# Context for Background Coding Agents: What an Unattended Agent Needs Before It Starts


URL: https://getunblocked.com/blog/context-for-background-cloud-agents/
Published: 2026-10-21T14:00:00Z
Author: Dennis Pilarinos
Categories: AI Agents, Context Engine

What a background coding agent needs before an unattended run: ticket history, rejected approaches, owners, scoped credentials. Patterns from 141 orgs.

---
Background coding agents need three things before an unattended run starts: the history behind the task, a way to ask for more while they work, and credentials that belong to the agent rather than to whoever kicked it off. Picture a ticket handed to a cloud agent at 6pm. The sandbox clones the repo, the agent reads the ticket, plans, writes, runs the tests and opens a pull request around 11pm. At 9am someone opens it. It compiles, the tests pass, and it re-implements a helper that already exists two packages over, because the only thing the agent knew was the ticket and the checkout. Anthropic's January 2026 trends report found developers use AI in roughly 60% of their work but report being able to fully delegate only 0 to 20% of tasks ([Claude blog](https://claude.com/blog/eight-trends-defining-how-software-gets-built-in-2026)). Most of that gap is what the agent does not know.

## What context do background coding agents that run in the cloud without a human watching need?

The same context a senior engineer would gather before touching the ticket, delivered before the first edit. **Background coding agents** are coding agents that run a task in a cloud sandbox with nobody watching, from ticket to pull request. Claude Code's cloud sessions keep running after you close your laptop and work in an isolated VM where git credentials never enter the sandbox ([Claude Code docs](https://code.claude.com/docs/en/claude-code-on-the-web)). The checkout is all the agent has unless you add more.

**The starting packet** is what the harness hands the agent before its first edit, and four things belong in it. The ticket's history: linked issues, the earlier attempt, the thread where scope was cut. Rejected approaches, usually a PR review where someone said no and why. Owners, so the agent knows whose conventions apply and who gets tagged. And the conventions the repo does not state, such as which retry helper is the sanctioned one. GitHub's cloud agent shows how narrow the default is: Copilot can only change the repository named when the task starts, and a session is capped at 59 minutes ([GitHub Docs](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-coding-agent)). Everything outside that box has to be supplied. The case for a shared layer that holds why, who and what happened before is in [how enterprise AI agents get company context](https://getunblocked.com/blog/enterprise-ai-agents-company-context/).

## What changes when the human leaves the loop?

The correction channel closes. Anthropic's February 2026 agent-autonomy study found that human interventions per session in Anthropic's own internal use fell from 5.4 to 3.3 between August and December. In its sample of 500k interactive Claude Code sessions, Claude Code stops to ask for clarification on the most complex tasks more than twice as often as humans interrupt it ([Anthropic](https://www.anthropic.com/research/measuring-agent-autonomy)). In a cloud session, nobody is there to answer.

### Three things change

No mid-task correction: the wrong turn at minute 12 is still in the PR at hour three. No shared browser or local files: a staff engineer at Codat came back from a week off with his Unblocked session expired, and within minutes Claude was web-searching for what Codat's own products were. He re-authenticated, asked once, and carried on ([Codat customer story](https://getunblocked.com/customers/codat/)). A headless agent never gets that second chance. And identity: the agent cannot borrow the engineer's cookies and tokens, so its permissions have to be its own.

### Attended versus unattended

| Row | Attended agent at the terminal | Unattended agent in a remote agent sandbox |
| --- | --- | --- |
| Correction | Human interrupts within a turn | None until the PR is reviewed |
| Local state | Engineer's checkout, browser sessions, env files | A fresh clone and whatever the harness injects |
| Identity | The engineer's own credentials | A token issued to the agent with its own scopes |
| Cost of a wrong turn | Seconds and a few tokens | Hours of compute and a PR built on the wrong premise |
| What the context layer must supply | Answers on demand | The starting packet plus answers on demand, both cited |


## What does context engineering for agents that run unattended in the cloud start with?

A context query, as the first call in the harness, before any file is read. Cursor's cloud agents run in isolated VMs and inject secrets at agent start, so an agent already running never sees anything added later ([Cursor docs](https://cursor.com/docs/cloud-agent)). Whatever the agent needs to know has to be reachable from inside that box.

### Webflow: the MCP call inside the sandbox

Webflow's internal remote-agent platform, Flower, spins up a remote-agent sandbox, and Unblocked is one of the MCPs the agent reaches out to from inside it ([Webflow customer story](https://getunblocked.com/customers/webflow/)).

> When Flower spins up the remote agent sandbox, you can see it reaching out to different MCPs. The most exciting one is Unblocked, because at that point you can see the agent itself gets it. The model's like, 'Oh, now I have the necessary information I need to actually deliver on the ask.'
>
> — Russ Nealis, Staff Technical Product Manager, Webflow


### Cloudbeds: ask first, in every skill

Cloudbeds got there by experiment. An engineering manager triaged a real incident twice with his existing Claude skill, once as-is and once with one added step: ask Unblocked first. The second run used about a third of the tokens and already had the answer before the model started dressing it up. He then opened roughly twenty pull requests so every AI skill his team runs starts by asking the context layer ([Cloudbeds customer story](https://getunblocked.com/customers/cloudbeds/)). That is the practical meaning of Unblocked as the context engine for engineering. The research happens inside the engine, across code, PRs, Slack, Jira and docs, and the agent receives the result instead of spending its budget hunting for it.

## What should the agent be able to ask mid-task?

Anything a teammate would answer in Slack, from a service that answers without a human. Claude Code's cloud docs note that a session waiting on an MCP tool approval or sign-in counts as inactive and can expire during the wait ([Claude Code docs](https://code.claude.com/docs/en/claude-code-on-the-web)). A question that blocks on a person is a question the overnight run never gets answered.

The mid-task questions are predictable. Has this error been seen before? Who owns this service, and what did they say last time? Why does this client retry three times? Which of two conflicting docs is still true? Each needs a source that already holds code history, PR reviews, chat and tickets together and returns a cited answer in one call; how that retrieval works is in [inside the Unblocked context engine](https://getunblocked.com/blog/inside-the-unblocked-context-engine/). We analyzed 141 customer organizations in October 2026, the review behind [how enterprise AI agents get company context](https://getunblocked.com/blog/enterprise-ai-agents-company-context/), and two patterns from it are worth copying. One team's agent pauses planning and asks a human on Slack when the evidence it gathered is insufficient, so it does not guess. Another caches fetched context per commit SHA, so a retry on the same commit starts warm.

## How do you scope credentials for an unattended agent?

Issue the agent its own identity and let the context layer enforce source permissions on every query. The MCP specification finalized on July 28, 2026 is explicit. Clients must not send a server any token other than one issued by that server's authorization server, and servers must not accept or transit any other tokens ([Model Context Protocol](https://modelcontextprotocol.io/specification/2026-07-28/basic/authorization)). Borrowing an engineer's session is out of spec as well as unwise.

### What the sandboxes already do

In Anthropic-hosted environments a proxy attaches git credentials server-side so they never enter the VM, and network access is limited by default ([Claude Code docs](https://code.claude.com/docs/en/claude-code-on-the-web)). OpenAI's Codex cloud takes the same line, with network secrets for allowed HTTPS services and a recommendation to limit each environment's network destinations ([ChatGPT docs](https://learn.chatgpt.com/docs/cloud)).

### What the context layer must do

The same discipline. **Data Shield** is Unblocked's permission layer. It "restricts data access in Unblocked according to the permissions established in your connected third-party systems," so an agent's token sees only what that identity may see in GitHub, Jira, Confluence and Slack ([Unblocked docs](https://docs.getunblocked.com/team-settings/data-shield)). Nothing outside those permissions reaches its answer. Advidi connected its incident agent to Unblocked and scoped its access the way it would for a human teammate. One organization in our review split credentials by stage: a triage stage with no GitHub access, and a separate autofix stage that has it. Query-time versus index-time enforcement is compared in [permission-aware context retrieval](https://getunblocked.com/blog/permission-aware-context-retrieval-ai-coding-agents/).

## How do you build an internal agent on Claude or OpenClaw that knows your codebase and Slack history?

Pick the harness, give it one MCP connection to the context layer, and make that the first call. OpenClaw is an MIT-licensed open-source assistant that runs on your own machine and meets you in chat apps such as Slack, Telegram and WhatsApp. It swaps between hosted and local models including Claude, and its repository shows about 393k stars ([GitHub](https://github.com/openclaw/openclaw)).

### Advidi's OpsClaw

OpsClaw is an operations bot built on OpenClaw that lives in Slack. When something breaks the team loops it into the thread. Before Unblocked it could see that a microservice was failing but not the code or the decisions behind it, and cloning 300 repositories into the agent's context on every incident was never an option. Now it reads the logs, sees the 500 response and asks the context layer for the code history behind the log line. It then points the thread at the exact place in the codebase, under the same permissions a human teammate would have ([Advidi customer story](https://getunblocked.com/customers/advidi/)).

Build yours the same way. The agent, CI runner or backend service owns orchestration and actions; the context layer owns why, who and what happened before, whether the harness is Claude Code in the cloud, the Agent SDK or OpenClaw. **Decision-grade context** is what should come back: synthesized across sources, conflict-resolved, permission-enforced. The same pattern for non-coding work is in [context for support and ops agents](https://getunblocked.com/blog/context-for-support-and-ops-agents/).

## FAQ

### Is a good AGENTS.md or CLAUDE.md enough context for background coding agents?

No. A rules file holds conventions you wrote down on purpose. It cannot hold the PR review from last month that rejected the approach the agent is about to take, or the Slack thread that changed the owner. Those live in the sources, and the agent needs a way to query them.

### Should the agent use the engineer's credentials who started the run?

No. Give it a token with its own identity and let the context layer apply source permissions per query. If the agent can see something the requester cannot, the PR it opens leaks it.

### How long should an unattended run be allowed to go?

As long as the context supports. The ceiling on autonomy is the weaker of context quality and your team's ability to catch a wrong answer; the framework is in [how much autonomy to give AI coding agents](https://getunblocked.com/blog/ai-coding-agent-autonomy/).

## How do you know it worked?

Cited output and a with-and-without comparison on the same task. Stack Overflow's 2026 survey of more than 30,000 developers found 93% say source attribution is required to trust AI output ([Stack Overflow](https://stackoverflow.blog/2026/10/06/the-results-of-the-2026-developer-survey-are-here/)). A PR from background coding agents should carry its sources the same way a good engineer's PR description does.

Two checks catch most failures. Read the citations in the plan and the PR: does each claim about why, who or what happened before point at a real PR, thread or document? If the agent cannot cite, it guessed. Then run the task twice with the same model and harness, once with the context layer and once without, and compare tokens, correction loops and a blind read of the diff. Cloudbeds' triage run is that test in miniature. GitHub puts the limit on logs plainly: they do not replace your own review and testing ([GitHub Docs](https://docs.github.com/en/copilot/concepts/agents/coding-agent/about-coding-agent)). Codat's Matt Thompson describes the result when it works:

> Our previous setup was like a pair programmer you had to babysit. With Claude Code and Unblocked, I fire off a query, minimize the tab for half an hour, and come back to working code.
>
> — Matt Thompson, Staff Software Engineer, Codat


The overnight run has to clear that bar alone.

## Before you turn on the overnight run

Write down what the agent will know at minute zero. If the answer is the ticket and the checkout, the run is a bet that nothing important lives in the PR history, the incident channel or the design doc, and that bet mostly loses. Put a context query first in the harness, give the agent an identity of its own, let it ask mid-task without waiting on a person, and read the citations before the diff. Background coding agents are worth running when they start from what a senior engineer would have gathered. That is the job Unblocked does: the shared context infrastructure that people and agents draw on alike, so the 9am review is about the code rather than what the agent never knew.