AWS described a procedure for running Claude Code as a remote agent in Amazon Bedrock AgentCore

Amazon Web Services has published a guide and a sample implementation (sample-remote-coding-agent) for running the Claude Code tool as a remote agent on the Amazon Bedrock AgentCore platform. Each coding task runs in its own isolated AgentCore runtime session inside the user's AWS account – a separate microVM whose memory is wiped after the session ends. The result of the work is returned as a pull request on GitHub, which the user verifies and merges themselves; according to the description, the agent never merges pull requests itself.

According to AWS, the solution preserves the security features that companies already use with Claude Code on Amazon Bedrock – billing through an existing AWS account with no per-user licenses, audit logging in AWS CloudTrail, and geographic inference profiles for data residency. On top of that, it adds further controls: the model is called only via a private Amazon Bedrock endpoint signed with an IAM role, the container holds no other AWS credentials, GitHub access goes through a GitHub App registered in AgentCore Identity with tokens valid for 8 hours, and the input prompt passes through Amazon Bedrock Guardrails before being queued (blocking jailbreak attempts, prompt injection, malware requests, and leaks of AWS keys). The entire run takes place in private VPC subnets with limited internet access, available only through a NAT gateway for GitHub.

According to AWS, the guardrail has one limitation: it only checks what the user writes into the prompt, not the content that the agent loads during the run from repository files or command output – meaning it will not detect prompt injection arriving through that route. AWS also states that remote agents pay off for tasks where test and verification commands can be run, and that their downside is reduced ability to intervene in a running task and less predictable costs compared to local operation.