Anthropic Indemnity and AGPL Code Fetched by Claude Code

Indemnity transfers financial risk; it does not prevent the event

A copyright or IP indemnity is a promise by a vendor to defend or compensate a customer for certain third-party claims, within defined limits. It does not stop copyleft code from entering your repository, and it does not change your licence obligations once it is there. For a regulated enterprise, that distinction matters. A claim can be indemnified and the obligation to disclose source or remove code can still exist.

NIST AI RMF 1.0 names the risk of infringing a third party's intellectual property or other rights as one of the risks tied to third-party AI entities. The NIST Generative AI Profile, which appears in draft form as of November 2026, suggests that third-party contracts and service agreements may carry GenAI-specific indemnity clauses. Both support a reasonable position: review the indemnity wording, and treat it as one control among several.

Indemnity language is typically organised around three things: the covered service, the output that service produced, and the customer's conduct. Each of the three is a place where an agentic session can sit awkwardly.

Why fetched AGPL code is not the same as generated output

When a model generates code from a prompt, the question is about output. When an agent uses a tool to retrieve a file, snippet or repository from the web, the question changes. The retrieved material is an input to the session. The agent may then copy it verbatim, adapt it, or combine it with other code. Whether the result counts as indemnified output is a question of definitions in your agreement, and it is the first thing counsel should test.

Several conditions commonly found in indemnities could be relevant here: modification or combination of output, use outside the agreed terms, knowing infringement, and customer-supplied inputs. An instruction that tells the agent to fetch and use a specific upstream file may be read differently from an open-ended generation request. Whether any of these conditions applies is a matter of the contract text and its interpretation, not something this guide can settle.

There is also a plain operational point. Even if a clause turned out to cover a given case, your team would still need to show what the agent fetched, where it came from and what licence applied. Indemnity processes generally expect the customer to be able to describe the facts.

AGPL in plain technical terms

The GNU Affero General Public License is a strong copyleft licence. Like the GPL, it conditions distribution of derived works on making corresponding source available under the same licence. Its distinguishing feature is aimed at network services: if you modify AGPL-covered software and let users interact with it over a network, the licence can require you to offer those users the source of your modified version, even without a conventional distribution.

That matters for internally developed, network-served software. A permissive licence such as MIT or Apache 2.0 typically asks for notices and attribution. AGPL can reach a hosted application, an internal portal or an API that incorporates the code, depending on how the code is combined and used. Whether a particular integration creates a derived work is a legal judgement and should go to counsel.

AI coding assistants make this harder to see. A developer who adds an AGPL library sees a dependency entry. An agent that pastes fetched code into a file leaves no manifest line, no package name and no licence header unless the source file carried one.

What only runtime controls can address

Contract review cannot tell you what entered a repository last Tuesday. That is a runtime question. The NIST Generative AI Profile draft lists transparency mechanisms that track the origin of data and generated content, along with auditing and validating those mechanisms. For coding assistants, extending that idea to fetched sources is an inference, but a practical one: record where code came from, what licence it carried and what the agent did with it.

The second runtime need is a decision point before commit. Detection after the fact leaves AGPL material in history and in downstream builds. A control in the path can allow clean code, block known copyleft material, or escalate ambiguous cases to a human for approval.

Agent-side trust decisions are also not sufficient by themselves. CVE-2026-21852 is a reminder: in Claude Code versions before 2.0.65, a flaw in the project-load flow let malicious repositories exfiltrate data, including Anthropic API keys, before the user confirmed trust. It is unrelated to licensing, but it shows that confirmations inside the agent can occur too late. Confirm your deployed versions are at 2.0.65 or later, and place enforcement outside the model.

Where Trussed fits

Trussed is control, provenance and evidence infrastructure for consequential AI. It does not replace contract review or indemnity. It addresses the runtime half of the checklist above.

Trussed enforces policy in the execution path on coding assistant interactions and tool calls. Policy can allow, redact, block, rate limit or escalate for human approval, and it is enforced at runtime, not reviewed after the fact. Code provenance records the origin, licence and security context of code, so a decision about AGPL material rests on recorded facts. Enforcement produces audit-ready evidence that a regulated enterprise can show to counsel, auditors or a regulator, and it can be deployed self-managed in your own cloud with configurable retention and data residency.