Anthropic has put Self-hosted Claude Managed Agents into private beta. Until now there were two tiers: the hosted service on the Claude Platform, where Anthropic runs the infrastructure, and self-hosted sandboxes for teams whose code cannot leave their own environment. Now the entire service runs on your side.
Managed Agents is Anthropic’s kit for agents that run long and unattended: the harness, sandboxes, credential handling, and session history. What changed is the kind of work. Anthropic names fixing broken builds, testing releases, triaging alerts, and working through a bug backlog. Some teams do not want agents with that level of access sitting half outside the company, and until now that meant building the platform yourself.
What runs on your side, and where the requests go
In your cloud or on your own servers: the harness, sandboxes, credentials, and session history. You operate the Managed Agents server, its database, and the workers where agents run their shell and file tools.
Model requests go wherever you want them. Straight to Anthropic, to your cloud provider — Amazon Bedrock, Google’s Agent Platform, or Microsoft Foundry — or into your own gateway. Anthropic is the default. If your organization has zero data retention in place, it applies to these requests the same way it applies to any other Messages API call. Your developers keep building agents with the same core APIs as in the hosted service.
Four principles Anthropic built into the architecture
They hold across all three ways of running it, whether Anthropic hosts everything, you host only the sandbox, or you host the whole service.
The brain and the hands are split. The harness calls Claude, the sandbox runs the agent’s code. The agent loop, session history, and vault secrets stay outside the sandbox. A sandbox only starts when a tool needs it, and no agent depends on one sandbox surviving its entire run.
Credentials stay out. For MCP tools and supported API calls, a proxy outside the sandbox adds the credential to the request. When you self-host, you can keep those credentials in your own secrets manager.
Network access can be fenced in. Per environment you set a list of allowed hosts and everything else is blocked. For an agent that fixes broken builds, that list might be exactly two entries: your git host and your package registry. Host the sandbox yourself and you set the same limits in your own firewall.
Every session leaves a complete record. Managed Agents keeps every step, including the tool calls and what came back from them. The record exports over OpenTelemetry, so the agents show up in the same monitoring tools as the rest of your systems.
Who this is for
Access runs through your Anthropic account team. Anthropic names no price, and the operating load is the real one: server, database, and worker fleet all run on your side, updates included.
This is aimed at the companies that would otherwise have built it themselves
Anthropic describes the path from outside to inside in three steps, and each one arrived after somebody asked. The demand here is easy to see: banks, insurers, and public agencies will not let an agent work unattended in their code while the loop, the credentials, and the record sit with a third party. The interesting part is the pace. Anthropic is rebuilding the enterprise variant fast enough that building it yourself turns into the comparison offer, and a week before the IPO that is no accident.