On November 12, Anthropic announced self-hosted Claude Managed Agents, now in private beta. The pitch is that you run the whole Managed Agents service in your own cloud or on-premise: the harness, the sandboxes, the credentials, and the session history. Developers still build agents with the same core APIs as the hosted service, the company says, and those agents can work in a company’s code and internal systems.
That’s a control-plane story, not a “nothing ever leaves” story. Anthropic is explicit about where model requests go.
What you host, and what still leaves
You operate the Managed Agents server, its database, and the workers where agents run their shell and file tools, the article says. Model requests go where you choose: Anthropic directly, Amazon Bedrock, Google’s Agent Platform, Microsoft Foundry, or your own gateway.
The platform docs have a section titled “What leaves your network.” For each model call, the server sends the conversation so far, including tool inputs and tool results, to your inference provider. By default, that’s the Claude API. A call to the Claude API also carries the IDs of the session and of that session’s agent and environment.
If your organization has zero data retention (ZDR) in place with Anthropic, the article says it applies to those requests the same way it does to any other Messages API call. That’s a policy on retained copies, not a claim that the conversation stays inside your perimeter.
Anthropic also describes a split between the harness — the “brain” that calls the model — and the sandbox, where the agent’s code runs. Vaults are designed to keep credentials out of the sandbox, the company says. You can limit an environment to a list of allowed hosts, and every session is supposed to leave a full record that can export over OpenTelemetry. Those are Anthropic’s design claims. I haven’t run the stack.
Limits I’d keep in that column
It’s a private beta. Access is through your Anthropic account team, not a self-serve download on the public site.
You run and secure the server, its database, and your sandboxes, and you install each release yourself, the docs say. Some features exist only on the hosted service. The differences page lists gaps that include webhooks and scheduled deployments, and it tells you to check that list before you move an application over. Nothing is copied from the hosted service, session history included — you’d create agents again on your server.
The agent’s bash tool is a real shell with the worker process’s permissions and network access. The worker doesn’t isolate that shell. Isolation comes from what you run the worker in — a container or a VM, the docs say, that holds nothing you need to protect.
Without a database, the server keeps its data in memory, and a restart erases it. The docs call for PostgreSQL 16 or later.
What I’d check before leaning on it
- Treat this as a private beta, not a general-availability launch. The only access path Anthropic names is your account team.
- Read “What leaves your network” before you treat it as a perimeter story. Session history can live in your database and the model call still sends the conversation so far to a provider.
- Check the differences list for anything your agents already use on the hosted service, including webhooks and scheduled runs.
- Decide who secures the server and how workers are isolated. The docs put that on you, and they don’t treat the
bashtool as a sandbox by itself.
If you’ve been waiting for the agent loop and the session history to live on your infrastructure, this is the option Anthropic is opening. I’d still start with the outbound-call section, not the “in your own environment” headline.
Documentation: Self-hosted Claude Managed Agents.
Hero photo: Lock No. 38 on the Ohio and Erie Canal by Louise Taft Cawood, Historic American Engineering Record / Library of Congress, via Wikimedia Commons; public domain (U.S. federal government work); cropped and resized.
