AWS demonstrates remote Claude Code sessions on Amazon Bedrock AgentCore with security controls

On November 6, 2026, AWS published a sample for running Claude Code coding tasks remotely on Amazon Bedrock AgentCore. Each task uses an isolated session in the customer’s AWS account, sends model calls only through Amazon Bedrock, and ends with a GitHub pull request for a person to review and merge. AWS’s AgentCore documentation describes sessions running in dedicated microVMs that are terminated, with memory sanitized, when a session ends.

Before a task is queued, the sample screens the user’s prompt with Amazon Bedrock Guardrails, configured to block jailbreak and prompt-injection attempts, misconduct, and secrets. That screen does not cover prompt injection in repository files or command output. The AgentCore runtimes run in private VPC subnets with VPC endpoints for AWS services; the only internet route is a NAT gateway for GitHub and package registries.

AWS says Amazon Bedrock does not use customer content to train models or share it with model providers, and providers cannot access prompts, completions, or Bedrock service logs. Customers can also configure zero data retention so AWS does not write request or response data to durable storage or share it with the model provider. The workflow still leaves the merge decision to people: the agent opens pull requests but does not merge them, and AWS recommends branch protection and human review.

A task can make up to three attempts. AWS identifies scoped features, bug fixes, and tests on a trusted repository as suitable work, while describing open-ended work and untrusted code as unsuitable. Deployment takes 15–25 minutes, with another 8–12 minutes to register a repository. The listed AgentCore Runtime V2 Regions are US East (N. Virginia), US East (Ohio), US West (Oregon), Asia Pacific (Tokyo), and Europe (Ireland). Deployment sets a default $200 monthly Amazon Bedrock budget with email alerts, but that budget does not cap spending.