Beyond the Hype: What I Actually Learned Using Terminal-Based AI Coding Agents

Terminal AI Agents: The Costs Not in the Changelog

Five terminal agents now compete for the same slot in a developer’s workflow: Claude Code, OpenAI Codex, Cursor CLI, Aider and Google’s Antigravity CLI. Their launch posts compare model quality and seat price. Their documentation compares something more consequential ” where the boundary sits, who approves crossing it, and what you can undo afterwards.

This is an analysis of those documents and price pages, fetched on 26 October 2026. It makes no claim about which agent writes better code, and it reports no first-hand benchmarking. The claim is narrower and more useful: the four costs that decide whether an agent is safe to leave running — escalation volume, reviewer quality, context burn and reversibility — are documented unevenly, and the gaps are where teams get surprised.

Labels. FACT means a vendor page fetched on 26 October 2026 states it. INFERENCE means my reasoning from those pages. UNKNOWN means the vendor has not published it in the pages reviewed.

Four costs that do not appear in a changelog

Every release note lists capabilities. None of them list these:

1. Escalation volume. How often the agent stops and asks, and therefore how much of a senior engineer’s day is spent answering.
2. Reviewer quality. Whether the thing answering the escalation is a person or a second model, and what happens when it says no.
3. Context burn. What each turn re-sends, and what survives when the conversation is compacted.
4. Reversibility. Whether “undo” restores the repository or only the conversation.

Only the third appears on an invoice. The first two decide whether the invoice is the expensive part. INFERENCE

Five agents, five boundaries

The table is the article in miniature. Two agents enforce at the shell, one enforces at the filesystem and network, one makes the commit the checkpoint, and one publishes a quota but not a boundary on the pages reviewed. INFERENCE

Codex: approvals as a second agent

Codex documents the cleanest separation of concerns, and it is the one to study even if you pick something else.

The sandbox defines technical limits; the approval policy decides when the agent must stop before crossing them. FACT The common modes are read-only (inspect, but no edits or commands without approval), workspace-write (edit inside the workspace and run routine local commands), and danger-full-access (no filesystem or network boundaries). FACT Approvals are on-request or never, and untrusted is no longer a selectable approval policy. FACT Full access means combining danger-full-access with never. FACT

Then there is the part most summaries skip. With approvals_reviewer = "auto_review", an escalation goes to a separate reviewer agent instead of a person. The reviewer sees a compact transcript plus the exact request, can run read-only checks, and does not see hidden reasoning. FACT Crucially, auto-review “is a reviewer swap, not a permission grant”: it does not expand writable roots, enable network access or weaken protected paths. FACT

It also has failure semantics, which is rare in this category. A denial returns a rationale and an instruction not to pursue the same outcome by workaround. FACT A circuit breaker interrupts the turn after three consecutive denials, or ten denials within the last fifty reviews in the same turn. FACT A human can override one denial through the /approve picker, which records up to ten recent denials per task, applies to one retry in the same context, and still routes the retry through review. FACT

The vendor’s own limit is the sentence worth quoting in a design review: auto-review “is not a deterministic security guarantee” and “can still make mistakes, especially in adversarial or unusual contexts.” FACT Session transcripts are retained under ~/.codex/sessions by default, so past traffic is auditable after the fact. FACT

There is a hole worth naming. With approval_policy = "never", danger-full-access, or --yolo, an action can avoid creating the boundary-crossing request that review requires. FACT Auto-review is not a safety net under full access; it is a replacement for the human at a boundary that full access removes. INFERENCE

The price side is unusually explicit. Codex is included in ChatGPT plans: Free at $0, Go at $8, Plus at $20, and Pro from $100 with $100, $200 and $500 tiers. FACT On Plus and Standard Business, the documented local-message estimate for one model is 15–160 messages per five-hour period, and Pro plans currently have no five-hour limit. FACT Credit rates are quoted per million tokens, for example 50 credits input, 2.5 credits cached input and 250 credits output for one model, with a typical task at 2–15 credits. FACT Fast mode uses 2.5x included usage and 2x purchased credits; image generation consumes included limits roughly 3–5x faster. FACT

Two inferences follow. A reviewer agent is a second inference per escalation, so review has a token cost as well as a latency cost. And a policy file written per organisation is a second thing to maintain, version and test. INFERENCE

The volatility is real, too: the pricing page notes one model retiring from Codex with ChatGPT sign-in on 14 October 2026. FACT Any cost model older than a quarter is a guess. INFERENCE

Claude Code: a sandbox under the shell

Claude Code’s enforcement is narrower than its reputation. The Bash sandbox is OS-enforced around shell commands, applies to Bash, PowerShell and Monitor commands and the processes they start, and stops there: “The sandbox covers shell commands only. Claude’s file tools, MCP servers, and hooks run outside it.” FACT

That sentence changes what a pilot should measure. You are not measuring whether the shell is contained. You are measuring what the file tools touch. INFERENCE

Two mechanisms widen the gap. A command that fails inside the sandbox can be retried with dangerouslyDisableSandbox, and an allow rule that matches a command also approves an unsandboxed retry with no prompt, unless allowUnsandboxedCommands is set to false. FACT And with filesystem isolation off plus commands auto-allowed, a sandboxed command can write shell startup files, $PATH executables or ~/.claude/settings.json and use them to widen access on the next run. FACT

The approval side has moved too. From v2.1.283, auto mode is the built-in starting mode for interactive terminal and VS Code sessions, with a classifier reviewing actions instead of you. FACT In acceptEdits, the auto-approved set includes rm, rmdir, mv, cp and sed, none of which produce a diff-shaped record. FACT

On cost, the vendor publishes an enterprise average of around $13 per developer per active day and $150–250 per month, below $30 per active day for 90% of users. FACT Agent teams use roughly 7x the tokens of standard sessions when teammates run in plan mode. FACT On Teams and Enterprise, the per-seat allowance resets on a rolling five-hour window and a weekly window and is shared with Claude chat and Cowork. FACT

The last point is the one finance tends to miss: coding and chat draw from the same allowance, so a heavy agent afternoon is a product-wide budget event, not a coding-tool event. INFERENCE The permission modes, the sandbox gap and the compaction behaviour are set out in more detail in the Claude Code cost review.

Cursor CLI: the password stays out of the model

Cursor’s CLI documents a smaller surface, and one detail that deserves credit. Sandbox behaviour is set with /sandbox or --sandbox <mode>, where the mode is enabled or disabled, and network access is controlled through an interactive menu. Settings persist across sessions. FACT

When a command needs sudo, Cursor shows a masked prompt and routes the password directly to sudo over a secure IPC channel, so “the AI model never sees it.” FACT That is the correct design, and it is the sort of detail that is invisible until an audit asks where credentials entered the transcript. INFERENCE

The trade-off is granularity. A two-state sandbox plus a network toggle is easy to reason about and hard to tune: there is no documented per-command allowlist on the page reviewed, so the choice is between broad permission and broad restriction. INFERENCE Whether a finer policy exists elsewhere in Cursor’s documentation is UNKNOWN here, because only the CLI overview was reviewed.

Aider: the commit is the checkpoint

Aider’s model is the oldest and the most legible. The usage documentation states that “Aider will git commit all of its changes”, and /undo reverts AI changes you do not want. FACT

That is a real safety property, and it comes with a real precondition: the working tree has to be clean before the agent starts, or “undo” restores you to a mixed state rather than a known one. INFERENCE Aider’s documentation recommends committing before you start for exactly this reason. FACT

Context economics are visible in Aider’s output in a way they are not elsewhere: the tool prints its repo map budget, for example “Repo-map: using 1024 tokens”, and it maintains a troubleshooting page for token limits. FACT A team can therefore see the context cost of a large repository before it becomes an invoice. INFERENCE

The trade is that Aider gives you no OS-level enforcement to lean on. It gives you a commit and an undo. INFERENCE

Antigravity: quotas without a price list

Antigravity is the newest and the least legible on cost. Google’s developer blog announced the transition from Gemini CLI to Antigravity CLI on 19 May 2026. FACT

The plans page describes quota tiers rather than prices: Ultra gets “the highest, most generous quota, refreshed every five hours” plus the highest weekly limits; Pro gets a high quota refreshed every five hours until the weekly limit is reached; accounts outside Pro and Ultra get “a meaningful quota, refreshed weekly”. FACT Overage is controlled by an AI Credit Overages setting with two values: Never, which waits for the quota to refresh, and Always, which spends credits whenever the baseline is exhausted. FACT

Two documented absences matter for budgeting. There is no support for bring-your-own-key or bring-your-own-endpoint for additional rate limits, and no organisational tiers through a custom contract. FACT

The opacity is the point. The docs state that rate limits “correlate with the amount of work done by the agent”, so straightforward tasks yield more prompts than complex ones. FACT That is a defensible design and a bad unit of account: you cannot convert a quota into cost per task unless you know what a request actually carries, so you cannot compare it with a credit rate or a token price. INFERENCE UNKNOWN — the marginal dollar value of one AI credit is not published on the plans page reviewed.

Sandboxing is not an approval policy, so price is not the tiebreaker

The common line is: “They all sandbox now, so pick on price.”

The mechanism fails on three separate layers, and each failure is documented by the vendor making the claim.

First, a sandbox is not an approval policy. Codex says so explicitly: the sandbox defines technical boundaries, the approval policy decides when the agent stops. FACT Turning approvals to never removes the stop, not the boundary — or, with full access, removes both. INFERENCE

Second, the boundary is not in the same place across products. Codex’s sandbox applies to spawned commands, and its workspace-write mode constrains writes to the workspace. FACT Claude Code’s sandbox covers shell commands only, with file tools, MCP servers and hooks outside. FACT Cursor’s is a two-state toggle. FACT A “sandboxed” agent therefore describes three different blast radii. INFERENCE

Third, review is labour with a price, and that price is not on the pricing page. Consider a $20 seat and a senior engineer at $90 an hour. Two minutes per escalation costs $3. Ten escalations a day costs $30 — more than the seat, every day, before anything goes wrong. INFERENCE The numbers are an illustration of the arithmetic, not measured data. Seat prices themselves are compared plan by plan in the subscription cost comparison.

That reframes the purchase. You are not buying messages. You are buying a boundary plus a review policy, and the review policy is the part you have to operate. INFERENCE

The ledger worth keeping

Only two of the six rows below ever appear on an invoice, which is why teams under-invest in the other four.

Codex retains auto-review transcripts under ~/.codex/sessions by default. FACT Claude Code reports per-session token use in /usage and can export per-user metrics through OpenTelemetry, which the docs describe as the only option that streams per-user token and cost metrics into your own observability stack in near real time on every setup. FACT Antigravity shows remaining credits in the CLI statusline. FACT

Collect all six rows for one sprint and the argument about seat price usually disappears. The expensive agent is the one whose escalations land on the person with the least context, not the one with the highest subscription. INFERENCE

Before the next sprint

1. Run one representative task in the most restricted mode each tool offers, and count escalations. That number, not the demo, predicts the review load. INFERENCE
2. Write the deny list before the allow list. In Claude Code, deny rules block in every mode, including bypassPermissions. FACT
3. Close the escape hatches you did not choose. In Claude Code that is allowUnsandboxedCommands: false; in Codex it is keeping approvals interactive so a boundary exists to review. FACT
4. Assign an owner for the reviewer policy. A reviewer agent with a per-organisation policy is a maintained artefact, and managed configuration takes precedence over local settings. FACT
5. Test the undo you plan to rely on. Aider’s /undo depends on a clean starting tree; Claude Code’s /rewind restores conversation and code to a checkpoint; Codex leaves you with git. FACT Pick the one you can execute at 2am without reading documentation. INFERENCE
6. Re-check the price page quarterly. Model retirements and rate changes are frequent enough that a cost model older than a quarter is fiction. INFERENCE

The terminal agent is not a coding tool with a subscription. It is an execution boundary with a review policy attached, sold by the message. Teams that evaluate it as the first thing get a demo. Teams that evaluate it as the second get a system they can leave running.

JL HOUSSEM

Independent technology writer focused on artificial intelligence, emerging technologies, and digital innovation. Covers AI applications in sports, productivity, and online business.