Anthropic has opened its self-hosted Claude Managed Agents to customers in private beta, a deployment mode that moves the entire agent platform — the harness, the sandboxes, the credential vault, and session history — into a company's own cloud or on-premise environment. The announcement, published on Anthropic's Claude resources site on November 12, addresses the most common enterprise objection to autonomous agents: that the control plane for software operating on production code and internal systems should not live in someone else's data center.

Managed Agents is Anthropic's suite of composable APIs for building and deploying long-running autonomous agents, providing the agent harness, sandboxes, credential handling, and session history needed to move agents from demos to production. The service first launched as a hosted offering on the Claude Platform, where Anthropic runs the infrastructure, and the company later added self-hosted sandboxes for teams whose code had to stay in their own environment. The new self-hosted mode goes further: customers operate the Managed Agents server, its database, and the workers where agents run their shell and file tools. For more on tools like this and other AI agent platform news, we are tracking the enterprise rollout as it expands.

What Anthropic Is Actually Shipping

With self-hosted Managed Agents, every part of the service runs in the customer's environment. Developers continue building agents with the same core APIs as the hosted version, so code written against the hosted service does not need to be rewritten. Model requests, however, can be routed wherever the customer chooses: directly to Anthropic, through a cloud provider — Anthropic names Amazon Bedrock, Google's Agent Platform, and Microsoft Foundry — or through the customer's own gateway. Session history is stored in the customer's own database, and organizations with zero-data-retention agreements in place with Anthropic get the same treatment for requests sent to Claude as any other Messages API call.

That last detail matters for regulated industries. A bank or hospital deploying an unattended agent can now keep the orchestration layer, the secrets, and the audit trail inside its own perimeter, while retaining the option to route inference through a cloud provider it already has contractual coverage with.

Four Security Principles by Design

Anthropic framed the launch around a set of architectural rules it applies whether it hosts everything, the customer hosts just the sandbox, or the customer hosts the whole service. First, the brain and the hands are split: the harness — the agent loop that calls Claude — stays outside the sandbox where the agent's code runs, and session history lives outside the sandbox as an event log, so an agent does not depend on any single sandbox surviving its whole run. Sandboxes start only when a tool needs them.

Second, credentials stay out of the sandbox. Vaults are designed to keep secrets away from the environment where untrusted code executes, with a proxy outside the sandbox adding credentials to requests for MCP tools and supported API calls. Self-hosting customers can also keep credentials in their own secrets manager. Third, network access can be limited: each environment can be restricted to an allowlist of hosts, so an agent fixing broken builds might reach only the company's git host and package registry. Fourth, every session leaves a full record — each tool call and its result is logged, and records export over OpenTelemetry so agent activity lands in the monitoring systems security teams already run.

Why Enterprises Want the Control Plane On-Prem

The pitch targets a specific problem Anthropic describes bluntly: agents have become capable enough to take on critical work — fixing broken builds, testing releases, triaging alerts, working through bug backlogs — and they run unattended with access to internal systems. At that level of access, Anthropic notes, teams can no longer rely on a person checking every step; the limits have to be built into the system itself.

The last several months of industry reporting have made that caution look justified. AI agents have been implicated in a string of security incidents across the industry, from intrusions into third-party platforms to misconfigured agents exceeding their intended scope, and enterprises have grown noticeably more conservative about where agent infrastructure runs and what it can touch. Self-hosting is Anthropic's structural answer: rather than asking customers to trust a vendor's perimeter, let them extend their own around the whole loop.

One of Three Launches in a Single Day

The private beta was one of three Anthropic product announcements on November 12. The company also introduced Claude for Manufacturing, a plugin with 17 skills and four connectors for drafting quotes, quality reports, and supplier requests, and Claude Meetings, which brings Claude into video calls to begin work during the conversation. The sequence shows a company pushing hard on enterprise workflow depth across industries and job functions — with the IPO window approaching later this month, the strategy is to make Claude the layer where enterprise work actually happens, not just a chat window beside it.

Access to the self-hosted beta runs through Anthropic account teams, so the general availability timeline remains unclear. But the direction is plain: as agent platforms compete for enterprise deployments, the vendor that lets customers keep the brain, the hands, and the paper trail inside their own walls has removed the last structural excuse not to deploy.

---

Stay Ahead of AI

Get the latest AI news, analysis, and breakthroughs — all in one place.

Read more AI news →