On July 2, Simon Willison released a coding agent. It does what you'd expect one to do: reads and edits files, runs shell commands, and grinds at a task while asking permission before it changes anything. A year ago that loop felt like the product — the thing companies raised money to build and guarded as a moat. Willison shipped his as a plugin. Apache-2.0, model-agnostic, pip install and you have llm code. The story isn't the agent. It's what "it's just a plugin" tells you about where value has moved.
Why it fits in a plugin#
The agent is small because everything hard was already built — just not by the agent. Willison's llm command-line tool has supported tool-calling since version 0.26, released in May 2025: give a model a Python function and let it call it. The 0.32 alpha line added the piece a safe agent actually needs — the ability to pause a tool chain mid-execution, ask a human, and resume. That's the machinery. On top of it, a coding agent is barely more than a decision: wire up six tools (read, write, edit, list, search, run a shell command), put an approval gate in front of the three that mutate state, and cap the loop so it can't spin forever.
When a full coding agent fits inside a plugin, the agent loop has stopped being scarce. The scarce thing was the tool-calling substrate underneath it — and that's now a dependency you install, not a system you build.
The loop was never the moat#
Strip a coding agent to its skeleton and it's four steps: the model asks to run a tool, you run it, you feed the result back, you repeat. Every framework that shipped this year implements the same skeleton, and now a single engineer assembles one over an off-the-shelf engine in a package small enough to read in an afternoon. That's the definition of a commodity. It also arrives model-agnostic by construction — because the substrate already speaks to every provider, the loop inherits that for free. There's no version of "our proprietary agent loop, but locked to one model" that survives contact with this. It's the same lesson the frameworks learned the hard way when Pydantic AI V2 bet on a composable harness over a plain loop: the loop is the commodity; the batteries around it are the product.
If your product plan still lists "build our own agent loop" in the differentiation column, that line is now worth roughly what "build our own JSON parser" is worth. Not zero — but not a moat, and not where your scarce engineering months should go.
Where the value actually went#
The value didn't disappear; it moved outward, to the layers a plugin-sized agent conspicuously doesn't give you:
- Isolation. The loop will happily run
execute_command. What keeps it from wrecking a machine, leaking a secret, or spending real money is a sandbox and a policy engine — and neither is in the box. That's a build, and a defensible one. - Evaluation. Any model can drive the loop. Knowing which model to route to for your workloads, and proving it with evals tied to your domain, is judgment a competitor can't
pip install. - The trust surface. A
y/nprompt is table stakes. An audit log you can replay, spend caps a finance team signs off on, and a UX a non-engineer trusts enough to leave running — that's product, and product is what customers pay for. - Distribution. The loop is free. The workflow it sits inside, and the customer relationship around it, are not.
The founder move#
Treat this release as permission to stop building the wrong thing. Adopt an open, model-agnostic loop — this one, or a comparable open-source agent like Aider, Cline, or OpenHands — and redirect the saved time into the sandbox, the permissioning, and the evals that are specific to your business. Being model-agnostic in the loop is also a hedge: it decouples you from any single model vendor's pricing and availability, so a price hike or an outage becomes a config change, not a rewrite. The teams that win the next year won't be the ones with the cleverest loop. They'll be the ones who understood, early, that the loop was the cheap part.
