Anthropic launches self-hosted Claude Managed Agents in private beta

Bringing AI into the perimeter

Anthropic has introduced self-hosted Claude Managed Agents, a new way for organizations to deploy autonomous AI agents. While the service was previously only available as a hosted offering on the Claude Platform, this new version gives companies more control over their infrastructure. It is currently available in a private beta for eligible users.

The primary goal of this release is to accommodate teams that need their code and data to remain strictly within their own environments. Many companies are beginning to use agents for critical tasks, such as fixing broken builds, triaging alerts, and working through bug backlogs. Because these tasks require access to internal systems, many organizations require the entire service to reside on their own hardware or private cloud.

With this update, companies no longer have to build the underlying platform themselves from scratch. They can now host the Managed Agents server, its database, and the workers where the agents actually execute their shell and file tools. This provides a middle ground between using a fully managed cloud service and building a custom internal solution.

Architecture of the 'brain' and 'hands'

The architecture of Managed Agents is built on a core principle of separating the 'brain' from the 'hands.' The harness acts as the brain, which communicates with the Claude model to make decisions. In contrast, the sandbox serves as the hands, which is the isolated environment where the agent's actual code is executed.

By keeping these two components separate, Anthropic ensures that an agent does not depend on a single sandbox surviving for its entire run. Sandboxes are only started when a specific tool is needed, and the session history is kept as an event log outside of that sandbox. This design prevents the agent's execution environment from becoming a single point of failure or a source of persistent data leakage.

Security is further reinforced by keeping credentials out of the sandbox environment entirely. The system uses Vaults to manage secrets, where a proxy outside the sandbox adds the necessary credentials to the request. For organizations using self-hosted versions, this means they can also choose to store their credentials in their own preferred secrets manager.

Customizable data and networking

One of the most significant features of the self-hosted model is the flexibility regarding data flow and network access. Organizations can choose exactly where their model requests are sent. They can route them directly to Anthropic, or through cloud providers like Amazon Bedrock, Google's Agent Platform, or Microsoft Foundry.

Networking can also be tightly restricted to meet specific security requirements. Each environment can be limited to a whitelist of allowed hosts, which blocks requests to any other host. For example, an agent designed to fix broken builds might be restricted so it can only communicate with a specific git host and a package registry.

Data retention is another key consideration for enterprise users who have strict compliance needs. If an organization has zero data retention (ZDR) in place with Anthropic, that policy applies to the requests sent to Claude in the same way as any other Messages API call. This ensures that the behavior of the agents remains consistent with the company's broader data privacy rules.

Monitoring and production readiness

Moving agents into production requires a high level of visibility into how they behave. Managed Agents addresses this by keeping a full record of every step an agent takes. This includes a log of every tool call the agent makes and the specific response it receives from that tool.

To make this data useful for IT teams, the records are exported over OpenTelemetry. This standard allows companies to send agent activity logs to the monitoring tools they already use. By doing this, developers can review agent actions alongside the rest of their system's telemetry, making it easier to debug issues or audit performance.

Because the system provides the agent harness, sandboxes, and credential handling, it is designed to get long-running agents into production more reliably. Developers can still use the same core APIs they would use with the hosted service, making the transition to a self-hosted model smoother for engineering teams. The goal is to provide a robust framework that handles the complexities of autonomous execution while giving the user full ownership of the infrastructure.