Claude Code /loop: Cron for AI Agents (March 2026 Update)

Every developer eventually wants the same thing: an AI that runs while they sleep. Nightly security audits. Weekly dependency drift reports. Pre-standup quality checks. For years that meant GitHub Actions + a pile of bash glue. Claude Code's /loop feature, shipped in March 2026, replaces all of it with five lines of YAML.

A scheduled task is just a skill (or a composition) plus a cron expression. The runner is headless, the repo is mounted, the model is wired up, and the only thing left of the historical tooling stack is the cron line itself.

What /loop is

/loop is the Claude Code feature that schedules a skill on a cron expression. It runs the skill inside a fresh agent session, no inherited context, no interactive prompts. When the run completes, the agent posts a summary to its configured notification channel (Slack, email, GitHub issue, or just stdout in a log file).

Three details matter:

1. Full repo access. The schedule mounts your project directory exactly as if you'd opened a terminal there. The agent can read files, run shell commands, open PRs.
2. Real-world side effects allowed. Scheduled agents commit code, push branches, file issues, and call third-party APIs. They are not sandboxed by default.
3. No human in the loop by default. If the agent asks a clarifying question, it falls back to the answer specified in the schedule's defaults block, or fails.

Anatomy of a scheduled task

Schedules live in .claude/schedules.yml at the project root. Here's the minimum useful schedule:

schedules:
  - name: nightly-security-sweep
    cron: "0 3 * * *"           # 3 AM daily, runner's local TZ
    skill: secure
    pin: "1.4.2"                  # pin to a known-good version
    on_finding: open_issue        # 'open_issue' | 'open_pr' | 'notify'
    notify: slack:#security
    timeout_minutes: 30

That's it. The cron syntax is standard, five fields, day-of-week optional. Claude Code handles the rest: spawning the agent, mounting the project, running the skill, parsing findings, opening issues, notifying Slack.

What you can configure

The full schema also supports: concurrency: cancel | queue | skip (what to do if the previous run hasn't finished), tools: (an allowlist scoping beyond the skill's own declaration), and env: (extra environment variables for the agent process).

Five use cases that actually matter

These are the schedules running on real production codebases in 2026. The pattern is the same: pick a recurring concern, pick a skill that handles it, schedule it.

1. Nightly security audit

The secure skill scans dependencies, code, and config for OWASP Top 10 vulnerabilities. Schedule at 3 AM, open a GitHub issue per finding, notify #security on Slack. You wake up with a triage queue, not a surprise.

2. Daily dependency-drift PR

- name: daily-deps
  cron: "0 7 * * 1-5"            # weekdays 7 AM
  skill: dependency-update
  on_finding: open_pr             # one PR per dep with patch + changelog
  pr_labels: [deps, automated]

Renovate without the YAML wars. The skill reads each dep's changelog, runs your test suite against the new version, and opens a single PR per dep with the diff, test results, and changelog summary in the body. Pass-or-fail visible at a glance.

3. Pre-standup quality pipeline

Schedule a composition (a skill that chains other skills) for 8 AM, every weekday. It runs lint, tests, security, perf checks against the main branch, and posts a single Slack message with the green/red status of each. By the time standup starts, the team already knows what's broken.

4. Weekly content + SEO refresh

On Sunday night, schedule a content refresh skill that re-checks the top 50 ranking pages, applies AEO fixes (40-80 word answer leads, schema validation, freshness updates), and opens a PR with the rewrites. You wake up Monday with a content batch ready to review.

5. Quarterly tech-debt sweep

- name: tech-debt-sweep
  cron: "0 9 1 */3 *"            # 9 AM on the 1st of every 3rd month
  skill: tech-debt-sprint
  on_finding: open_issue
  notify: github:repo

Once a quarter, the agent inventories TODOs, outdated deps, missing tests, and code smells, then opens a structured issue for the next sprint. Less a task than a calendar reminder for the codebase.

Writing /loop-friendly skills

Not every skill works well headless. Three principles separate the ones that do from the ones that frustrate:

1. Be decisive. A scheduled skill cannot ask clarifying questions. If your skill ends "would you like me to proceed?", it will deadlock on the schedule and fail at timeout. Decide and document the default.
2. Emit structured findings. The on_finding handler (issue, PR, notify) needs structured input. End your skill with a clear findings block: severity, file, line, recommendation. Free-form prose is a worse Slack message than a list.
3. Be idempotent. Tomorrow's run will see yesterday's PR. Skip what's already done. Match by content hash, not by file path, so renames don't fork a duplicate issue.

Guardrails

The three guardrails that have prevented incidents in the schedules we've watched in production:

• Pin skill versions. The skill author shipped a regression last Tuesday? Your schedule is still on the pinned version. Bump when you've reviewed the changelog.
• Scope tools. The schedule's tools: list overrides the skill's declaration. A security skill probably doesn't need internet access. A docs skill probably doesn't need shell.
• Always require human merge. The auto-merge toggle is one toggle away. The first time an agent ships a broken migration at 3 AM, you'll regret turning it on.

What to schedule first

If you're not running any scheduled agents yet, here's the order we recommend. Each one is a one-line install plus the schedule snippet above:

1. secure, nightly security audit. Highest ROI per token, no judgment calls.
2. dependency-update, daily PR per dep with changelog + tests.
3. tech-debt-sprint, quarterly inventory.

All three are installable from skills-hub.ai with npx @skills-hub-ai/cli install <slug>. See the full list of automation-ready skills in our AI deployment skills landing.

Related reading: Claude Code subagents (compose multi-stage pipelines that run on a schedule), "scheduled tasks" in our glossary.