Claude Code can now run coding tasks in AWS microVMs and hand back pull requests

Amazon Web Services has published a sample that moves Claude Code off the laptop and into remote sessions on Amazon Bedrock AgentCore. According to the official AWS post, each task runs in its own isolated microVM in the customer’s account and ends as a GitHub pull request.

One microVM per task, one pull request out

The sample is called sample-remote-coding-agent. A developer submits a task either from Claude Code, through a sample-rca plugin that runs a local Model Context Protocol server, or from a web console served by Amazon CloudFront. A Lambda function screens the prompt with an Amazon Bedrock Guardrails guardrail, logs the task in DynamoDB and queues it in Amazon SQS. A dispatcher then starts one AgentCore runtime session on the runtime that belongs to the target repository.

Inside the session, the container image carries the Claude Code CLI, the Claude Agent SDK, git and make. The agent clones the repository, plans the change with Claude Opus, writes it with Claude Sonnet, runs the repository’s own setup and test commands, and has Opus review the result. Review can send the work back to planning, up to three attempts in total. Finally the agent publishes its work on a branch named agent/<taskId> and opens a pull request whose description documents which command verified the change, what that command returned, and how many tries the task needed.

If verification did not pass, the pull request opens as a draft; the console labels that outcome “Draft, not verified” and Claude Code reports it as SUCCEEDED_UNVERIFIED. AWS says the agent never merges.

Security controls and what they leave open

AWS lists several controls. Model calls go through a private Bedrock endpoint, signed with the runtime’s IAM execution role, which can invoke only Anthropic models. GitHub access comes from a GitHub App registered with AgentCore Identity; the tokens expire after 8 hours and are refreshed automatically, so the agent holds no long-lived credential. The runtimes sit in private subnets with VPC endpoints, and a Route 53 Resolver DNS Firewall blocks the model vendor’s own domains.

The post is candid about limits. The guardrail checks only the prompt a user types, so it does not see prompt injection that arrives through repository files or command output. The DNS Firewall is a denylist and does not stop other HTTPS traffic; AWS suggests an AWS Network Firewall domain allowlist for production. The sample is also not meant for untrusted code, because the agent runs the repository’s own commands, nor for open-ended work.

Who can try it: the code is on GitHub under aws-samples, and deployment needs an AWS account in a Region offering AgentCore runtime V2: us-east-1, us-east-2, us-west-2, ap-northeast-1 or eu-west-1. It also needs Docker, Python 3.11 or later, uv and Node.js 22.12 or later. AWS puts deployment at 15 to 25 minutes, plus 8 to 12 minutes to register each repository. It recommends zero data retention and, for data residency, a geographic inference profile instead of the sample’s global defaults.

The bill starts before the first task runs

AWS says the deployment bills while idle, through the NAT gateway, interface endpoints, AWS WAF, the Cognito user pool, the DNS Firewall, images and logs. The default $200 monthly Bedrock budget only sends an email and does not cap spending, and the sample publishes no cost estimate. AWS also warns that remote agents make cost harder to predict.

Some of the variable costs can be read from the public AgentCore pricing page. For runtime microVMs, consumption pricing for v2 is listed at $0.1276 per vCPU-hour and $0.0169 per GB-hour, against $0.0895 and $0.00945 for v1. The page also lists long-term AgentCore Memory storage at $0.75 per 1,000 records a month and retrieval at $0.50 per 1,000 retrievals. AgentCore Identity is listed as free when used through AgentCore Runtime or Gateway. Because tasks run for tens of minutes, according to the post, compute is likely a modest line next to the Opus and Sonnet token charges and the always-on networking, though AWS gives no figures to confirm that.

The comparison with a local setup is mostly about control and per-seat costs. AWS says Bedrock bills through an existing account with no per-seat licenses, and logs to CloudTrail. What the post does not establish is how often tasks succeed, how many reach a mergeable state, or how the sample compares with hosted agents from other vendors. Those are AWS’s design claims, not independently tested results.

The pattern matches a wider push to govern coding agents at the infrastructure layer. As our report on CrowdStrike’s AI kill switch noted, that vendor has agent-level hooks for Claude Code and plans to extend its Guardian product to AWS AgentCore, with no timeline given. AWS says the same design can work with other coding agents that use Bedrock as their model provider.