Automates developer workflows by safely delegating coding tasks to remote AI agents while maintaining strict infrastructure isolation.
Amazon Bedrock AgentCore Runtime moves each Claude Code task off your laptop and into an isolated microVM inside your own AWS account, and the work comes back as a draft pull request that you choose to merge. The honest verdict: a real isolation win for teams that already run autonomous coding agents, and the wrong tool for untrusted code or open-ended briefs. On AWS’s own pages, read November 6, 2026, the cost is consumption-based per second of CPU and memory with no upfront commitment, up to $200 in Free Tier credits for new AWS customers, and a default $200 monthly Amazon Bedrock budget in the reference deployment that emails you without capping spend.
What is Amazon Bedrock AgentCore and what does it do?
Amazon Bedrock AgentCore is AWS’s platform for building, connecting, and running agents at scale. Its Runtime capability gives every coding task its own isolated session inside your AWS account, and a new AWS walkthrough shows it running Claude Code as a remote agent end to end.
The pitch fits in one line from the post itself: you offload a coding task, close the laptop, and come back to the result. Each registered repository gets its own runtime, backed by one container image in Amazon Elastic Container Registry that carries the Claude Code CLI, the Claude Agent SDK, git, and make.
The session is a dedicated microVM with its own CPU, memory, and filesystem, and AWS’s runtime documentation states that the microVM is terminated and its memory sanitized after the session completes.
AgentCore Runtime turns a Claude Code task into a sandboxed cloud session that belongs to your account.
Does AgentCore actually keep Claude Code off your laptop?
The split matters here. The coding work runs in the cloud session, but a small plugin still runs on your machine: the sample’s MCP server signs each request with your AWS credentials and calls an IAM-authorized Amazon API Gateway HTTP API.
You can skip even that by submitting tasks from a web console served through Amazon CloudFront, where you sign in with Amazon Cognito. Either path routes the repository work itself into the microVM, away from your local filesystem.
The security stack behind the session: a guardrail on every task prompt, private networking inside your VPC, least-privilege permissions, and short-lived GitHub access issued through AgentCore Identity.
Amazon Bedrock also states that it does not use your content to train models or share it with model providers, and that its Mantle inference engine is built so AWS staff have no technical means to reach customer prompts or completions.
The task leaves your laptop, the credentials stay local and short-lived, and a human decides what ships.
Amazon Bedrock AgentCore vs local Claude Code: which is safer?
Running Claude Code on a local machine hands the agent your hardware, and the AWS post’s case is that each task runs outside your laptop and the credentials in your shell. One leaked repo key or one careless command touches real files on real disks.
AgentCore routes the same task into a dedicated microVM, which keeps the remote agent away from your local filesystem. The trade lands in your bill instead of your risk profile, because the runtime bills per second of actual CPU and memory consumed.
Anthropic ships its own cloud option too, Claude Code on the web, which runs sessions from a browser or phone. The difference is where the work lives: AgentCore keeps execution inside your AWS account, behind your IAM policies and an identity provider such as Microsoft Entra ID or Okta.
For teams that must keep agent execution inside their own cloud estate, AgentCore is the safest of the 3 paths.
A draft pull request sits in the queue at 7 in the morning on a branch named agent/<taskId>, the verification command and its exit code printed in the description.
The engineer who filed the task closed the laptop the night before. The agent used its 3 attempts, opened the branch, and stopped there, because the agent never merges and the human does.
The other number on the screen is the budget line: the default $200 monthly Amazon Bedrock budget emails without capping spend, and an idle deployment still bills through the NAT gateway, the interface endpoints, WAF, Cognito, the DNS Firewall, images, and logs. The budget review belongs in the same morning ritual as the pull request review.
Who is Amazon Bedrock AgentCore actually for?
The post is blunt about fit. Scoped features, bug fixes, and tests on a trusted repository that declares its own setup and test commands are the good fits.
Untrusted code is the hard no, because the agent runs the repository’s own commands and cannot make them safe. Open-ended work fails too, because each task stops after 3 attempts.
Across runs, AgentCore memory records what happened in each step and extracts lessons, such as a build step with a hidden prerequisite, for later tasks on the same repository.
The pull request records the verification command, its exit code, and the attempts used, and it opens as a draft unless verification passed.
This fits engineering teams with trusted repos and scoped work, and it fits nobody’s untrusted-code pipeline.
Is it safe to give an AI agent access to your GitHub?
The sample issues short-lived GitHub access through AgentCore Identity, so the repository credentials an agent uses expire instead of living in a config file on a laptop.
Least-privilege permissions and a guardrail on every task prompt bound what the agent can reach for during a run, and the pull request opens as a draft unless verification passed.
The hard boundary the post names itself: the agent runs the repository’s own commands, so untrusted code stays outside this design, and the review step is where a human decides what ships.
Agent access to GitHub here is short-lived, guarded, and merge-blocked by design.
How much does Amazon Bedrock AgentCore cost?
The AgentCore pricing page reads as consumption-based, with no upfront commitments or minimum fees, and new AWS customers receive up to $200 in Free Tier credits.
microVM sessions bill per second on the CPU and memory your session consumes, with a 1-second minimum and a 128MB minimum for memory. Runtime v2 reclaims idle memory after 120 seconds, which trims the meter on agents that spend their runs waiting on tool calls.
Network data transfer bills at standard EC2 rates, container storage bills through Amazon ECR, and the Instances compute type adds a management fee on top of the EC2 price, with sessions that persist up to 14 days.
The reference deployment adds its own warning: it bills while idle, and its default $200 monthly Amazon Bedrock budget emails you without capping spending.
Price this as a meter that runs whenever the sandbox exists, and set hard alerts before you connect a bill-critical repository.
Should you switch to Amazon Bedrock AgentCore?
If your team already delegates coding tasks to Claude Code and wants the execution isolated from developer machines, the switch earns its setup time. Track what each session costs you against what AI APIs cost a small business before you scale it beyond one repository.
Start with one trusted repository that declares its own setup and test commands, keep the human merge step, and treat the budget alert as part of the workflow review.
If your agent stack is still forming, our guide on stacking AI agents for a small business places a remote coding agent against the customer-facing tools you would pick first.
Switch for isolation on trusted repos, skip it for untrusted code, and never let the budget run unwatched.
Amazon Bedrock AgentCore: quick answers
Does the agent ever merge its own pull request?
No. The pull request opens as a draft unless verification passed, and the post is explicit that you review it and merge it while the agent never merges.
How long can an AgentCore session run?
microVM sessions run for up to 8 hours, and the Instances compute type persists sessions for up to 14 days, per the AgentCore documentation.
What happens when a Claude Code task fails on AgentCore?
Each task stops after 3 attempts, and the pull request records the verification command, its exit code, and the attempts used, so you can read the failure back.
Does Claude Code on AgentCore cost anything upfront?
No. Billing is consumption-based per second with no upfront commitment, and new AWS customers get up to $200 in Free Tier credits on the pricing page.
Source: AWS Machine Learning Blog. Last Updated: November 6, 2026. Signal Type: industry_news.
