What changed
AWS released a sample that runs each Claude Code task in a separate Bedrock AgentCore runtime session inside the customer's AWS account and returns a GitHub pull request for review. The design uses Bedrock model calls, short-lived GitHub tokens, a prompt guardrail and optional private VPC networking.
Why it matters
The reference makes remote coding-agent isolation and human merge review concrete without requiring a laptop to stay online. It also concentrates repository credentials, network policy and generated code inside a cloud runtime that must be configured and audited correctly.
What to do
Deploy the sample only into a disposable account and repository, restrict egress and GitHub scope, force a denied prompt and expired token, inspect CloudTrail and runtime logs, and prove that closing the session removes credentials and leaves only a reviewable pull request.
Caveat
This is AWS sample code and a technical how-to, not a managed generally available Claude Code product or independent security assessment. The sample requires adaptation for production, and isolation does not prevent harmful code, data exfiltration through allowed paths or reviewer error.