No Code AI Agents:What They Can Do and When to Move to Code

On November 30, 2026, OpenAI will shut down Agent Builder. That date is 20 days after this article. Agent Builder is a visual canvas to build agents, so it is one of the tools for no code AI agents. OpenAI announced the shutdown on June 3, 2026, on its deprecations page.

OpenAI gives users a way out. You can export a workflow as code for its Agents SDK, in TypeScript or Python. But the migration guide also says this: "This process does not convert your workflow graph or guarantee that every behavior transfers unchanged."

I start with that sentence because it is the clearest statement about no-code agents that I know. The vendor wrote it, and it says the important part. The platform owns a part of your work.

No-code agents are useful, and for many tasks they are the correct choice. They also have limits that a demo does not show. This guide is about both.

I am Chris Machetto. I run Frenchy Digital, which started in 2016, and we build custom agents for clients. That gives me a commercial interest in the answer "move to code". So I do three things in this guide. I show the arithmetic, I give the source of each number, and I say where no-code is the better choice.

This is the order. First, what a no-code agent is and what it does well. Then where it stops, two security cases that each owner must read, and the cost to move. The guide ends with seven signals to move to code and four tasks for this week.

A no-code agent is an AI agent that you build in a visual editor or in plain language, not in a code editor. You select a model, connect tools from a list and write instructions in a text box.

Those three parts match the definition in the OpenAI guide for product teams. The guide says that an agent has a model, tools and instructions. It defines an agent in one sentence.

Agents are systems that independently accomplish tasks on your behalf.

OpenAI, A practical guide to building agents

Anthropic makes a second distinction that is important for no-code tools. In Building effective agents, it calls a system a workflow when the model and the tools follow code paths that a person defined first. It calls a system an agent when the model directs its own process and selects its own tools.

Zapier, n8n and Make are workflow tools that now include agent features. Microsoft Copilot Studio is an agent builder inside a larger suite. The difference is important for you. A workflow with one agent step is easier to test than an agent that selects all of its own steps.

The products also differ in how much code they allow. The Zapier pricing page calls Zapier "a no-code automation platform" that connects more than 9,000 apps. But n8n is different. Its Code node lets you write JavaScript or Python as a step in a workflow. So n8n is a low-code tool: code is not necessary, but code is available.

Make also has agent features, and its pricing page says that credits are now its billing unit. Each platform counts work in its own unit: activities, tasks, executions or credits. Keep that in mind when you compare prices later in this guide.

This guide is about one decision: when to move an agent from a platform to code. For the general guide, with tasks by department and costs, read AI agents for business.

Most owners think that no code means no engineering. You do not write code, so you do not need an engineer. That belief is reasonable, because the editor looks like a form, not like software.

In December 2025, a research team at Tenable published a test of that belief. The team built a travel agent in Microsoft Copilot Studio. A SharePoint file held fake customer names and fake card numbers. The agent could create a booking, read a booking and edit a booking.

Then the researchers attacked it with plain text. A variant of a known prompt injection made the agent list its actions. The read action returned card details for reservations 23 to 25. The edit action changed the price of a trip from $1,000 to $0.

The attack used no code at all. It used plain text and a permission that was too wide. The edit permission was there to change travel dates. In the words of the researchers, "those same edit permissions also apply to the price field!"

That is an engineering decision. Nobody wrote code, and the decision was still wrong. A no-code editor removes the syntax. It does not remove the questions about access, tests and failure.

OWASP is a security organization, and it has a name for this risk: excessive agency. Its page gives three root causes: excessive functionality, excessive permissions and excessive autonomy. The Tenable agent had the second one.

No-code and code are not two options. They are five steps. Each step up gives you more control and more work.

I recommend that most businesses start at the lowest step that works. Move up one step only when you have a reason that you can write in one sentence.

The steps are not a ranking of quality. Step 1 is the correct answer for many support inboxes. Step 4 is the wrong answer for a task that a standard connector already does.

Anthropic gives developers the same advice. It recommends "finding the simplest solution possible, and only increasing complexity when needed". It also warns that frameworks can hide the prompts and the responses, so errors are harder to find.

A no-code platform is also a framework. It can hide the parts that you need to see when an agent fails. That is the cost of the speed. It is a fair cost for a simple task and a high cost for a complex task.

I compare ten platforms at steps 2 and 3, with their prices and export options, in the top 10 AI agent platforms for small business. This guide is about the decision to move up a step.

No-code agents are good at frequent tasks with a clear goal, in apps that already have connectors. The connector list is the main asset of a platform. A connector is work that another team did, tested and maintains for you.

The approval features are the most useful items in that table. Zapier Human in the Loop pauses a Zap so that a person can review a step. The reviewer can approve or decline, and you can let the reviewer edit the data. The feature is on the Professional, Team and Enterprise plans, not on the free plan.

n8n has a similar control for AI tool calls. Its documentation says: "You can require human approval before an AI Agent executes a specific tool." The request can go to Slack, Microsoft Teams, Gmail and other channels.

These features match the advice in the OpenAI guide. The guide says that sensitive, irreversible or high-stakes actions need human oversight until you trust the agent. Its examples are order cancellations, large refunds and payments.

A no-code agent can be a very good agent if it does three things. It writes a draft. It asks before it acts. It works only in apps with tested connectors. I recommend that most first agents look like that.

Each platform has limits, and the vendors publish them. Read them before you build, because a limit that you find in production costs more. These are the limits that I check first, with the vendor statement for each one.

The Zapier rows come from the help page on agent usage and the Zapier article on HIPAA. The Copilot Studio rows come from the Microsoft page on quotas and limits. The n8n row comes from the n8n page on source control.

Read the first row with care. For an account at its activity limit, the help page says: "Your agents will no longer run."

You can still chat with the agent, and Zapier sends an email at 80% and at 100% of the limit. The agent does not run again until the next billing date or an upgrade.

None of these limits makes a platform bad. They are the normal limits of a shared service. But each one is a decision that the vendor made for you.

Three things are harder on a no-code platform than in code. The first is a set of tests that runs on each change. The second is a complete export of the agent. The third is a permission that covers one field and not the full record.

Tests are the largest gap. OpenAI also announced that its Evals dashboard and API will shut down on November 30, 2026, the same day as Agent Builder. Its migration path for evals points to Promptfoo. Without tests, you cannot know if a change to the instructions made the agent better or worse.

I explain how to set up those tests in AI agent evaluation and observability. The method is the same on a platform and in code. Use real past examples, a correct result for each one and a pass mark that you set first.

Prompt injection is first on the OWASP Top 10 for LLM applications. It occurs when outside text, such as an email, contains instructions that the model follows. Nobody has a full solution. No-code platforms do not solve it, and code does not solve it either.

The first case is from Zenity Labs, in July 2025. The researchers built a copy of a customer service agent that McKinsey made in Copilot Studio. They sent one email that contained a prompt injection.

The agent read the email and followed it. According to the Zenity report, it sent the contents of a knowledge file and Salesforce records to an address that the attacker selected. Nobody clicked anything.

Zenity reported the problem to Microsoft on February 21, 2025. Microsoft fixed it on April 24, 2025. Zenity then added a sentence that each owner must read: "To be clear, prompt injection is still possible."

The second case is the Tenable travel agent from the section above. Read the two cases together. In both cases, the attack needed only text. In both cases, the access of the agent decided the damage.

Self-hosted tools add a different risk: you install the patches. In January 2026, a flaw in n8n with the name Ni8mare received the score CVSS 10.0, the maximum. An attack needed no login. Rapid7 reports that the patched release came out on November 18, 2025, and the advisory on January 7, 2026.

Count the days. November 18 to November 30 is 12 days, December is 31 and January adds 7. That is 50 days. A team that updated to version 1.121.0 in that period had the fix before the public knew about the flaw.

After the disclosure, The Hacker News reported that Censys saw 26,512 exposed n8n hosts. Exposed means that the host was on the internet. It does not mean that each host was vulnerable.

The same Rapid7 page lists a second critical n8n flaw, N8scape, with a score of 9.9. It needed a user with permission to create or change workflows. That is a reason to give few people that permission.

I list the first ten controls that I recommend in AI agent security: 10 controls before you connect your data. Most of them apply to no-code agents with no change.

Economists use the term switching cost. A switching cost is what a customer pays to change from one supplier to another. It includes money, time and the work that does not transfer.

No-code agents have a switching cost that increases with each workflow. The Agent Builder shutdown makes it visible. The export gives you Agents SDK code. The migration guide then tells you to review the control flow, triggers, tools and permissions as you test the new agent.

OpenAI also names a second route, ChatGPT Workspace Agents, for teams that build in plain language. The same guide warns that workflows with strong determinism may not migrate faithfully to a workspace agent. In plain words: if your agent depends on exact rules, the plain-language route can change its behavior.

Other vendors change their products too. The Zapier help page on agent usage, updated on October 1, 2026, says that Zapier moves Agents to AI by Zapier. I do not know what changes for users, so I only report the sentence.

You cannot remove the switching cost. You can make it smaller. Keep the valuable parts of the agent outside the platform, in documents that you own.

• The instructions.: Keep a copy of the full text, with a date for each change.
• The tools and the permissions.: Write down each tool, what it can read, what it can change and why.
• The test cases.: Keep 50 to 200 real examples with the correct result for each one. These examples move to any platform.
• The logs.: Export the run history each month if the platform allows it. You need it to compare the old agent and the new agent.

The fees of a no-code platform are small, and they are rarely the reason to move to code. These are list prices that I read on the page of each vendor on November 10, 2026.

The n8n prices are from the n8n pricing page, which counts workflow executions "regardless of complexity". The Microsoft price is from the Copilot Studio pricing page. Note the units again: activities, tasks, executions and credits do not convert into each other.

Now the arithmetic. Our custom agent costs $40,000 in year one. Zapier Agents Pro costs about $400 a year, which is $33.33 times 12. $40,000 divided by $400 is 100.

So in year one, the custom route costs about 100 times more in fees. A custom agent must do something that the platform cannot do, and that thing must be worth the difference. If you cannot name that thing in one sentence, stay on the platform.

The fees are not the full cost of no-code. Your own hours to build and test are a cost. The time of the person who reviews the drafts is a cost too. But review time also exists with a custom agent. A custom agent removes setup work from your team. It does not remove the review.

Volume changes the comparison in one way. The self-serve Zapier Agents plans stop at 1,500 activities a month. Above that, Zapier lists an Enterprise tier with a custom number of activities, and the page shows no price. I cannot compare our price with a price that I cannot see, so ask Zapier for it in writing.

Our three-year number helps at that point. $40,000 plus $30,000 plus $30,000 is $100,000 for three years. That is about $2,778 a month, plus the model usage that you pay directly to the provider. The price increases with complexity and with the number of systems that the agent connects to.

I compare packaged agents and custom agents in more detail in the pillar guide linked above. The break-even there uses a packaged agent that bills for each resolved conversation. The method is the same: put each route in its own unit, then convert to a monthly cost.

These are the signals that I use. One signal is a reason to look at code. Two or more signals are usually a reason to move. Each signal has a test that you can do this week.

The signals also work in the other direction. These conditions tell me to keep an agent on its platform.

• The person who maintains the agent is not a developer, and nobody else will maintain it.
• The agent writes drafts, and a person sends them.
• Each write uses a standard connector with an approval step.
• The volume is inside the published tiers, with room for a busy month.
• No rule in the task costs money when it is wrong.

A move to code does not need to be one large project. Move one part at a time, and keep the old agent until the new part passes your tests. This is the order that I use.

1. 1.Write the four documents.: Write the instructions, the tools and permissions, the test cases and the logs, as in the section on the cost to move.
2. 2.Find the one step that causes the most trouble.: Usually it is the exact rule or the write with no connector. Do not move the whole agent.
3. 3.Build that step as a small service in code.: Give it a narrow input and a narrow output. A price service returns a price. It does not accept instructions.
4. 4.Call the service from the platform.: In n8n, a Code node can do this. On other platforms, find the code step or the web request step in the documentation.
5. 5.Run the old path and the new path together.: Compare the results on the same inputs for two weeks. A person reviews each difference.
6. 6.Switch when the tests pass.: Keep the old version for one month, so that you can go back.

For Agent Builder users, the export already gives you Agents SDK code in TypeScript or Python. Treat it as a first draft. Do these steps before November 30, 2026.

1. 1.Open the workflow in Agent Builder.
2. 2.Select Code in the top navigation.
3. 3.Select Agents SDK in the code dialog.
4. 4.Select TypeScript or Python, then copy the complete export.
5. 5.Save the export in your own code repository, with the date.
6. 6.Run your test cases against the exported agent before you use it live.

The first four steps are from the OpenAI migration guide. The last two are mine. The guide says that some behavior may need manual recreation, and your test cases show you where.

The agent project that I can show in public is Beyond Points, a travel product for people with loyalty points. I use it here because its main parts match three of the signals above.

First, a browser agent completes point transfers from card programs to partner programs. That is the browser robot option of signal 1. Second, the ranking of results is exact: eight identical searches at the same time return the same ranking, byte for byte. That is signal 2.

Third, transfers, bookings, payments and cancellations never run until the user confirms. That is the middle column of the table in the next section, built into the product. The chat also has thirteen tools, so it looks up a fare and does not guess it.

The same case study shows the other side. During discovery, we rejected a proposal for a large set of microservices on Kubernetes. The founder needed a product to operate, not a platform team. Code is not a reason to build more than the task needs.

The second project moved in the other direction. We Find Your Insurance is a site for an insurance broker. The first build had a custom chatbot: a serverless function of 475 lines with filters for prohibited Medicare marketing language.

The site now runs on WordPress with a custom theme, so the broker edits pages without a developer. A GoHighLevel booking calendar and the website chat send leads to the GoHighLevel account of the broker. I include this project because the move is not always toward code. The right place for a tool is where its owner can operate it.

Now a scenario. The inputs are assumptions, so replace them with your own. Consider a property management company with 20 people. It uses a no-code agent to triage about 600 maintenance requests a month. Assume that each request uses five activities: the trigger, one knowledge lookup and three actions.

• Activities a month: 600 times 5 is 3,000.
• Zapier Agents Pro includes 1,500, so the agent stops at about the middle of the month.
• The next Zapier tier has a custom price that the page does not show.
• n8n Starter costs 20 euros a month, billed annually, for 2,500 executions. One run for each request uses 600.
• A custom agent at our price is about $2,778 a month over three years, plus usage.

For this company, I recommend step 3, not step 5. The n8n plans count executions, not steps, so the volume problem ends for 20 euros a month. The cost is new work. A person must own the workflows, and on a self-hosted install, a person must install the patches.

Two conditions change my answer to a custom agent. The first is a write into a property system with no connector, when the write must be exact. The second is a rule about money, such as a deposit refund, that must never depend on a prompt.

Complete this table before you build on any platform. It is the same table for no-code and for code. Only the method of enforcement changes.

On a no-code platform, you enforce the middle column with an approval step. Zapier Human in the Loop and the n8n approval for tool calls both do this. In code, you enforce it with a confirmation gate that the model cannot skip.

Enforce the right column with permissions, not with instructions. If the connection cannot delete records, the agent cannot delete records, whatever the text says. That is the lesson of the Tenable price field.

Actions move from the middle column to the left column with time, one at a time. An action that a person approved 200 times in sequence with no change is a good candidate. An action that a person corrects one time in ten is not. I explain approval design in more detail in the related guide on human-in-the-loop design.

You can buy a platform or hire a builder, and that includes us. These signs tell me not to buy.

• A platform with no export of the agent, or an export that you did not test.
• Permissions that cover the full record, with no way to limit a tool to the fields that it needs.
• No approval step for actions that you cannot reverse.
• A published price that stops below your volume, with no price above it.
• No clear statement about a business associate agreement, if you handle health data.
• A vendor or a builder who says that it has a full solution for prompt injection.
• An accuracy or resolution percentage with no method, no sample and no period.
• A builder who proposes custom code for a task that a standard connector already does.

The last point applies to us too. If a connector does the job, I will tell you. A custom agent that copies a connector is a cost with no new capability.

On compliance, this is our own position. Frenchy Digital signs business associate agreements with healthcare clients. We hold no SOC 2, ISO 27001 or HITRUST attestation. If your procurement process requires one, a platform such as Copilot Studio lists them, and we do not.

This is what I did not verify, or decided not to use as evidence.

• Each price is a list price that I read on November 10, 2026. Vendors change prices. The Zapier page that I read was its machine-readable pricing reference.
• Zapier says that it moves Agents to AI by Zapier. I did not find the details, so the activity limits can change.
• The sources that I read give different ranges of affected versions for the Ni8mare flaw. I report only the fixed version and the dates.
• The count of 26,512 exposed n8n hosts is from Censys, as The Hacker News reported it. I did not read the Censys data.
• The Tenable and Zenity cases are research demonstrations on test agents, not attacks on a live business.
• The OpenAI announcement page for AgentKit did not load for me. I describe Agent Builder only from its documentation and the deprecations page.
• Our public evidence for code agents is one agent case study. That is a small sample, and I tried not to argue from it.
• The property management scenario uses assumed inputs. It is arithmetic, not a measurement.

1. 1.If you use Agent Builder, export each workflow before November 30, 2026.
2. 2.List each agent that you run, with its owner, its tools and the permission of each tool.
3. 3.For your most important agent, write 50 real examples with the correct result for each one.
4. 4.Compare your usage of last month with the limits of your plan.

If you complete those tasks and two or more signals apply, book a discovery call with us. If your company is in New York, our team for AI agent development in New York can review the list with you. If the platform is enough, I will tell you.

Start with the export.