Anthropic announced on 12 November, in an article and on its ClaudeDevs account on X, that customers can now host Claude Managed Agents themselves. Help Net Security reported on the company’s announcement the same day.

Managed Agents is Anthropic’s set of APIs for building autonomous AI agents and running them in production. It includes sandboxes, credential handling, session history and the harness, the program that steers the agent, gives the model its tools and runs its steps. Until now, Anthropic ran the service. Customers could host only the sandbox in which the agent’s code runs.

Now the customer runs the Managed Agents server, its database and the workers where agents run their shell and file tools. The database is PostgreSQL, Help Net Security reported, and the architecture diagram in Anthropic’s announcement shows the same. Session history is stored in this database. Agents are built with the same core APIs as in the service Anthropic hosts.

Anthropic cites fixing failed builds and triaging alerts as example uses. In such work the agent needs access to the company’s code and internal systems.

The model still runs outside the network

Customers choose where model requests go: directly to Anthropic, to Amazon Bedrock, Google’s Agent Platform or Microsoft Foundry, or to their own gateway. Help Net Security noted that Claude itself still runs outside the customer’s network. Prompts go out and completions come back. The company’s diagram shows the same boundary. If an organisation has a zero data retention (ZDR) agreement with Anthropic, under which request data is not retained, it covers these requests as it does other Messages API calls.

Credentials stay outside the sandbox

The agent’s code runs in a sandbox, Anthropic said. Outside it are the agent loop, the session history and secrets stored in a vault. A proxy outside the sandbox adds the credential to the request, but only for MCP tools and supported API calls. Help Net Security therefore advises reviewing the other services the agent connects to before deployment. Customers who host the service themselves can keep credentials in their own secrets manager.

Each environment can be limited to a list of allowed hosts, and other connections are blocked. Customers using their own sandbox set these restrictions in their own firewall. Every agent step is logged with its tool calls and results, and the logs can be exported via OpenTelemetry to the customer’s own monitoring tools. The customer is responsible for updating and correctly configuring the server, database and firewall rules, Help Net Security said.

Self-hosted Managed Agents is in private beta and available only to eligible organisations. Organisations request access through their Anthropic account team.