Claude Code runs as isolated remote sessions on AWS Bedrock AgentCore

AWS published a reference architecture for running Anthropic's Claude Code outside a developer's laptop. Each task runs as an isolated remote session on Bedrock AgentCore. Each session lives in the customer's own AWS account, inference goes through Bedrock, and the agent's output is a GitHub pull request rather than direct commits.

The design targets the enterprise objections to coding agents. Isolating each task limits the blast radius if an agent misbehaves. Keeping traffic inside Bedrock satisfies data-residency and governance requirements, and making a pull request the only output keeps a human reviewer in the loop. It pairs naturally with AWS's other AgentCore patterns published the same day, including Okta Cross App Access with Cedar policies for agent authorization.

The timing is pointed. This week Goldman Sachs reportedly pulled Claude Code from its bankers and traders, a Hacker News thread that drew 636 points. Apiiro reported that Claude Code's 'Don't Ask Again' setting left passwords in 1,122 public GitHub files. A sandboxed, review-gated deployment model is AWS's and Anthropic's answer to exactly those concerns. Competitors offer similar hosted coding agents, including OpenAI's Codex and Devin.

Caveats: this is a reference pattern, not a managed product, so customers must build and operate it themselves. Isolation does not prevent an agent from writing secrets into a pull request; reviewers still have to catch that.