Coding agents are leaving the laptop. AWS and Databricks show the new path: gateway, microVM, pull request

Today a coding agent typically runs on a developer’s laptop, with that developer’s credentials, network access and whatever is in their home directory. It works, and it is the security team’s least favorite sentence of the year.

Two releases in early November show where that is heading. Neither is a product launch in the usual sense, which is why they are useful: they describe the plumbing.

AWS: one task, one microVM, one pull request

An AWS sample published on November 6 runs Claude Code as a remote agent on Amazon Bedrock AgentCore. A developer submits a task through a Claude Code plugin or a web console. A guardrail screens the prompt, the task is queued, and an AgentCore runtime session starts for the repository, isolated in its own microVM inside the customer’s AWS account.

The agent clones the repository with a short-lived GitHub token issued by AgentCore Identity, consults memory from earlier tasks, plans and reviews with Claude Opus, writes code with Claude Sonnet, and runs the repository’s own setup and test commands. It stops after three attempts. The result is a pull request that records the verification command, its exit code and the attempts used, marked as verified or unverified. The agent never merges.

The network is private, model calls go only to Bedrock through a private endpoint, and the runtime’s IAM role is denied access to the identity control plane.

Where the AWS sample draws its boundaries

Customer AWS account

• Private subnets
• Bedrock-only model access

Per-task microVM

• Fresh session per repository
• Short-lived GitHub token

Coding agent

• Runs repo commands
• Opens a pull request, never merges

Databricks: the same agents, through the company gateway

Databricks took a narrower step. Its November release notes make Claude Code and Codex available inside SSH tunnel sessions, with model requests routed through Unity Gateway, Databricks’ governed model gateway, and authenticated with the session’s own credentials. Spend on AI functions now also counts against Unity Gateway budgets, and a GitHub Action in beta publishes Git-managed agent skills into Unity Catalog.

That is the control we described when Databricks cut its own AI coding costs through the gateway: one place to see, budget and limit which models coding agents call.

What each step fixes, and what it leaves open

The AWS design fixes where the agent runs and what it can touch. The Databricks design fixes which models it calls and who pays. Together they describe the target state. Separately, each leaves gaps, and the AWS authors name theirs honestly:

• The guardrail sees only the prompt. Instructions hidden in repository files or command output are not screened. Prompt injection from the codebase itself remains possible.
• The agent runs the repository’s own commands. The sample is not meant for untrusted code. A malicious build script runs inside the microVM.
• The DNS firewall is a denylist. It does not stop other HTTPS traffic.
• Budgets warn; they do not stop. The default US$200 monthly Bedrock budget sends email, it does not cap spend, and the deployment bills while idle.

The direction is right

Moving coding agents off laptops turns an unmanaged endpoint into a workload with an account, a network, an identity and a log. The pull request becomes the boundary, which is where review already happens.

It also concentrates load on that boundary. Agents that open pull requests around the clock will strain review queues and CI, a strain we saw when Anthropic built source control for agents at scale. Plan the review capacity before the sandboxes, or the queue becomes the new laptop.