Text-only routing underestimates coding agent cost and risk

At a glance

What this is: This is an analysis of model routing for coding agents that concludes prompt-only classification is not enough to choose between cheap and frontier models reliably.

Why it matters: It matters because coding agents increasingly act like non-human workers with delegated access, so poor routing can create cost blowouts, context loss, and unsafe task handling in AI-assisted development programmes.

Context

Model routing for coding agents is a control problem, not just a cost-optimisation trick. The decision depends on task scope, context growth, cache reuse, and whether the work will stay within the original prompt or expand into a longer execution path. In AI-assisted development, that means the agent’s task framing can no longer be treated as stable once the session starts.

The article’s core tension is that lightweight classifiers can be directionally useful, but they do not see the repository, the hidden complexity in the codebase, or the future work a session will generate. That makes the routing decision fragile at the exact moment when teams are most tempted to automate it.

Key questions

Q: What breaks when coding-agent routing is based only on the opening prompt?

A: Prompt-only routing breaks when the task expands after the first turn, because the classifier never sees the repository, hidden dependencies, or later rework. The result is a model choice that can look right at intake but fail once the session becomes longer, costlier, and more dependent on preserved context.

Q: Why can a cheaper model create higher total cost in a coding workflow?

A: A cheaper model can become more expensive when it produces long responses that expand the conversation history and raise input costs on later turns. If the model also invents intermediate outcomes or repeats unnecessary steps, every extra token compounds across the run. In agentic workflows, per turn verbosity often matters more than raw token price.

Q: How should teams decide when to hand work to a subagent?

A: Use a subagent only when the work is a closed stretch whose output can stand on its own and will not need heavy parent-context reasoning later. If the parent must keep using the intermediate steps, the delegation has not really reduced complexity, only moved it around.

Q: Should organisations treat AI coding agents like privileged software identities?

A: Yes. If an AI agent can install code, access secrets, or modify repositories, it is functionally acting as a privileged non-human identity and should be governed that way. That means task-scoped access, explicit boundaries, and monitoring of its downstream actions, especially when it can touch build and release systems.

Technical breakdown

Why prompt-only routing misses the real workload

A turn-0 router only sees the opening request, so it has to infer task difficulty from a thin slice of context. That can work when the job is genuinely narrow, but coding sessions often expand after the first tool call, after code inspection, or after the agent discovers hidden dependencies. In practice, the input that matters is not the initial prompt alone but the evolving work graph: repository size, change surface, test scope, and the amount of explanation the agent must retain. Once those factors appear, a one-shot classifier stops being a dependable proxy for cost or difficulty. See the AI Coding Agents Security Guide.

Practical implication: Treat prompt-only routing as a weak prior, not a final decision rule, for AI coding workflows.

Why cache effects change the economics of model switching

Model switching in coding workflows is not free because long sessions accumulate cached context, tool traces, and partial reasoning that are expensive to rebuild. A cheaper model may have lower token prices, but if the session must be reconstructed or replayed, the apparent savings shrink quickly. This is why per-task cost and per-session cost can diverge so sharply. The more interactive and stateful the workflow, the more the pricing model needs to account for context retention, not just raw inference rates.

Practical implication: Measure routing on full-session economics, including cache rebuild cost, before assuming a cheaper model reduces spend.

Why subagents change the control boundary for coding work

Subagents can help when a stretch of work is self-contained and only its conclusion needs to survive in the parent session. That is different from simply offloading cheap tasks. The useful boundary is whether the delegated work closes cleanly, leaves a durable answer, and avoids dragging irrelevant context back into the main session. When that boundary is wrong, the parent model still inherits the noise, which defeats the point of delegation. So the architecture question is not just which model to use, but which parts of the work should ever enter the parent context at all.

Practical implication: Delegate only closed, conclusion-bearing stretches of work, not the parts the parent will need to reason over later.

Threat narrative

Attacker objective: The objective is not direct compromise but inefficient, risky automation that turns a low-friction coding request into expensive and potentially unsafe agent execution.

1. Entry begins with a harmless-looking coding request that appears cheap at prompt time but later expands into a much larger task.
2. Credential or access pressure emerges when the agent is given enough repository and tool context to make changes, reruns, or delegated follow-up actions without a fresh review.
3. Escalation happens when the session grows beyond the original routing assumption and the wrong model choice amplifies rework, cache loss, and human cleanup.
4. Impact is cost inflation, wasted engineering time, and a higher chance that an AI coding agent executes work with the wrong scope or control boundary.

Breaches seen in the wild

• Amazon Q Developer extension compromise 2025: An over-scoped CI token let an attacker ship a prompt telling Amazon Q's AI coding agent to wipe files and AWS resources (CVE-2025-8217).
• PocketOS database deletion incident: An AI coding agent found an over-privileged Railway API token in the codebase and deleted PocketOS production data and backups in nine seconds.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Text-only routing creates an identity-adjacent governance gap: when an AI coding agent is allowed to choose models from the prompt alone, the organisation is effectively delegating execution authority without seeing the full task state. That is a governance problem, not just a pricing problem, because the same session can cross from low-risk assistance into high-consequence code change, deployment, or cleanup work. The control weakness is the missing linkage between task scope, repository state, and delegated capability. Practitioners should treat routing decisions as part of the agent’s authority model, not as an isolated optimisation layer.

Context drift is the real failure mode in coding-agent operations: sessions do not remain small and cheap in the way a router assumes. Once the agent has to search, inspect, rework, or justify itself over multiple turns, the cost driver becomes accumulated context and not the initial prompt. That means the right control is visibility into session growth and task closure, not faith in the opening message. Agent observability and incident response matters because the moment a task stops being self-contained is the moment its risk profile changes.

AI coding agents behave like delegated non-human identities: they act with borrowed context, inherited permissions, and varying degrees of autonomy, which makes them governance objects rather than simple productivity tools. If the model choice depends on a prompt fragment instead of verified task boundary, the organisation is leaving identity, privilege, and execution scope loosely coupled. That is exactly the kind of gap that produces overreach, hidden cost, and unreviewed action. Practitioners should manage coding agents with the same discipline they apply to other high-trust machine identities.

Named concept: routing opacity: when model selection is based on a thin initial prompt rather than the full session, the organisation loses visibility into why a task was assigned to a given model and what that model later had to carry. Routing opacity matters because it turns an explainable control decision into a guess, and guesses do not scale across production software development. The practical response is to make routing decisions auditable, replayable, and tied to task context rather than user phrasing alone.

The economic story and the security story are the same story: a routing system that saves pennies on obvious tasks but loses money on the long tail will also tend to be the one that misclassifies the risky tail. That is because cost minimisation without context governance encourages shallow decisions. For identity and AI teams, the takeaway is simple: if the selection logic cannot survive longer sessions, it is not mature enough to govern agentic work at scale.

From our research library:

• Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026.
• Read next: AI Coding Agents Security Guide

What this signals

Routing opacity: the real control gap is not whether a classifier can guess task difficulty, but whether the organisation can explain why a coding agent was assigned a given model and how that choice held up as the session evolved. If the answer depends on the first message alone, the routing policy is too shallow for production development work.

The strongest operational shift is to govern coding-agent sessions as stateful work units rather than as isolated prompts. That pushes teams toward task-bound delegation, context-aware routing, and explicit review of agent handoffs, especially when the agent is acting as a non-human identity with borrowed access and accumulated context.

The leakage signal is already visible in coding-agent behaviour: Claude Code-assisted commits leaked secrets at a rate of 3.2%, more than double the human-only baseline of 1.5%, with peaks reaching 31 secrets per 1,000 commits in August 2025, according to the State of Secrets Sprawl 2026. That is why routing, delegation, and secret governance need to be treated as one control plane, not separate problems.

For practitioners

• Map routing to task state, not just prompt text Require repository signals, change scope, and session history before a model tier is chosen for coding-agent work.
• Instrument session cost and context growth Track how quickly sessions expand after the first turn, and compare that to the model tier originally selected.
• Separate closed work from parent-context work Delegate only stretches that end in a self-contained result and do not need to be re-opened by the parent agent.
• Audit model switches for cache rebuild penalties Measure whether a lower-tier switch actually reduces spend once prompt reconstruction and context replay are included.
• Treat coding agents as governed identities Bind access, delegation, and review to the agent’s task boundary so privilege and model choice move together. See the AI Agent Authorisation Guide.

Key takeaways

• Prompt-only model routing can look efficient while still missing the sessions that become long, expensive, and operationally messy.
• The practical failure is not just bad cost prediction, but poor visibility into when an AI coding session stops being a simple task.
• The control that changes outcomes is task-scoped delegation with context-aware routing, not a cheaper model by default.

Related NHI Mgmt Group resources: AI Coding Agents Security Guide · AI Agent Authorisation Guide · AI Agent Observability, Audit and Incident Response Guide · Amazon Q Developer extension compromise 2025

Key terms

• Model Routing Layer: The model routing layer is the policy and orchestration logic that decides which model handles a request, when to escalate, and what tools the request can reach. In AI programmes, it behaves like a control plane because it shapes data exposure, privilege boundaries, and auditability.
• Context Carry: Context carry is the amount of prior conversation, tool output, and working state that must remain available for an AI session to keep functioning correctly. In long coding sessions, it often matters more than raw prompt length because it drives both cost and whether a model switch is viable.
• Third-party agent delegation: A situation where an enterprise allows an external AI agent to act inside its systems through approved connectors, credentials, or APIs. The governance challenge is that accountability, visibility, and revocation must still hold even when the agent is operated outside the enterprise boundary.
• Routing Opacity: Routing opacity is the inability to explain why a specific model was chosen for a given AI task and how that choice interacted with the evolving session. It becomes a governance problem when model selection is based on a shallow prompt snapshot instead of task state, repository signals, and operational risk.

Deepen your knowledge

NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and workload identity. It helps practitioners build control over delegated access and automated execution in AI-enabled environments.