AWS describes a pattern in which a developer hands a coding task to Claude Code running as a remote agent on Amazon Bedrock AgentCore. Each task runs in its own microVM-based runtime session in the customer's VPC, and every model call goes to Amazon Bedrock, so existing Bedrock data protections apply. The workflow uses an MCP server in Claude Code or a web console, an API Gateway and Lambda queue, and a per-repository AgentCore runtime built from a container image.
The agent clones the repository, plans with Claude Opus, writes changes with Claude Sonnet, and runs the repository's own setup and test commands. Review can send work back to planning for up to three attempts. The agent then opens a pull request, as a draft unless verification passed, and never merges it. AgentCore memory keeps lessons from earlier tasks on the same repository.
Why it matters if you build agents
Teams building agents can offload scoped tasks on trusted repositories and get reviewable pull requests back, but the sample is not suited to untrusted code or open-ended work. The prompt guardrail screens only what a user types, not prompt injection that arrives through repository files or command output.
Builders adapting the sample should keep the GitHub App installed only on repositories they register, turn on branch protection, and review the zero data retention and network firewall notes in the post before production use.
Get stories like this every weekday
One short email with the day's agent tooling news.