AWS AgentCore Session endpoints let you preview a web app live in your browser while a coding agent edits it

What happened

On October 30, 2026, AWS published a blog post explaining Session endpoints for the Amazon Bedrock AgentCore runtime. AWS describes Amazon Bedrock AgentCore as a platform to build, connect and optimize AI agents at scale. A "coding agent" is an AI that writes and modifies code on its own; the period during which an agent works on a task is called a "session". AWS states that the AgentCore runtime runs each session in its own isolated microVM (a lightweight virtual machine kept separate from others), and Session endpoints let users open the application running in that session from their own browser.

AWS describes the background this way: if an application must be copied out and deployed elsewhere, every change waits on a deployment and review slows down; if the application keeps running where the agent edits it, each change shows up in the browser within seconds.

AWS's demo uses a coding agent: the user asks it to switch a website to a dark theme, and after the agent saves the stylesheet, the site in the browser updates without a refresh.

How it works and its limits

According to AWS, Session endpoints give each session an authenticated URL that forwards each request's HTTP method, path, query string and body, as well as WebSocket connections (long-lived connections that let a server push updates to the browser), to a port the user has allowed. A port can be thought of as the "door number" of a particular service on the same machine.

• Ports: AWS says they are set with allowedPorts when the runtime is created, with 1 to 5 entries, each a single port or a range within 8000–12000, excluding platform-reserved ports. Allowing a port does not start a server: the app itself must listen on that port and bind to 0.0.0.0.
• URL: AWS says the URL is placed in a header of the response to InvokeAgentRuntime, the AWS API call that sends prompts to the agent.
• Authentication: AWS says that for a runtime using IAM (AWS's identity and access management service), every request must carry a SigV4 signature (AWS's way of proving who sent a request), and the caller also needs the bedrock-agentcore:InvokeAgentRuntimeProxy permission. A runtime using JWT (JSON Web Token) authorization takes a bearer token (a type of access credential) instead. AWS stresses that knowing the URL does not grant access.
• Scope: AWS says the URL is limited to a single session and stops working when the session ends; to serve an app to users, deploy it to a hosting service such as AWS Amplify Hosting.
• Local endpoint: AWS says a browser cannot add a signature or token to a page's requests on its own, so a client in the bedrock-agentcore SDK can open a local endpoint on your machine that adds the credentials and forwards the requests.

AWS also distinguishes a Session endpoint from the existing runtime endpoint: the latter is how callers reach the agent itself, while the former is for viewing what the agent is running inside a session.

What it means for development teams

By AWS's account, teams reviewing a web prototype built by an AI agent can see the result while it keeps running where the agent works, without deploying it first each time. AWS also cautions that the feature is for building, testing and reviewing, not for serving an app to users.

AWS adds that if other people can send prompts to the coding agent, you may want to consider Amazon Bedrock Guardrails to filter harmful prompts and responses, and to review the agent's changes before publishing them. AWS says the demo agent's file tools refuse paths outside the website folder.

What you see when a request is rejected

AWS adds that requests are recorded in AWS CloudTrail as InvokeAgentRuntimeProxy events, and that the runtime removes its own authentication headers before forwarding, so the website does not receive the user's signature.

Requirements and known limitations

• AWS says Session endpoints work with microVM runtimes, not with the Instances compute type.
• AWS says the URL is reached over public HTTPS, and AWS PrivateLink is not supported for inbound connections.
• AWS's demo requires: an account in an AWS Region that offers Session endpoints, Python 3.10 or later, bedrock-agentcore 1.25.2 or later, boto3 1.43.122 or later, Node.js 22 or later, and access to Claude Haiku 5.5 in Amazon Bedrock.
• AWS provides the complete sample and notebook in the agentcore-samples GitHub repository; to avoid ongoing charges, AWS advises stopping the preview and deleting the runtime, uploaded code and IAM role created by the sample when finished.

Browse the latest news in this topic

• AI news