they wrote insecure code 45% of the time, and bigger or newer models did no better (Veracode, vendor). Keep agent-built tools to your own files, and do not put them online or near other people's data. If you built something in a hosted app builder and want to share the link, run Before you share an app you made with AI first.

Day-one settings (about 15 minutes, once)

1. A dedicated folder with copies. Make a new folder, such as agent-work, copy in the files for the job, and open the agent from that folder only. Keep the originals somewhere else.
2. Ask before acting. Use the mode that asks before it edits files or runs commands, and start each job in a planning mode to see what it intends. Some tools now start in a mode that approves routine actions for you, so check which mode you are in at the start of every session and switch if you need to.
3. No skip-all-prompts mode on your own computer. It is meant for isolated environments only (see the box below).
4. No secrets in the folder. Passwords, keys and personal documents stay out.
5. Sandbox and limits. If your tool offers a sandbox (a walled-off space that limits what the agent can reach), turn it on. For the full setup check and the permission ladder, see Letting an agent near your email, browser and files.

Dated box, read 2026-10-04, re-read 2026-10-11. Settings change monthly, so check the date.

For other tools, see the vendor's own help page.

Five first projects

The first prompt

Paste this into the agent, from inside the dedicated folder:

I am not a programmer. In this folder there is <FILE>. I want <OUTCOME>.
Before changing anything, tell me your plan in plain words and what you
will create. Work on copies and never on my originals.
When you finish, show me how you checked the result, and save any script
you wrote as <SCRIPT_NAME> with a one-line comment on how to re-run it.

Replace the following:

• <FILE>: the file or folder, such as the twelve sign-up spreadsheets.
• <OUTCOME>: what you want, with the check, such as one merged file whose row count equals the twelve added together.
• <SCRIPT_NAME>: a file name, such as merge_signups.py.

A worked example (illustrative)

A club secretary has twelve sign-up spreadsheets, one per month, with slightly different column names.

1. Setup. She copies the twelve files into agent-work, opens the agent there and switches to the planning mode.
2. Prompt. The first prompt above, with the twelve sign-up spreadsheets, one merged file whose row count equals the twelve added together, and merge_signups.py.
3. Plan. The agent says it will match the column names ("E-mail", "Email address" and "email" become one column), stack the rows, drop exact duplicates and write signups_all.csv. She asks it not to drop duplicates, because she wants to see them first, and approves the changed plan.
4. Result. The agent reports 1,184 rows from 1,184 input rows. She checks it herself: she opens each input in her spreadsheet app, notes its row count, and adds the twelve numbers (1,184). Then she searches the merged file for three names she knows from different months. All three are there with the right email.
5. Next month. She drops the new file in the folder and asks the agent to re-run merge_signups.py.

Time: about 25 minutes the first time, including her checks.

How to tell it worked

• The agent told you its plan before it changed anything, and you approved it.
• Your originals are untouched, and every new file is inside the dedicated folder.
• You did the check yourself (counts, totals or spot samples) and it matched, not just the agent's report of its own check.
• You can re-run the job next time from the saved script without starting over.

Did it save time?

Time one run by hand and one with the agent, and count your review time in the agent's column: Am I actually faster?. If the agent gets something wrong, tell it what you saw and what you expected, rather than just "it's broken".

Limits

Sources

1. Veracode. AI-generated code security research, July 2025 press release. Vendor test. Link
2. Anthropic. Claude Code permissions documentation, 2026. Vendor documentation. Permissions · Permission modes

Changes

1. v1.010 Oct 2026first version