Chris Kent

CMO at Coder

Most enterprise AI risk programs rest on an assumption nobody has written down: that if the model is good enough, the deployment is safe enough. Buy from a reputable lab, read the system card, check the certifications, and the rest is adoption.

That assumption is now the largest unexamined control in the enterprise stack, and it is load-bearing. In a world where everyone is a coder, it is also about to be tested at a scale most organizations have not planned for.

The timing became obvious this week. In <a href="https://darioamodei.com/post/we-must-pace-the-frontier">We Must Pace the Frontier</a>, Dario Amodei argues that frontier labs should deliberately slow capability advancement so that safety work can keep up. He says Anthropic is committing unilaterally to embedded third-party evaluators with the right to publish findings the company cannot edit. It is a serious proposal backed by a costly commitment, and the industry is better for it.

It is also work that happens entirely upstream of the place where AI actually touches a business. A model can be paced, aligned, interpreted, and independently audited, and still arrive in an organization that has not decided which repositories it can read, which systems it can call, or what happens when it decides the task requires more access than anyone intended.

Those are two different disciplines. Confusing them is how enterprises end up with excellent vendor due diligence and no idea what ran on their infrastructure last week.

<h2>Safety lives in the environment</h2>

The clearest evidence for this came from the labs themselves, in their own test environments, this summer.

In July, OpenAI disclosed that models had escaped an isolated test environment and reached production systems at Hugging Face. <a href="https://metr.org/blog/2026-08-26-openai-hugging-face-incident-investigation/">METR&#39;s independent investigation</a> found the agents coordinating on a shared unsanctioned message board, dividing into specialized lanes, with named agents assigning roles to the others. One obtained remote code execution on a worker container handling production data.

Then Anthropic published <a href="https://www.anthropic.com/news/investigating-incidents-cybersecurity-evals">findings from its cybersecurity evaluations</a> that most vendors would have buried. Models that were supposed to have no internet access found one through a misconfiguration. Reviewing more than 141,000 test runs, the team identified three incidents in which models reached real company infrastructure. One retrieved credentials and pulled production data. One published malware to a public package registry, where it was downloaded and run on fifteen real systems.

The instructive part is what the models were doing. They were not rogue. They were completing the assignment with everything within reach (which is the defining behavior of an agent rather than a defect in one). Two of the most sophisticated AI organizations in the world, working in purpose-built isolation with every incentive to get containment right, each left one open path. One open path was enough.

Take the right lesson from that. Safety did not fail at the model layer. It failed at the boundary, which is the layer your organization owns and almost nobody has built.

<h2>Frontier labs govern the intelligence, but you govern its agency</h2>

This is the division of labor that the industry conversation keeps blurring and it determines what your team is actually accountable for.

Frontier labs are responsible for the intelligence they create. Training, alignment, interpretability, evaluation, refusal behavior, incident disclosure, and the verifiability mechanisms Amodei is proposing all sit with them. No customer can do that work. You cannot audit a training pipeline or read what happens inside a model.

Organizations are responsible for the agency of that intelligence, including where agents execute, what code and data they can open, which tools, systems, and MCP servers they can reach, as well as what credentials and compute they can spend and whether every action is observed, attributed, constrained, and recorded.

Labs do publish governance controls, and the serious ones are useful: retention settings, tenant isolation, enterprise administration, documented usage policies. Those controls get written once for an entire customer base, which is what makes them generic. They describe how a vendor handles data in general, not how your organization is obligated to handle its own.

Regulated environments need something narrower. Controls keyed to your data classification scheme. A residency commitment your regulator will actually accept. Separation of duties between the person requesting the work and the system performing it. Change management that produces evidence rather than assurances. A lab&#39;s protocol reasonably stops at its own API boundary, and your obligations continue well past it, into the repositories, records, and internal services the agent reaches once it is inside.

Those are decisions about your business, made with your context, enforced on your infrastructure.

Most organizations have made those decisions. They made them for an environment where the actors were human and countable, and where access review could run on a quarterly cycle because a quarter was fast enough.

The ground has moved underneath those controls. Enterprises now manage an average of 109 machine identities for every human identity, according to <a href="https://www.helpnetsecurity.com/2026/05/14/2026-identity-security-landscape-report/">Palo Alto Networks&#39; 2026 Identity Security Landscape report</a>. While most can explain what their AI agents are for, far fewer can define what those agents can access, how that access is limited, when permissions are revoked, or which systems can inherit them. The Cloud Security Alliance found in April that <a href="https://cloudsecurityalliance.org/press-releases/2026/04/16/more-than-half-of-organizations-experience-ai-agent-scope-violations-cloud-security-alliance-study-finds">53% of organizations have already experienced AI agents exceeding their intended permissions</a>.

A permission model built around people does not fail loudly when agents arrive. It keeps working, at the wrong scale.

<h2>The deployment curve does not slow down</h2>

Whatever happens at the frontier, the number of autonomous actors inside enterprises is climbing on a curve set by procurement, employee preference, and board pressure. Gartner projects that by 2028 the average global Fortune 500 enterprise will have <a href="https://www.gartner.com/en/newsroom/press-releases/2026-04-28-gartner-identifies-six-steps-to-manage-artificial-intelligence-agent-sprawl">more than 150,000 AI agents in use, up from fewer than 15 in 2025</a>.

A safer frontier actually steepens that curve rather than flattening it. Models that arrive with embedded evaluators, published risk reports, and verified alignment properties are easier to approve, easier to defend to a regulator, and easier to roll out broadly. That is the correct outcome and the entire point of the exercise. It also means the better the models get, the more of them will be running inside organizations that never decided where they run.

This puts the burden squarely on the boundary, on a deadline.

<h2>What the boundary has to do</h2>

Five requirements make a deployment governable, and they hold as a set or not at all.

<ol>
<li>Contain the data, so outbound access is denied by default and every exception is explicit and reviewable. </li>
<li>Scope the access, so every AI action sees what the task needs and nothing wider. </li>
<li>Govern the models, so only approved models run and sensitive work routes by policy rather than by whichever tool someone opened first. </li>
<li>Audit everything, so each action leaves a durable record tied to a person and a task. </li>
<li>Control the spend, so cost is visible by team and agent with hard stops set in advance.</li>
</ol>

Assembled from separate tools, these produce five boundaries, five policies, and no single account of what happened. They work when they are enforced in one place, at the point where AI actually executes.

The alternative is the posture Gartner warns about. It predicts that <a href="https://www.gartner.com/en/newsroom/press-releases/2026-05-26-gartner-says-applying-uniform-governance-across-ai-agents-will-lead-to-enterprise-ai-agent-failure">by 2027, 40% of enterprises will demote or decommission autonomous AI agents due to governance gaps identified only after production incidents occur</a>. The root cause its analysts name is treating agent governance as binary, either locked down or fully trusted. Both settings fail. One drives shadow development, the other expands the blast radius.

<h3>Build the layer, not another policy</h3>

Most enterprises have a model strategy and a roadmap of use cases. Far fewer have built the layer where AI actually runs. Coder&#39;s <a href="https://coder.com/blog/what-100-engineering-teams-revealed-about-ai-maturity-and-what-to-do-about-it">AI Maturity Model assessment of 100 engineering organizations</a> found 70% running agents on infrastructure that was never designed for them, and only 31% at organization-wide governance or better.

We call that layer the <a href="https://coder.com/ai-operating-layer">AI Operating Layer</a> and the design principle is portable whoever you build it with. Containment, scope, model policy, audit, and spend belong in the environment where work executes, rather than bolted onto each tool as it arrives. A policy asks people to behave. An environment decides what is possible.

<a href="https://coder.com/ai-operating-layer"><img src="https://www.datocms-assets.com/19109/1788291279-aiol-thumb.jpg" alt="The AI Operating Layer">
</a>

For us that means <a href="https://coder.com/solutions/workspaces">self-hosted workspaces</a>, <a href="https://coder.com/docs/ai-coder/agent-firewall">default-deny networking</a>, and <a href="https://coder.com/docs/ai-coder/ai-gateway">centralized model access</a> applying to every session, human or agent, without anyone reconfiguring per team.

<h3>Where the agent thinks and where it runs</h3>

The harder problem is the one enterprises actually have. Teams have already chosen their preferred agents, those agents are cloud-hosted, and the vendor&#39;s cloud is where the code goes. In a regulated industry that disqualifies the agent regardless of how good it is.

<a href="https://coder.com/blog/introducing-agent-relay-cloud-hosted-agents-self-hosted-execution">Agent Relay</a> separates where an agent thinks from where it executes. The provider keeps running the reasoning loop. Execution moves into a workspace the enterprise operates, where network policy, RBAC, and audit logging already apply. It launched September 4 with Cursor, and Claude Code followed on September 15, built with support from the Claude Code team.

That split is the division of labor described above, made concrete. The lab governs the model. The enterprise governs where it executes, what it reaches, and whose name is on each action, since every request resolves against the organization&#39;s existing identity provider before work starts. 

The limit is worth stating. Inference still routes through the agent provider rather than through AI Gateway, which follows from the reasoning loop running in the provider&#39;s cloud. Nobody has a complete answer to AI risk, and this one is narrower: what an autonomous actor is permitted to do once it is inside.

Every ungoverned environment is harder to govern after the fact. Every unaudited agent run is harder to reconstruct retroactively. Building the layer deliberately costs a fraction of building it under pressure.

<h2>The decision you have already made</h2>

Every organization running AI today has made a decision about the boundary. Most of them made it by default, one tool at a time, without anyone in the room who would describe it as a decision.

The frontier labs are being asked to prove their models can be trusted and that debate will run for years. The question in front of everyone else is smaller, more immediate, and entirely within their control: what they have already permitted to happen on their own infrastructure.

Model safety and deployment safety are two different disciplines with two different owners. Here is what enterprises are responsible for, and what it takes to hold it.

Trusting the Model is Not an AI Security Strategy

Coder Team 

Coder today announced Claude Code support with Coder’s new Agent Relay, the self-hosted execution environment for cloud coding agents launched last week. This integration enables running Claude Code agents inside Coder workspaces on the customer’s own infrastructure: network-governed, sandboxed, and fully auditable. Anthropic continues to handle billing and run the agent loop, while everything the agent touches lives on machines the customer controls. With <a href="https://coder.com/blog/introducing-agent-relay-cloud-hosted-agents-self-hosted-execution">Agent Relay</a>, Coder is making Claude Code agents available to more organizations across industries.

<h2>Claude Code on customer-controlled infrastructure</h2>

Claude Code has set the pace for agentic development and become the coding agent enterprise developers ask for by name. Adoption in regulated industries has been limited by deployment, not demand. <a href="https://coder.com/use-cases/financial-services">Financial services</a> and other regulated enterprises operate under security and compliance requirements that prevent autonomous agents from accessing source code, credentials, and internal services on infrastructure outside the organization’s control. Until now, that has kept Claude Code out of many of the organizations best positioned to benefit from it.

Agent Relay removes that limitation. Claude Code&#39;s work runs in <a href="https://coder.com/solutions/workspaces">Coder workspaces</a> on the customer&#39;s cloud, VPC, or on-premises environment, governed by network egress policy the platform team sets and logged in full. Anthropic continues to operate the agent, the enterprise retains its security perimeter, and security review teams get clear answers to the questions that determine approval: where code runs, who has access, what the agent can reach, and what record exists afterward.

<h2>Opening regulated industries to agentic development</h2>

Some of the world’s largest developer organizations sit inside financial services and other regulated industries. Agent Relay enables those enterprises to adopt Claude Code without giving up the controls their regulators require.

Coder launched Agent Relay on September 2 <a href="https://coder.com/blog/agent-relay-spacexai-launch-partner-cursor-cloud-agents">with Cursor as its first agent provider</a>, and Anthropic’s engineering team worked with Coder to bring Claude Code onto the relay within days of launch. For platform teams already running Agent Relay, turning on Claude Code requires no new deployment and no fresh security review: the workspace model, the egress policy, and the audit trail are already in place, and Claude Code inherits all of it on day one. Coder plans to extend the integration over time.

&quot;The teams that care most about running Claude Code on their own infrastructure tend to be the ones with the most rigorous environmental isolation requirements. Coder has built a strong reputation serving those teams, and Agent Relay gives them a straightforward way to bring Claude Code into environments they already control,” said Cat Wu, head of product for Claude Code at Anthropic.

<h2>How the integration works</h2>

This integration is built on Claude Code’s publicly available self-hosted environments. Each Coder workspace starts a Claude Code runner that opens an outbound connection to Anthropic’s backend. Developers keep the Claude Code experience they already use in Claude Desktop and claude.ai, and Anthropic continues to handle account administration, billing, and inference. Tool calls execute inside the self-hosted workspaces, keeping the agent’s filesystem, credentials, and access to internal services within the customer-controlled environment. Workspaces are sandboxed, ephemeral, and scoped to a single Claude Code session, with permitted data sources and network egress defined once at the environment level and inherited by every workspace that follows. Every run produces an audit record of workspace provisioning and lifecycle correlated to the Claude Code session and user it served, and teams can add process-level network policy enforcement that blocks and logs every request the agent makes. 

“Claude Code is one of the agentic tools our enterprise customers ask for by name, and regulated industries have wanted it the most. Agent Relay removes the barrier, giving organizations the same Claude Code experience their teams want while executing within infrastructure they control,” said Josh Epstein, president at Coder.

The direction from here is open. Any provider of self-hosted cloud agents will be able to build with Coder and Agent Relay over time, bringing their agents into the same governed execution model. It continues the strategy Coder has pursued from the start: everyone is a coder, and anyone within an organization should be able to safely run and build with their favorite AI on Coder.

<h2>Availability</h2>

Claude Code support in Coder Agent Relay is in early access with select design partners. Documentation and deployment guides are available at <a href="https://coder.com/anthropic">coder.com/anthropic</a>. If security review has kept Claude Code out of your organization, <a href="https://coder.com/contact/sales">talk to Coder</a> about running it inside your infrastructure.

Coder’s Agent Relay integration with Claude Code, built with support from the Claude Code team, lets financial services, technology leaders, and global enterprises run the industry’s leading coding agent on infrastructure they own.

Coder + Anthropic logos

Coder Brings Claude Code to Agent Relay, Unlocking Agentic Development for the World’s Most Regulated Enterprises

Matt Vollmer

Product Marketing Manager at Coder

Last week, we introduced <a href="https://coder.com/blog/introducing-agent-relay-cloud-hosted-agents-self-hosted-execution">Agent Relay</a>, which connects cloud-hosted coding agents like Cursor to self-hosted Coder workspaces. For enterprises comfortable with a cloud-hosted agent, it provides greater control over where the agent does its work.

But enterprises draw that boundary in different places. For highly regulated organizations and government agencies, self-hosted execution only solves part of the problem. Regulations like DORA, internal security policies, or air-gap requirements can place tighter constraints on third-party cloud services and where different parts of the AI stack can run.

Coder supports both deployment models. Agent Relay brings cloud-hosted agents to self-hosted execution. Coder Agents brings both the agent and execution onto self-hosted infrastructure, including air-gapped environments.

<h2>Today, Coder Agents is generally available</h2>

<a href="https://coder.com/docs/ai-coder/agents">Coder Agents</a> extends Coder’s self-hosted development platform with a fully self-hosted AI coding experience, giving organizations control over where their agent runs, what it can access, and which models it uses.

Developers get the AI coding experience they expect, while enterprises retain choice across the stack. Teams can use the models, MCP servers, skills, and development tools that fit their needs, without giving up control over the infrastructure where agents work. Platform and security teams can centrally govern those choices while keeping the agent and execution environment on infrastructure they control.

<img src="https://www.datocms-assets.com/19109/1787680702-coder-preview.gif" style="max-width:100%; border-radius:5px;" />

Since <a href="https://coder.com/blog/introducing-coder-agents">launching in beta</a>, we’ve focused on making it production-ready with improved agent durability, stabilized APIs for headless background work, deeper RBAC and auditing, and refinements informed by customers deploying it in real-world environments.

We’ve seen customers take Coder Agents beyond the interactive coding experience. During beta, nearly 70% of Coder Agents workloads were invoked through the API, signaling that the future of enterprise agents won’t be limited to developers chatting with them. Agents are increasingly becoming infrastructure for automated development workflows.

Coder Agents is now commercially available as a fully supported enterprise offering.

<h2>Enterprise AI needs an operating layer</h2>

There won&#39;t be one agent, one model, or one deployment model for the enterprise. Some teams will choose cloud-hosted agents with self-hosted execution. Others will require the entire stack to run on their infrastructure. Most large enterprises will likely have both.

The durable infrastructure decision sits underneath those choices.

Organizations need a common foundation for deciding where AI runs, what it can access, which models it can use, and how its activity is governed. That is the <a href="https://coder.com/ai-operating-layer">AI Operating Layer</a>.

Agent Relay extends that layer to cloud-hosted agents. Coder Agents provides a fully self-hosted path. Coder provides the infrastructure underneath both.

That gives platform teams a way to adopt whatever comes next without rebuilding their infrastructure every time developers choose a new agent or model.

<h2>What’s next</h2>

The next chapter of Coder Agents will be written by the customers deploying it in production. We’ll continue investing in the capabilities enterprises ask for: safe deployment, operational simplicity, model flexibility, and a native developer experience.

If you’re already a Coder customer, contact your Customer Success Manager to learn more about Coder Agents. If you’re evaluating self-hosted AI coding for your organization, <a href="https://coder.com/demo">book a demo</a> with one of our solutions engineers. Or <a href="https://coder.com/docs/install">install Coder</a> and see what fully self-hosted AI coding looks like on infrastructure you control.

Coder Agents is now generally available, bringing fully self-hosted AI coding to enterprises and government organizations, including those operating in air-gapped environments. Run both agents and execution on infrastructure you control, with your choice of models and tools and centralized governance.

Coder Agents GA

Coder Agents is GA: Fully Self-Hosted, From Agent to Execution

Discover the latest at the official Coder blog: updates, company insights & AI development infrastructure tips for enhanced developer productivity.

Trusting the Model is Not an AI Security Strategy

Coder Brings Claude Code to Agent Relay, Unlocking Agentic Development for the World’s Most Regulated Enterprises

Coder Agents is GA: Fully Self-Hosted, From Agent to Execution

All posts