The setup. Engineering at a 300-person fintech ships a Claude Code workflow that runs against production AWS. The agent has STS-issued credentials to read CloudWatch logs, read X-Ray traces, and write to a specific S3 bucket for diagnostic artifacts. The session is started by an engineer through a Slack bot that authenticates with their corporate SSO. The intent declared at session start is "investigate customer-reported latency in the payments service."
This post walks STRIDE through that scenario. For each category: the attack, the controls that catch it (native and added), the residual risk, and the action item.
The point isn't to prove that Claude Code is unsafe or that AWS is unsafe. Both have strong primitives. The point is to see what the strong primitives catch, what they don't, and where intent-bound runtime evaluation adds something the native layer can't.
Spoofing
The attack. An attacker who has compromised an engineer's laptop attempts to start a session impersonating the engineer. Or a prompt injection inside log data the agent retrieves causes the agent to act as if a different user instructed it.
What catches it. SSO with phishing-resistant MFA on the human side (FIDO2 or passkey; SMS doesn't meet Anthropic's Foundation bar). Per-agent identity from the IdP, hardware-bound where possible. CloudTrail entries that distinguish the agent's STS session from any other session. Intent-bound sessions add the second pass: even if the agent has the right credential, the declared session intent has to align with the action being taken.
Residual risk. A prompt injection that successfully recasts the user's intent. The credential checks all pass; the agent acts on instructions that came from data, not from the user. Runtime evaluation against the original declared intent is the control that catches this. Native Claude Code primitives don't ship with intent semantics by default.
Action. Bind sessions to declared intent. Block actions that don't align with intent even when the credential authorizes them.
Tampering
The attack. An attacker modifies the agent's configuration, the MCP server's tool definitions, the prompt template, or the audit logs after the fact. Or a man-in-the-middle on the agent's outbound calls swaps the request payload.
What catches it. Claude Code's ConfigChange hook fires on settings changes, allowing organizations to audit or block. MCP servers signed and self-hosted on immutable infrastructure. Mutual TLS with certificate pinning on agent-to-service connections (Anthropic Enterprise tier). CloudTrail with log-file validation enabled. S3 buckets with object lock for audit storage.
Residual risk. An attacker with admin on the host where Claude Code runs can modify what runs before the ConfigChange hook fires. Hardware-rooted attestation (TPM-backed identity, confidential computing) is the control at the Advanced tier; most teams won't have it yet.
Action. ConfigChange hooks on settings.json. Sign and verify MCP servers. Object-locked audit log storage. Treat the agent host as a sensitive endpoint with its own posture requirements.
Repudiation
The attack. After an incident, the chain of custody can't be reconstructed. The agent did something. Nobody can say who triggered it, what intent was declared, what the agent attempted vs. what completed, and whether any actions were blocked along the way. The three indistinguishable scenarios Kane Narraway named (the attribution gap) hold: user directly, user-instructed agent, or hallucinating agent. All look identical in the log.
What catches it. CloudTrail with request IDs propagated through every downstream call. Claude Code's session.id, user.account_uuid, and organization.id attribution on all telemetry events. Distributed tracing across the agent's tool calls (Anthropic Enterprise tier; Claude Code supports OpenTelemetry). Intent declared at session start, recorded in the audit log, propagated through to every action.
Residual risk. Actions that complete before evaluation catches up. The log shows the action and the block (or the absence of a block) but not necessarily the latency between the two. Dwell time matters here.
Action. Capture session intent in the audit pipeline. Propagate request IDs from the human prompt through to the API call. Ship full provenance chains if the agent is in a regulated workload (HIPAA, FINRA, the EU AI Act in some jurisdictions).
Information disclosure
The attack. The agent reads more data than the task required. Or it returns sensitive content in its response that gets logged downstream. Or it exfiltrates data through a side channel: a tool call that posts to an external endpoint, an "uploaded image" that becomes a public Imgur link, a "summary" that ends up in a third-party MCP server's context.
What catches it. STS session policies that scope the credential to the minimum (specific buckets, specific log groups, time-bounded). Tool allow-listing at the agent: capability restrictions on what an "email" tool can do, what a "file write" tool can do. Output filtering for PII patterns. Network request approval for outbound calls.
Residual risk. Approved tools used in unintended sequences (the tool chaining attack Anthropic names: secure internal tool + external email tool = exfiltration neither would expose alone). The MCP server's context store is owned by whoever runs the MCP server; your retention policy may not extend there.
Action. Allowlist tools explicitly. Validate parameters with PreToolUse hooks. Constrain network egress at the runtime. Inventory which MCP servers retain context outside your control and either retire them or self-host.
Denial of service
The attack. An agent caught in a loop hits a billable API thousands of times. A resource exhaustion attack from prompt injection: a malicious comment in a Jira ticket the agent reads instructs it to invoke a costly action repeatedly. The bill arrives at the end of the month.
What catches it. Rate limits at the API. Circuit breakers in the runtime. Spending caps at the AWS account level. Anthropic's note on this is sharp: rate limits are friction, not barriers, and a determined attacker grinds through them. The hard control is the circuit breaker that halts.
Residual risk. The cost of the attack is bounded by the circuit breaker, but the time to detect and stop is the dwell time. For a $0.001-per-call API hit in a tight loop, the bill can run six figures inside an hour.
Action. Set hard limits at the AWS account level (Service Quotas, Budgets with hard actions). Pair with PreToolUse hooks that count and halt. Page on the threshold, don't just throttle.
Elevation of privilege
The attack. The agent attempts an action outside its declared scope. A debug session tries to write where it was supposed to read. A sub-agent receives a "valid-looking" instruction from a peer agent and executes it without checking original intent (the confused deputy Anthropic describes). A retired agent's credential is still active and gets used.
What catches it. STS session policies bound to the task. IAM conditions on the credential (time-of-day, source IP, MFA-required for sensitive actions). Per-agent identity with no shared credentials. Sub-agents that inherit a constrained slice of the parent's intent, not the full envelope. Intent-bound runtime evaluation: actions outside the declared session goal are blocked even when the credential authorizes them.
Residual risk. The agent attempts an action that's borderline. The runtime has to make a judgment call: block, allow, or route to a human. Get this wrong in either direction and you have either friction or a breach.
Action. Per-agent credentials, never shared. Sub-agent identity with its own permissions, not just inherited from the parent. Intent-bound evaluation that distinguishes "agent has permission" from "agent should be doing this right now."
What the native layer catches vs. what's left
Claude Code and AWS together close most of the controls. Settings.json with deny-by-default, PreToolUse hooks for parameter validation, ConfigChange hooks for tamper detection, sandboxed execution at the OS level, session isolation, OpenTelemetry attribution. STS for scoped credentials, IAM conditions for context-aware authorization, CloudTrail for audit, Service Quotas for hard limits.
What the native layer doesn't catch:
- The semantic check that this action aligns with the session's declared intent.
- The chain of custody from human prompt to API call across all the layers (the audit log captures the AWS call; the prompt that triggered it is somewhere else).
- The case where the credential is valid, the action is permitted, but the intent has drifted.
- The retired agent whose credentials are still live because the offboarding flow didn't include the agent identity.
Each of these is where intent-bound governance sits. The runtime layer above the credential and below the API gateway. The Claude Code agent has tool X; the session intent is Y; the action is evaluated against Y; out-of-scope actions are blocked or routed for approval regardless of whether tool X would otherwise permit them.
What to do this week
Pick the agent in your environment with the largest blast radius. Walk it through these six categories. For each, write the attack, the control that catches it, and the residual risk. The exercise takes an afternoon. The output is a one-page artifact that lets you talk to the CISO about agent risk in a structure they recognize.
Most teams will find two or three categories where the native primitives close the attack cleanly, two or three where they catch most of it but leave a clear residual, and one where the gap is wide enough to warrant a separate project. The intent-bound layer is usually where the wide gap is.