Self-hosted Claude Managed Agents enter private beta

Anthropic now lets teams run every part of Claude Managed Agents in their own cloud or on-premise, harness, sandboxes, credentials and session history included, under a private beta announced in a November 13 post on Claude. Teams that could self-host only the sandbox can now keep the whole service inside their perimeter without building that platform themselves. Two limits apply: model requests still leave for Anthropic, a cloud provider or a gateway the team runs, and access is by request through the Anthropic account team.

Anthropic is aiming this at agents that run unattended on company code with access to internal systems: fixing broken builds, testing releases, triaging alerts, working through a bug backlog. In the self-hosted mode you operate the Managed Agents server, its database and the workers where agents run their shell and file tools. Model calls can go to Anthropic directly, Amazon Bedrock, Google’s Agent Platform, Microsoft Foundry or your own gateway. Developers build with the same core APIs as on the hosted service. Session history sits in your database, and if your organization has zero data retention (ZDR) with Anthropic, it covers the requests sent to Claude the same way it covers any other Messages API call.

Which controls move in-house

Managed Agents is built on four security principles, and Anthropic says they hold in every mode: when it hosts everything, when only the sandbox is yours and when the whole service is. The first keeps the harness, the loop that calls Claude, apart from the sandbox where the agent’s code runs. The agent loop, session history and vault secrets stay outside the sandbox. Sandboxes start only when a tool needs one, and because the session lives outside as an event log, a run doesn’t depend on a single sandbox lasting to the end.

Credentials also stay out of the sandbox. For MCP tools and supported API calls, a proxy outside the sandbox attaches the credential to the request. The self-hosted version adds one option here: you can keep those credentials in your own secrets manager.

Each environment can be limited to an allowlist of hosts, and requests to any other host are blocked. When you host the sandbox, you set those limits in your own firewall. Anthropic’s example is an agent that fixes broken builds, whose list might hold just the git host and the package registry.

Every session is recorded step by step, including each tool call and what it returned. That record exports over OpenTelemetry, which Managed Agents gained in a public beta in October, so agent activity can go to the monitoring tools a team already runs, next to the rest of its systems.

What the beta lacks

Nothing carries over from the hosted service, TNW reports, so agents and saved data have to be rebuilt on the new server. Webhooks and scheduled runs are also missing, which for now makes the self-hosted beta the thinner of the two products for a team that relies on either.

The work of running the service moves in-house as well. Customers take on jobs Anthropic used to do, such as securing and updating the server, the outlet says.