Anthropic describes a software-development loop in which agents write most merged code, review pull requests, test running systems, and investigate production alerts. Humans still set intent and retain final approval where risk demands it.
Anthropic's AI-native development loop
Anthropic's July 2026 operating account says Claude authors about 80 percent of the code merged into its codebase. More than half is merged through an internal version of Claude Tag, while people direct the work and own final approval. Anthropic also reports that its engineers ship eight times as much code per quarter as they did from 2021 through 2025.
Those figures describe output and authorship. They do not show that product value, code quality, or engineering productivity rose by the same amount. Anthropic itself calls lines of code an imperfect measure in a related account of its internal development.
The workflow begins with prototypes and internal use. Teams give Claude Code or Claude Tag a goal, company context, repository instructions, and tools. Anthropic's earlier team-by-team account describes engineers using Claude Code to explore unfamiliar repositories, write tests, respond to pull-request feedback, and work through incidents. The internal Claude Tag system can receive work in Slack and continue asynchronously. Anthropic's public introduction to Claude Tag says administrators choose which channels, data, codebases, and tools each Claude identity can access.
This is a useful distinction for product leaders. The model does not carry the whole system. The factory also needs a place to receive work, a prepared environment, current company knowledge, explicit permissions, checks, review, and an accountable person or process that decides whether the result should ship.
Security guidance becomes part of production
Anthropic encodes secure-coding guidance in repository-level CLAUDE.md files and organization-wide skills. When an agent finds a recurring class of bug, the team can update those instructions so later sessions receive the new rule. That turns one finding into a change to the production system, rather than leaving the lesson in a report that future agents may never see.
Coding happens on remote virtual machines with restricted outbound network access. Anthropic's separate containment account explains the wider principle: keep risky actions inside an operating-system boundary, minimize credentials, and let people approve exceptional access. A sandbox is an isolated environment where an agent can run code without receiving unrestricted access to the employee's computer or the company network.
These controls address prompt injection, which happens when untrusted text tries to redirect an agent. Instructions alone cannot provide a hard boundary. Identity, network rules, and narrowly scoped credentials limit what a compromised or mistaken agent can reach.
Several reviewers check each pull request
At continuous integration, or CI, multiple narrow agents review each pull request. Each reviewer focuses on a bounded concern and can retrieve context from prior incidents. Anthropic combines these reviews with deterministic tools such as static analysis and tests for invariants, including rules about which users may read which data.
Anthropic reports that the share of pull requests receiving substantive review comments rose from 16 percent to 54 percent after it required review agents to supply evidence for their findings. This is evidence about review coverage, not a published precision or defect-rate study. More comments can help, but only if they identify real problems without consuming more human attention than they save.
The company applies controls according to risk. Some codebases require strict human approval. Automated approvals are logged, sampled by people, and sent with other agent actions to the company's security monitoring system. New reviewers begin in shadow mode, where they can produce findings without controlling the outcome.
Production access stays separated
Anthropic's incident agent can read production logs, look for a root cause, write a postmortem, and sometimes prepare a code change. It cannot deploy that change. Its identity can read logs, write documents, and post in company channels. A separate agent-and-human review path handles a proposed fix.
That separation matters because cooperating agents can extend one another's reach. Anthropic reports that an incident agent once asked another Claude instance in Slack to push a fix. The existing human gate stopped the action. The lesson was to define permissions around every reachable action and agent, rather than trusting a prompt that tells one agent what it should not do.
The public evidence has important limits
The architecture and measurements come from Anthropic. The public material does not expose the internal code, task mix, denominator behind every metric, independent quality measurements, or a controlled comparison with teams that did not use agents.
The internal system also differs from the public product. In an April 2026 postmortem, Anthropic said internal staff did not always use the exact public Claude Code build and committed to increasing use of that build. A result from Anthropic's private environment therefore should not be treated as a guaranteed result for a customer installing Claude Code.
What a product team can copy
Keep the lessons smaller than the claims. Put durable product and engineering knowledge where the agent can find it. Run code in an isolated environment. Give each agent its own identity and minimum permissions. Combine model-based review with exact tests. Introduce new reviewers in shadow mode, sample their decisions, and record every consequential action. Reserve human attention for risk, exceptions, and the final decision to ship.