Coder Put Claude Code Behind Your Firewall. Anthropic Still Runs the Loop

The enterprise objection to Claude Code has been boring and correct: the agent wants your repo, your credentials, and a path to the internet, and the loop still lives at Anthropic. Coder’s September 15 press release does not move the loop. It moves the filesystem.

Yahoo carried the same GlobeNewswire item, datelined Austin. Agent Relay is Coder’s self-hosted execution environment for cloud coding agents, launched the week before. Claude Code now runs inside Coder workspaces on infrastructure you own. Network-governed, sandboxed, auditable. Anthropic still handles billing and still runs the agent loop. Everything the agent touches is supposed to live on machines you control.

We already ran Claude Code against Ollama for a zero-invoice local path. That is a different product. Ollama keeps inference in the building. Agent Relay keeps the tools in the building and ships the prompts to Anthropic. If your security review was “no tokens leave the VPC,” this is not the ticket you wanted. If the review was “the agent may not write to the laptop that has prod kubeconfigs,” it might be.

What actually shipped

Each Coder workspace starts a Claude Code runner that opens an outbound connection to Anthropic’s backend. Developers keep the Claude Code they already use in Claude Desktop and on claude.ai. Anthropic keeps account administration, billing, and inference. Tool calls execute inside the self-hosted workspace, so the agent’s filesystem, credentials, and reach into internal services stay on the customer side.

Workspaces are sandboxed, ephemeral, and scoped to a single Claude Code session. Permitted data sources and network egress are defined once at the environment level and inherited by every workspace that follows. Every run produces an audit record of workspace provisioning and lifecycle, correlated to the Claude Code session and the user it served. Teams can add process-level network policy that blocks and logs every request the agent makes.

That last sentence is the part a bank will actually buy. Not “AI.” Logs.

Josh Epstein, Coder’s president, said Claude Code is one of the agentic tools their enterprise customers ask for by name, and regulated industries have wanted it the most. Agent Relay, in his line, removes the barrier: same experience, execution inside infrastructure they control.

The architecture is built on Claude Code’s publicly available self-hosted environments. Coder is not claiming a private Anthropic fork. It is wrapping the official runner in a workspace that dies when the session dies.

Early access, not a SKU you can PO today

Claude Code support in Agent Relay is in early access with select design partners. Documentation and deployment guides are at coder.com/anthropic. The release’s closing pitch is blunt: if security review kept Claude Code out of your organization, talk to Coder.

I do not have pricing. I do not have a list of those design partners. I do not have a SOC 2 exhibit that names Agent Relay. A GlobeNewswire copy does not become a procurement packet because it says “fully auditable.” Ask for the audit record schema, the egress policy model, and whether the outbound connection to Anthropic can be pinned to a proxy you already inspect.

Coder also says the direction is open: any provider of self-hosted cloud agents should be able to build with Agent Relay over time, same governed execution model. That is a platform claim. Today the named integration is Claude Code. Treat Codex, Gemini CLI, and the next logo as a slide until they ship.

What this is not

It is not local inference. The runner calls Anthropic. Your code snippets, tool results, and whatever the agent stuffed into context still leave the building. If you needed air gap, you needed the Ollama path, with the limits we already listed.

It is not a replacement for Goose. Goose lets you swap models and does not swap out the bill. Agent Relay keeps the model you asked for by name and relocates the shell.

It is not Copilot HydraFusion. HydraFusion was a cost cut that beat Opus once. Different vendor, different loop, different audit story.

It is not a promise that the agent will be good. It is a promise about where the rm runs.

The same week, private code still humbles the stack

The New Stack’s Real-SWE write-up is not a Coder article. It is the reason a regulated shop should still watch the agent after you have a pretty sandbox.

Specific Labs tested coding agents on private code, the kind of tree they say is unlikely to have been in training. They estimate 99 percent of tokens in real-world enterprises are hidden from frontier models. Scores fell once the agents left the public set.

Fable 5.1 running via Claude Code led at 38.8 percent. GPT-6 Astra on Codex CLI was 33.8 percent. Gemini 3.8 Flash on Gemini CLI was 31.2 percent. Then GLM 5.3 at 28.8, Grok 4.6 and Muse Spark 1.3 tied at 23.8, Kimi K3 at 18.8, GPT-5.6 Sol at 16.2. Each model got eight tries per task. Each model ran in its own coding tool, so the number is the combo, not the weights alone. Six tasks stumped everyone.

38.8 percent is first place. It is also a failing grade if you were about to let the agent open a PR into a payments service. Agent Relay will not raise that number. It will make the failure happen on a machine whose disk you can image.

If you already blocked Claude Code because a developer laptop had production credentials in the environment, Relay is aimed at you. Put the credentials in the workspace policy, not in ~/.aws. Make egress a list, not a hope. Keep a human on the merge.

If you blocked Claude Code because prompts cannot leave the country, hang up. Anthropic still runs the loop. The press release says so in the second paragraph.

Who should bother this month

Design-partner energy is real only if you already run Coder, already lost a security review over Claude Code, and already have a proxy that can see outbound model traffic. Then the September 15 note is a calendar invite.

If you do not run Coder, this is not a reason to rip out the laptop workflow next week. Evaluate the workspace model first. Ephemeral, session-scoped, inherited egress is the product. Claude Code is the guest.

If you run agents on a shared Docker socket, we have written that sermon elsewhere and it still applies. Relay’s sandbox is only as strict as the workspace image and the network policy you actually attach. A design partner who mounts the host Docker socket into the workspace has bought a very expensive --host.

I will believe the “any provider” roadmap when a second agent lands in the same audit table. Until then the review is narrower: Claude Code, outbound to Anthropic, tools at home, early access. That is enough to reopen a ticket. It is not enough to close it.

Questions the press release does not answer

Ask Coder, in writing, what the audit record contains. The release says workspace provisioning and lifecycle, correlated to the Claude Code session and the user. That is necessary. It is not sufficient. You also want the tool-call trace: which files were read, which commands ran, which outbound hosts were attempted, which were blocked. Process-level network policy that “blocks and logs every request” is only useful if the log lands in the SIEM you already have, not in a Coder UI someone screenshots for the CAB.

Ask whether the outbound Anthropic connection can terminate on your proxy. A runner that “opens an outbound connection to Anthropic’s backend” can still be a hole if it pins past SSL inspection or uses a channel your DLP does not see. Regulated shops that already inspect model traffic will not take “trust the SaaS” as the answer. The whole pitch is that the filesystem stays. The prompt still leaves. Inspection is how you live with that sentence.

Ask what “ephemeral” means on disk. Session-scoped workspaces that die are good. Workspaces whose volumes snapshot into a backup cluster you forgot about are how source code lives for seven years. Inherited data-source allowlists are only as tight as the first environment you copy.

Ask who can attach a volume. If a developer can mount $HOME into the workspace, you bought Claude Code on the laptop again, with extra YAML. The sandbox is the image and the policy, not the brand name Agent Relay.

Pricing is missing. Design-partner status is missing. A date when early access becomes GA is missing. Those absences are normal for a September 15 wire. They are disqualifying for a production rollout next Monday.

How I would trial it, if I already pay for Coder

Pick one repo that is annoying and not production. Put the workspace on a subnet that cannot reach the payments database. Allow egress only to Anthropic and the internal package registry. Turn on the process-level block-and-log. Run the same task five times. Read the audit records as if they will be Exhibit B. If you cannot explain a tool call from the log, you do not have an audit trail. You have a marketing adjective.

Keep a control: the same task in Claude Code on a locked-down laptop, and the same task through the Ollama path we already measured. Relay should win on credential isolation. It should lose on data residency. Ollama should lose on model quality. Real-SWE’s 38.8 percent ceiling is the quality conversation, and it does not care which hypervisor ran the shell.

Eight tries per task on that benchmark is also a process warning. If your policy is one-shot PRs, you are not running the experiment they ran. If your policy is “the agent may retry in the sandbox until the tests pass,” you are closer, and you still need a human on merge because six tasks stumped every model in the room.

Coder’s line that anyone in the organization should be able to safely run their favorite AI is a vision statement. The September 15 artifact is narrower and better: Claude Code, in a workspace you own, talking to Anthropic, early access, docs at coder.com/anthropic. Write the ticket that way. Leave “favorite AI” for the roadmap slide. The ticket you can file today has a URL, a date, and a split of duties you can brief to security without a metaphor.