Amazon Bedrock AgentCore: AWS's Answer to the Agent Deployment Problem

AWS launched Amazon Bedrock AgentCore in preview in July 2025 and took it to general availability that October. What’s new here is narrower: on April 22, 2026, AWS added a managed harness to AgentCore Runtime. That announcement landed quietly — days before OpenAI’s GPT-5.5 and GPT-5.4 models arrived on Bedrock at the “What’s Next with AWS 2026” event on April 28 — but for builders shipping production agents, AgentCore solves a harder problem.

The hard problem is not building an agent. It’s running one in production for real users, at scale, without building the infrastructure layer yourself.

What AgentCore Actually Is

AgentCore is a managed platform for deploying and operating AI agents. It is not a framework and not an orchestration library. It sits between your agent code and AWS infrastructure, handling:

• Session isolation: each user session gets its own microVM with separate CPU, memory, and filesystem. When the session ends, the microVM is terminated and memory is sanitized; AWS states commands and agent code “cannot access other customers’ workloads or escape the VM boundary.”
• Session duration: agents can run for up to 8 hours per session, compared to AWS Lambda’s 15-minute hard limit. This matters for tasks that involve iterative research, long file processing, or multi-stage workflows.
• State persistence: managed session storage (preview) externalizes local session state — up to 1 GB per session, retained for 14 days of idle time — letting agents suspend mid-task and resume exactly where they left off.
• Managed execution: the managed harness runs the full agent loop — reasoning, tool selection, action execution, response streaming — with no orchestration code required from you.

AWS lists LangGraph, LlamaIndex, CrewAI, and Strands Agents among the frameworks AgentCore works with out of the box, alongside custom code. It also works with any foundation model on Bedrock, and — as of June 1, 2026 — with OpenAI’s GPT-5.5 (US East Ohio) and GPT-5.4 (US East Ohio and US West Oregon) on Bedrock.

The Managed Harness

The April 22, 2026 update added a managed harness to AgentCore Runtime. To use it, you specify three things:

1. A model (any Bedrock-compatible model ID)
2. A system prompt
3. A list of tools (Bedrock-format tool definitions)

The harness handles everything else: the reasoning loop, tool invocation, response accumulation, and streaming. No while not done loop. No manual tool-dispatch code.

import boto3

client = boto3.client("bedrock-agentcore-runtime")

response = client.invoke_agent(
    agentId="my-research-agent",
    sessionId="user-session-abc123",
    inputText="Summarize the last 90 days of earnings reports for NVDA, AMD, and INTC",
)

for event in response["stream"]:
    if "chunk" in event:
        print(event["chunk"]["bytes"].decode(), end="", flush=True)

Harness tool schemas use JSON Schema for the inputSchema — the same format used in the inputSchema field of Bedrock’s Converse API tool definitions.

The harness (in preview) is available in four AWS Regions: US West (Oregon), US East (N. Virginia), Europe (Frankfurt), and Asia Pacific (Sydney). There is no separate harness charge — you pay only for the underlying AgentCore capabilities you use.

How Pricing Works

AgentCore Runtime pricing has two dimensions:

The I/O wait detail is the interesting one. AWS states that “if your agent consumes no CPU during I/O wait, there are no CPU charges” — when your agent is waiting for an LLM response, an API call, or a database query, CPU billing pauses, which can cut effective compute cost compared to always-on compute models.

Billing granularity is per-second with a 1-second minimum, so short-lived tool executions are not punished with full-minute minimums.

Browser profiles and cookies, if your agent uses AgentCore’s browser capability, are stored in S3 at standard S3 rates.

There is no separate charge for the managed harness — you pay only for the underlying AgentCore capabilities (Runtime, Memory, Gateway, etc.) that your agent uses.

Core Services

AgentCore is modular. You can use components independently or together:

Runtime — the session execution environment. Per-session microVM isolation, 8-hour sessions, filesystem access, shell access within the sandbox. This is the core product.

Memory — a managed memory layer with two types: short-term memory for turn-by-turn context within a session, and long-term memory that “automatically extracts and stores key insights from conversations across multiple sessions, including user preferences, important facts, and session summaries.”

Gateway — an MCP-compatible gateway that converts APIs and Lambda functions into MCP-compatible tools and lets your agent call them through a managed connection layer, handling inbound and outbound OAuth authentication.

Tools — Gateway “converts APIs, Lambda functions, and existing services into Model Context Protocol (MCP)-compatible tools,” plus AWS’s own built-in Browser and Code Interpreter tools, available through the AgentCore SDK and CLI.

The Session Isolation Model

The isolation guarantee is stricter than container-based approaches and matters for multi-tenant deployments.

With containers, a misconfiguration or kernel vulnerability can leak data between tenants. Each AgentCore Runtime session runs in its own Firecracker microVM — the same virtualization technology AWS built to underpin Lambda and Fargate — giving each session a dedicated kernel and hardware-isolated memory.

For builders handling sensitive data — legal documents, financial records, health information — this is a meaningful difference from spinning up shared containers or using a single-process agent server.

When a session ends, the microVM is terminated and memory is sanitized; AWS states that commands and agent code “cannot access other customers’ workloads or escape the VM boundary.”

Nothing persists unless you explicitly use the managed session storage feature (which externalizes state to S3-backed storage) or the Memory service (which stores extracted facts in the managed memory store).

Framework Integration

AgentCore does not replace your framework. It wraps it.

LangGraph: deploy a LangGraph graph as an AgentCore agent. AWS lists LangGraph among the frameworks that work with AgentCore Runtime and the managed harness. The Runtime provides the execution environment; LangGraph handles the graph traversal.

CrewAI: package a CrewAI crew as an AgentCore deployment unit — also on AWS’s supported-framework list.

LlamaIndex: deploy a query pipeline or agent using AgentCore as the host. LlamaIndex is likewise named as a supported framework.

Strands Agents: AWS’s own open-source agent framework integrates natively with AgentCore — the managed harness itself is built on Strands Agents. If you’re starting fresh on AWS, this is the lowest-friction path.

Custom: if you have existing Python agent code, the CLI’s code-based path lets you write the agent loop in a framework you choose and deploy it to AgentCore Runtime, with full control over orchestration logic.

AgentCore vs. Lambda vs. ECS

This comes up for every new agent deployment. The short version:

AgentCore wins when you need session duration beyond Lambda’s 15 minutes, per-session data isolation, or you want to stop building the infrastructure layer. It is not the right answer for high-throughput stateless workloads where Lambda’s cold-start tax is already acceptable.

What Is Still in Preview

As of June 2026, these AgentCore features are in preview:

• Managed harness (available now in the four launch regions; it reached general availability on June 17, 2026)
• Managed session storage (preview — S3-backed session filesystem state)

AgentCore’s Browser and Code Interpreter capabilities are already generally available, not preview — AgentCore itself reached general availability in October 2025. Separately, OpenAI’s GPT-5.5 and GPT-5.4 on Bedrock are region-limited (Ohio, and Ohio plus Oregon respectively) but not labeled preview as of their June 1, 2026 announcement.

What to Do Right Now

If you are running agents on Lambda and hitting the 15-minute timeout, AgentCore Runtime is a straightforward migration target. The managed harness removes orchestration boilerplate; you keep your tool definitions and model choice.

If you are building multi-tenant agent applications and handling any sensitive data, the microVM isolation model is worth the migration overhead. The alternative — hoping your container isolation is sufficient — is a risk you can eliminate now.

If you are already on Bedrock, AgentCore integrates with your existing IAM roles, AWS PrivateLink connectivity, CloudTrail logging, and Bedrock Guardrails (applied through the Gateway policy engine). There is no new security model to learn.

The AgentCore managed harness is available today in 14 AWS Regions: US East (N. Virginia, Ohio), US West (Oregon), Canada (Central), Europe (Frankfurt, Ireland, London, Paris, Stockholm), and Asia Pacific (Mumbai, Singapore, Sydney, Tokyo, Seoul). Documentation is at docs.aws.amazon.com/bedrock-agentcore.