Claude Code lets Claude work out cloud environment setup; Anthropic says API keys are stored without Claude seeing them

Claude decides what dependencies and API keys are needed

Anthropic announced on its official X account on Nov. 6 (Nov. 7 Japan time) that it had made it easier to get a repository running in cloud sessions of its AI coding tool "Claude Code." Cloud sessions are a feature that runs Claude Code on a virtual machine in the cloud instead of the user's computer. According to the post, Claude determines the components (dependencies), network access and API keys needed to run it, and saves that environment for next time. It is available on the Pro, Max and Ultra plans, and the company says API keys are stored securely and Claude does not see them.

In the roughly 22-second official demo attached to the post, after the first run Claude says it needs Python dependencies, access to api.example.com and a key for a weather API, and proposes an environment with a saved setup script. A confirmation reading "Create new environment?" appears on screen, showing permission for api.example.com and running "pip install -r requirements.txt," and the user chooses to decline or create. According to the note, approving creates the environment and moves the session to it, and the current environment's credentials stop being used, but the machine and files are kept. When the user in the demo approves, a dedicated form for the key opens, and a Bearer token is entered as masked text and saved. The app then starts on port 5000 and a preview is displayed.

Official documentation as of Nov. 7 did not appear to describe a procedure in which Claude determines and saves the environment.

Official documentation describes a user-configured procedure

According to official documentation, an environment for cloud sessions is a saved configuration that bundles the scope of network access, environment variables and a script run at startup. The "Default" environment provided at first can only connect to approved destinations, such as major package registries, and contains no environment variables or scripts. When something is missing, the procedure is for the user to edit the environment and add destinations, variables or scripts.

Part of the mechanism for saving environments also existed before this post. If the startup script finishes within about 5 minutes, Anthropic saves the state of the files, and the next session starts from that state. If it takes longer than about 5 minutes, nothing is saved, and the saved state is rebuilt after about 7 days. Whether the saving for next time in this announcement is the same mechanism cannot be determined from the post and video.

Keys attached to traffic outside the virtual machine

The text of the post only says keys are "saved securely" and does not describe the mechanism. The save screen in the video explains that the key is stored in the session's environment, that Claude never sees it and that it is sent only to api.example.com. Both are official explanations, and no material independently verifying the security of the implementation has been found. What official documentation describes as used without being seen is a feature called "network secrets," which registers API keys and tokens with the environment. Anthropic's relay server (proxy) attaches the key after traffic leaves the virtual machine, so the key stays outside the virtual machine, it says. According to the documentation, the key does not appear in the session's environment variables or files, and once saved, even the user cannot display the value again.

Anthropic also described the approach of attaching keys outside the virtual machine in an official blog post on Oct. 6. The note in the video overlaps with the description of network secrets, but whether keys saved through this procedure are treated as the same feature could not be confirmed in the documentation.

"Not seen" comes with conditions on environment and destination

The documentation sets out conditions on what network secrets can protect. Keys the proxy cannot attach to traffic remain in environment variables, and environment variables and startup scripts can be read by anyone who uses that environment. Keys are attached only to traffic to specified destinations, and not to GitHub, Anthropic's API, major public package registries or traffic from startup scripts.

Claude does not see the key's value but can make API calls that use it. The specified destinations can be reached regardless of the environment's network settings, and the key applies to sessions started by anyone. The save screen in the video also notes that if the environment is shared, every session in that environment, including other people's sessions, uses the key and can connect to api.example.com. The feature is not available in environments companies run on their own servers, and organizations that manage their own encryption keys cannot store keys.

Post names three plans: Pro, Max and Ultra

The post names Pro, Max and Ultra as eligible, and does not say when the rollout began or whether it is being rolled out in stages. Pricing is $17 a month billed annually or $20 a month billed monthly for Pro, $100 a month for Max and $200 a month for Ultra. There is no separate charge for cloud virtual machines; usage counts toward plan limits.

Cloud sessions and network secrets are also available on Team and Enterprise. On Enterprise, users with premium seats, among others, are eligible. The post does not mention these two plans, and whether they are covered by this procedure has not been confirmed. Organizations using Zero Data Retention settings, which do not retain data, or HIPAA configurations cannot use cloud sessions.

Cursor passes secrets as environment variables, Codex deletes them before work

Other companies are also working on environment setup for cloud-based AI coding tools. U.S.-based Cursor's documentation says the agent installs dependencies, verifies that things work and saves the environment after success, and that setup takes less than 10 minutes. Secrets are passed to the agent as environment variables.

OpenAI's Codex can automatically install dependencies for projects that use common package managers. Secrets can be used only in the startup script and are deleted before the agent starts work. Tech outlet RuntimeWire reported on Sept. 20 that an analysis of Codex's production build had found an unreleased flow for drafting environments through conversation and a mechanism for passing secrets through a proxy. The analysis was only partly reproduced, and it is not an OpenAI announcement.