Member-only story
Part 10: It has a shell, a memory, and untrusted input pointed straight at it. Hosting the Claude Agent SDK is a question of architecture and isolation, not “where do I put the function.” #
You know how to ship an LLM feature. An agent breaks every assumption you brought with you, and the failure mode is not a bad response, it is your customer data leaving the building. An AI agent is not a stateless function. It is a long-running process with a shell, a filesystem, and untrusted input pointed at it, so deployment is a question of architecture and isolation, not just where you host the function.
In this article: You will learn why an AI agent built on the Claude Agent SDK cannot be hosted like a stateless function, the three container lifecycle patterns that cover almost every real deployment, and a practical isolation ladder, from a five-minute sandbox to a hardened container to per-agent microVMs. By the end you will understand prompt injection as a deployment threat, and the one architectural move, a proxy the agent cannot bypass, that makes it survivable.