According to the AWS Machine Learning Blog, AWS has released a reference sample that moves Claude Code from a developer's laptop to a remote, account-contained agent built on Amazon Bedrock AgentCore. The project, called sample-remote-coding-agent, lets a developer hand off a coding task, close their machine, and later review the outcome as a GitHub pull request.

Why Bedrock for Claude Code

The post begins by explaining why organizations use Amazon Bedrock as Claude Code's model provider. Billing flows through an existing AWS account without per-seat licensing, CloudTrail provides audit logging, and geographic inference profiles help with data residency. AWS highlights three security properties. First, data protection: content is not used for training or shared with model providers, and Bedrock is in scope for SOC, ISO and FedRAMP Moderate, is HIPAA eligible, and can be used in line with GDPR. Second, access through familiar governance: Claude Code authenticates with temporary IAM credentials, can federate through identity providers such as Microsoft Entra ID or Okta, and can use AWS PrivateLink for private connectivity from a VPC. Third, retention and operator access: Mantle, the newer Bedrock inference engine, is designed for zero operator access, and customers can configure zero data retention.

The remote agent pattern

AWS argues remote coding agents turn a task into a delegation. Several tasks can run in parallel instead of contending for one workstation, each in a disposable environment separate from the developer's shell credentials, and the result arrives as a reviewable pull request. The trade-offs are acknowledged: less ability to steer mid-task, setup effort, and less predictable cost. The sample is recommended for scoped features, bug fixes and tests on trusted repositories that declare their own setup and test commands. It is explicitly not suited to untrusted code, since the agent executes the repository's own commands, nor to open-ended work, since each task stops after three attempts.

Architecture and workflow

The flow has seven stages. Tasks are submitted either from Claude Code, through a sample-rca plugin that runs a local MCP server signing requests with the user's AWS credentials, or from a web console served by CloudFront and authenticated with Amazon Cognito. Requests reach API Gateway, where a Lambda function screens the prompt with Amazon Bedrock Guardrails, records the task in DynamoDB and enqueues it on SQS. A dispatcher Lambda then starts an AgentCore runtime session on the runtime registered for the target repository.

Each repository has its own runtime running one container image from Amazon ECR, containing the Claude Code CLI, the Claude Agent SDK, git and make. AgentCore runtime places every session in its own microVM with isolated CPU, memory and filesystem, running inside a VPC with private endpoints to Bedrock and other AWS services. Outbound access is limited to HTTPS, GitHub is reached via a NAT gateway, and a Route 53 Resolver DNS Firewall blocks model-vendor domains, helping ensure inference goes through Bedrock.

Inside a session, the agent obtains a GitHub token from AgentCore Identity and clones the repo, then searches AgentCore memory for lessons from earlier tasks on that repository. Claude Opus on Bedrock plans the change, Claude Sonnet writes it, and the agent runs the repository's setup and test commands. Claude Opus then reviews the result and can send it back to planning, up to three attempts in total. AgentCore memory records each step and extracts reusable lessons, such as hidden build prerequisites. Finally the agent pushes an agent/<taskId> branch and opens a pull request documenting the verification command, exit code and attempts used. The PR is a draft unless verification passed, and the agent never merges. DynamoDB holds task status so Claude Code and the console can track progress after hand-off.

Analysis

The release shows AWS using AgentCore as a managed substrate for agentic coding, competing for the same workflows as hosted background agents from other vendors but keeping execution inside the customer's account. The combination of microVM isolation, guardrail screening, DNS filtering, and human-gated merges targets enterprise concerns about autonomous code execution. The reuse of learned repository lessons through AgentCore memory points to agents that improve over time, while the stated limitations on untrusted code and bounded retries signal a pragmatic scope. For Anthropic, it reinforces Claude Code's distribution through Bedrock; for AWS, it showcases AgentCore's runtime, identity and memory capabilities as building blocks.