# From AutoGPT to the Modern Coding Agent: What Actually Changed

I installed AutoGPT the week it crossed 100,000 GitHub stars, back in the spring of 2023, gave it a modest goal, and watched it spend its entire budget confidently re-researching the same sub-question four different ways before I killed the process. It wasn't a fluke of my particular setup — that was more or less the universal experience. The framework had real ideas in it. It just didn't work, not in the sense of "occasionally buggy," but in the sense of "structurally incapable of finishing a nontrivial task without a human catching it mid-spiral." Three years later I run coding agents unattended for hours at a stretch and they finish real work. Nothing about that gap is mysterious once you look at it component by component, and it's worth doing that plainly instead of waving at "the models got better," because that's true but it's not the whole story.

I've written about the harness architecture that makes today's agents reliable in [a dedicated piece](agent-harness-design), and about the [Ralph loop](ralph-wiggum-loop-agentic-coding) as a specific technique that superficially looks like a throwback to 2023's philosophy. This piece connects those dots directly: what AutoGPT and BabyAGI actually were, the specific reasons they didn't deliver on the hype, and what changed — including the part where "let it run in a loop" came back into fashion for reasons that have almost nothing to do with why it failed the first time.

## What were AutoGPT and BabyAGI, exactly?

**AutoGPT**, released by Toran Bruce Richards on March 30, 2023, and **BabyAGI**, published by Yohei Nakajima days earlier that same month, were both fully-autonomous, LLM-driven planner loops: give the agent a goal in plain language, and it would decompose that goal into sub-tasks, execute them with minimal to no human checkpoints, and try to self-direct toward the stated objective using its own judgment about what to do next and whether each step had succeeded. BabyAGI's original form was startlingly small — around 140 lines of Python wiring a model, a simple task queue, and a vector store together in a loop: take an objective, break it into tasks, execute one, generate new tasks from the result, repeat. AutoGPT was a heavier, more feature-complete take on the same idea, with file access, web browsing, and long-term memory bolted on. Both went viral within days of publishing. Both trace directly back to GPT-4's release just weeks earlier, which is not a coincidence — they were, more than anything, a demonstration of what suddenly seemed possible with a meaningfully more capable model, tried in the most maximal way available at the time: remove the human entirely and let the loop run.

## Why did that generation of autonomous agents mostly not work?

Four specific, compounding problems, not one vague "it just wasn't ready":

**Tool use and instruction-following were meaningfully worse.** GPT-3.5 and early GPT-4-era models were considerably less reliable at emitting well-formed structured output and following multi-step instructions consistently than what's routine by 2026. A framework whose entire premise is "the model decides everything and nothing double-checks it" is unusually exposed to exactly that weakness — a single malformed action or misread instruction early in a long autonomous run doesn't just cost one step, it can send everything downstream off course.

**There was no verification loop, full stop.** The agent's own claim that a sub-task had succeeded was the only signal driving the next step. This is the exact same failure mode I named in the harness piece as the most common reliability bug I see in agent systems today — *self-report is not evidence* — except in 2023's autonomous frameworks there was no human and no automated check anywhere in the loop to catch it. Errors didn't just happen; they compounded silently across dozens of autonomous steps, because nothing was ever forced to confront a real, external signal about whether the previous step actually worked.

**Context windows were far smaller, with no mitigation.** Long autonomous runs degrade as their history grows — that's true in 2026 too — but 2023's models had a fraction of today's context budget and none of the compaction or state-externalization strategies that make long sessions survivable now. A long AutoGPT run didn't gracefully manage its growing history; it just ran out of usable room and got incoherent.

**There was no permission or sandboxing model worth the name.** These frameworks typically had broad, largely ungated access to whatever tools and file access they were configured with. There was no equivalent of the permission gate I describe as load-bearing in the harness piece — no per-action decision about whether a specific proposed action was safe to actually execute. The agent's plan was the security model, which is another way of saying there wasn't one.

| Failure mode | 2023 (AutoGPT / BabyAGI) | 2026 (harness-based coding agents) |
| --- | --- | --- |
| Tool use reliability | Frequent malformed calls, inconsistent instruction-following | Substantially more reliable structured tool use |
| Verification | None — model's self-report was the only signal | Real tests, linters, build output fed back as ground truth |
| Context management | Small windows, no compaction strategy | Compaction, externalized state, sub-agent scoping |
| Permission model | Broad, largely ungated tool access | First-class per-action permission gate, scoped sandboxing |
| Human role | Meant to be removed entirely | Removed from routine turns, not from grounding |

## What did harness-based agents actually fix?

Every one of the four problems above got a direct, deliberate answer — not just "wait for better models," though that helped too. Harness-based coding agents keep a real verification step in the loop instead of trusting the model's word: tests get run and their actual output fed back in, linters run for real, commands' real exit codes and output become the next observation, not the model's narration of what it assumes happened. The permission and sandbox model is now something teams design on purpose, scoping what an agent can touch by action type rather than granting a single all-or-nothing trust level for a session. Context management became an explicit engineering discipline — compaction that preserves decisions while dropping noise, sub-agent orchestration that isolates a sub-task's exploration from the parent's budget — instead of just running until the window fills up and things get weird. And yes, the models themselves got substantially better at exactly the structured, multi-step, tool-calling reliability that 2023's frameworks needed and didn't have.

```mermaid
graph TD
    subgraph OLD["2023: AutoGPT / BabyAGI"]
        O1["Model decides everything"] --> O2["Model's self-reportis the only signal"]
        O2 --> O3["No permission gateon actions taken"]
        O3 --> O4["Errors compound silentlyacross autonomous steps"]
    end
    subgraph NEW["2026: harness-based agents"]
        N1["Model proposes an action"] --> N2["Permission gate decidesif it's allowed to run"]
        N2 --> N3["Real verification: tests,lint, actual output"]
        N3 --> N4["Grounded result feedsback into the next step"]
    end
```

*The 2023 loop and the 2026 loop look similar at a glance — both are "model decides, then acts, then decides again." The difference is what sits between "decides" and "acts," and between "acts" and "the next decision." That gap is exactly where the harness lives.*

## Isn't the Ralph loop just AutoGPT again?

It looks that way on the surface, and I think that resemblance is worth confronting directly rather than glossing over — the [Ralph loop](ralph-wiggum-loop-agentic-coding) is, after all, a technique that lets a coding agent run autonomously for extended periods with minimal human supervision, which is exactly the pitch AutoGPT made in 2023. But the resemblance stops at the surface. Ralph works specifically because it pairs that autonomous loop with real, deterministic verification each and every iteration — a test suite, a build, git state that either reflects working code or doesn't — which is precisely the ingredient AutoGPT and BabyAGI never had. Ralph's state also lives in files and git history rather than an ever-growing conversation, sidestepping the context-degradation problem those older frameworks ran straight into with no mitigation at all.

Ralph isn't a regression to 2023's philosophy of "remove all checks and let it run." It's closer to the opposite: it's what "let it run in a loop" looks like once someone has actually solved the grounding problem that made the first attempt fail. Take the verification step out of a Ralph loop and you don't get a worse version of Ralph — you get AutoGPT, with all the same silent-compounding-error failure mode, just wearing 2026's better base model. The loop shape was never the problem in 2023. The absence of anything checking the loop's own claims was.

**The lesson generalizes past Ralph specifically.** Any agent architecture — autonomous loop, single long session, multi-agent orchestration, whatever comes next — inherits this same fault line. The question that predicts whether it'll work isn't "how autonomous is it" or "how good is the underlying model," it's "what happens when the model is confidently wrong about whether a step succeeded." If the honest answer is "nothing catches that," you've rebuilt 2023's failure mode with better prose.

## What does "autonomy" actually mean differently in 2026?

Not "no human or verification in the loop at all" — that was 2023's definition, and it's the definition that failed. The 2026 definition is closer to: the loop includes real, cheap, automatable verification instead of relying on the model's word for anything that matters, and the human's role shifts from checking every step to designing the checks the loop runs against itself. That's a meaningfully different claim about what you're allowed to remove. You can remove a human from routinely approving each individual action once the permission policy and verification step are trustworthy enough to catch what matters — that's real autonomy, earned. What you can't remove, in 2023 or 2026, is some form of grounding: a point where the system's belief that something worked gets checked against a fact that doesn't come from the model's own mouth.

This connects to the broader landscape I covered in [a survey of where agent tooling actually stands this year](agent-landscape-2026) and to the evaluation discipline in [a piece on evaluating agent systems once they're built](evaluating-llm-agent-systems) — both are, in a sense, about the same idea from different angles: you don't get to trust an agent's competence by inference from how sophisticated its architecture sounds. You get to trust it by what checks it actually against reality, and how often.

## What to carry away

AutoGPT and BabyAGI weren't bad ideas badly named — they correctly identified that an LLM could plan and self-direct across multiple steps, months before the industry had a name for "agent." What they lacked was everything downstream of that idea: reliable tool use, a real verification loop instead of self-report, context management that didn't just run out, and a permission model with any teeth. Harness-based agents in 2026 fixed all four, not through one silver-bullet improvement but through treating each as its own deliberate engineering problem. And when a technique like the Ralph loop brings back the look of full autonomy, the right question isn't whether it resembles 2023 — it's whether it brought the grounding that 2023 never had. That's the actual dividing line, and it's held up better than "which architecture is fashionable this year" ever would.