You open your IDE, type a few characters, an AI suggests the next line. You hit Tab. This has been the deal for two years, and somewhere around month six you stopped being impressed. Autocomplete is furniture now. You don't notice it until it breaks.
Here's the thing: while you were Tab-completing your way through life, the tools you pay $20/month for quietly changed what they actually do. And nobody updated the marketing page.
Thirty Days, Four Tools, One Line Crossed
Between March 5 and April 2, 2026, every major AI coding tool shipped updates that cross the same boundary — from "suggests code" to "runs your machine."
Cursor fired first. On March 5, Cursor launched Automations — always-on agents triggered by Slack messages, GitHub events, PagerDuty incidents, even schedules. These agents spin up cloud sandboxes and execute autonomously. On March 25, they added self-hosted cloud agents — up to 8 running in parallel, each cloning your repo. They claim "hundreds of automations per hour" across customers.
Claude Code followed on March 23 with computer use — the AI can now point, click, open files, and navigate your screen. Anthropic also bumped Opus 4.6 output to 64K tokens (ceiling: 128K), added named subagents with @-mention routing, and built a permission relay that forwards approval prompts to your phone. Your AI assistant now texts you for sudo access. Let that sink in.
Windsurf Wave 13 shipped parallel multi-agent sessions backed by Git worktrees — a way to create isolated copies of your codebase — so each agent works on its own branch. They also replaced your default shell with a dedicated zsh instance "specifically configured for reliable agent terminal execution." Translation: they didn't trust your shell to behave.
GitHub Copilot closed the loop. On April 1, the cloud agent broke free from its PR-only cage — it can now work on branches without creating pull requests, produce plans before writing code, and run research sessions. On April 2, the Copilot SDK entered public preview, letting developers embed agentic capabilities into their own apps.
What Actually Changed Under the Hood
These tools now operate as agent loops — a pattern where the AI doesn't just suggest code but runs shell commands, reads error logs, installs packages, and retries until the tests pass. Your IDE became a supervised agent runtime — an environment where AI processes run continuously with access to your filesystem and terminal.
The product isn't autocomplete anymore. It's delegation. You describe what you want, and the agent figures out the twenty terminal commands needed to get there.
The Part Nobody's Advertising
Every one of these tools now has a permissions model roughly equivalent to giving sudo access to a very smart stranger. NVIDIA published a security framework specifically noting that once control passes to a subprocess, the application has "no visibility into or control over the subprocess." The isolation technologies in play — microVMs, gVisor, hardened containers — vary wildly between vendors.
Cursor gives agents their own cloud sandboxes. Claude Code texts your phone for permission. Windsurf replaces your shell. Copilot runs in GitHub's cloud. Four different answers to the same unsolved question: how do you sandbox something that needs root-level access to be useful?
What This Means for You
If you're choosing a coding tool right now — as a developer, team lead, or someone approving the bill — the question isn't "which one writes better code." They all write roughly similar code. The question is: how much control are you comfortable handing to an agent running inside your development environment?
The autocomplete era lasted about two years. The IDE stopped being a text editor and became an agent sandbox. Most developers haven't updated their threat model to match. Maybe check what permissions your coding assistant actually has before your next coffee break.
