Managed Agents goes fully self-hosted in private beta

Anthropic on November 12 opened a private beta of self-hosted Claude Managed Agents, where the harness, sandboxes, credentials and session history all run in a company’s own cloud or on-premises. Teams that wanted the whole agent service inside their own environment no longer have to build that platform themselves, though the beta is open only to eligible orgs, which request access through their Anthropic account team.

Until now the closest option was self-hosted sandboxes: the agent’s code ran on your side while the rest of the service stayed on the Claude Platform. Under Anthropic’s announcement, the new mode makes you the operator. You run the Managed Agents server, its database and the workers where agents run their shell and file tools. Model requests go where you send them, whether that is Anthropic directly, Amazon Bedrock, Google’s Agent Platform, Microsoft Foundry or your own gateway, and developers keep building agents with the same core APIs as the hosted service.

Session history is stored in your database. If an organization has a zero data retention (ZDR) agreement with Anthropic, it covers the requests sent to Claude the way it covers any Messages API call.

Anthropic pitches the mode at agents that run unattended on your code and need your internal systems: fixing broken builds, testing releases, triaging alerts, working through a bug backlog.

Four rules in every setup

Anthropic says four design rules apply whether it hosts everything, you host only the sandbox, or you host the whole service:

• The harness, the loop that calls Claude, is kept apart from the sandbox, where the agent’s code runs. The agent loop, session history and vault secrets stay outside the sandbox, and sandboxes start only when a tool needs one, so a run doesn’t depend on one sandbox surviving to the end.
• Credentials stay out of the sandbox. For MCP tools and supported API calls, a proxy outside it attaches the credential to the request, and self-hosted deployments can also keep credentials in their own secrets manager.
• Each environment can be limited to a list of allowed hosts, and requests anywhere else are blocked. For an agent that fixes broken builds, Anthropic’s example list is just your git host and your package registry; when you host the sandbox, you set the same limits in your own firewall.
• Every session leaves a full record of the agent’s steps, including each tool call and what it returned. The record exports over OpenTelemetry into the monitoring you already run.

From one container

Managed Agents launched in public beta on the Claude Platform on April 8, priced at standard token rates plus $0.08 per session-hour. A price for the self-hosted version has not been given.

The split between harness and sandbox began as an engineering fix. In an Anthropic engineering post, the company says it first put the session, the harness and the sandbox in a single container, and when that container failed, the session was lost. Because the harness assumed Claude’s work lived in the same container, customers who wanted Claude connected to their virtual private cloud had two choices: peer their network with Anthropic’s, or run Anthropic’s harness in their own environment. The private beta now ships that second route as Anthropic’s own product, with the database and credentials on the customer’s side as well.

Portability is the open complaint. Weilun Chen of Stealth said of Managed Agents that “this is a lock in into their SDK and their format” and argued that the trajectory definition should be open source, InfoQ reported.