Anthropic launches self-hosted Claude Managed Agents for corporate use

Moving agents inside the perimeter

Anthropic recently introduced a self-hosted version of its Claude Managed Agents service. This release is designed for corporate AI operations where keeping data and credentials within a private network is a priority. As helpnetsecurity.com reported, the option opened as a private beta on November 12 for customers who request access through their account team.

Previously, customers could host their own sandboxes, which are isolated environments where an agent's code actually runs. However, Anthropic still managed the rest of the infrastructure, including the handling of credentials and the records of every action the agent took. This meant that teams needing a fully internal platform had to build the entire system themselves from scratch.

The new self-hosted model changes this dynamic by allowing companies to run the entire agent harness, the sandboxes, and the session history on their own hardware. This is particularly important for agents that work unattended to perform tasks like testing releases or working through bug backlogs. It provides a middle ground for organizations that want the convenience of Anthropic's managed tools without sacrificing control over their internal data.

How the self-hosted architecture works

In this new setup, the customer is responsible for operating three main components: the Managed Agents server, a PostgreSQL database, and the workers. The workers are the specific units where agents execute their shell and file tools. The PostgreSQL database is where the session history, which records what each agent did, is stored locally.

Developers can still build agents using the same core APIs provided by the hosted service. A key distinction is where the model requests are sent. Customers can point these requests to Anthropic directly, or to other platforms like Amazon Bedrock, Google’s Agent Platform, or Microsoft Foundry. Even in this setup, the Claude model itself still runs outside the customer's network, meaning prompts go out and completions come back.

For organizations with zero data retention (ZDR) agreements with Anthropic, these requests are treated the same as standard calls to the Messages API. This is the standard interface Anthropic uses for model requests. This means that while the management and history stay local, the actual processing of the text still involves an external connection to the model provider.

Security principles and credential safety

Anthropic built Managed Agents around four specific security principles that apply regardless of who hosts the environment. The company argues that because teams cannot monitor every single step of an unattended agent, the limits must be built into the system itself. One primary principle is the separation of the harness, which calls the model, from the sandbox where the agent's code actually runs.

The agent loop, session history, and vault secrets are kept outside of the sandbox. A sandbox only starts when a specific tool needs to be used. To keep credentials safe, a proxy located outside the sandbox attaches the necessary credentials to the request. This ensures that the agent's code inside the sandbox never has direct access to the underlying secrets.

Self-hosted customers can keep these credentials in their own secrets manager. However, Anthropic notes that this specific protection is limited to MCP tools and supported API calls. If an agent needs to reach any other service that is not supported, the organization must manually check that connection before letting the agent go live. This ensures that the most sensitive parts of the system remain isolated from the execution environment.

Monitoring and firewall controls

To further secure the environment, each setup can be locked down using an allowlist of permitted hosts. This means the system can block requests to any host that is not explicitly approved. For example, an agent designed to fix broken builds might only be allowed to communicate with a specific git host and a package registry.

The responsibility for enforcing these limits falls on the customer who hosts the sandbox. They must configure their own firewalls to ensure the allowlist is correctly implemented. This gives the organization granular control over where their AI agents can

Responsibilities for the customer

While the self-hosted option provides significant privacy benefits, it also shifts the burden of maintenance to the customer. The organization is now responsible for running the server, the database, and the firewall rules. This includes the ongoing task of keeping all of these components patched and correctly configured to prevent security vulnerabilities.

This shift is aimed at high-security environments where the