Operate Claude Managed Agents inside your security perimeter

Here it is:

Anthropic has opened a private beta for self-hosted Claude Managed Agents, letting development teams run the full Managed Agents service inside their own cloud or on-premises infrastructure instead of relying on Anthropic-hosted compute. The company previously offered Managed Agents only as a hosted platform service and later added self-hosted sandboxes, but the control plane, credential storage, and session history still lived on Anthropic's side. With this release, every component — the agent harness, sandboxes, credentials, and session history — stays within the customer's security perimeter, according to Claude Blog's report.

This piece walks through what changed in the Managed Agents architecture, how a self-hosted deployment works, where model requests can be routed, how data residency and zero data retention fit in, and who stands to gain. It is aimed at platform engineers, DevOps leads, and security teams evaluating whether to move autonomous agents into their own infrastructure.

01From hosted sandboxes to a full on-premises control plane

Managed Agents launched originally as a hosted service on the Claude Platform, where Anthropic ran all the infrastructure. For organizations whose code had to stay on their own machines, Anthropic then added self-hosted sandboxes — the execution environment moved in-house, but the orchestration layer remained on Anthropic's servers. Self-hosted Claude Managed Agents removes that last external dependency.

Every part of the service now runs in the customer's own environment. The Managed Agents server, its database, and the workers where agents execute shell and file tools are all operated by the customer. Developers continue to build agents with the same core APIs they used on the hosted version, so existing agent code does not need to be rewritten.

02Harness, sandboxes, credentials, and session history

Managed Agents is described as a suite of composable APIs for building and deploying autonomous agents. It provides the agent harness, sandboxes, credential handling, and session history required to get long-running agents into production. In a self-hosted deployment, all four of those components sit inside the customer's network.

Session history is stored in the customer's own database rather than on Anthropic's infrastructure. Credentials used by agents to access internal systems never leave the customer's environment. The harness — the orchestration layer that manages agent lifecycles — is likewise operated by the customer's team, giving security and compliance groups full visibility into how agents interact with internal code and systems.

03Model routing through Bedrock, Foundry, or a private gateway

Model requests from self-hosted Managed Agents can be routed to multiple destinations. Customers can send requests directly to Anthropic, or through their cloud provider — Amazon Bedrock, Google's Agent Platform, or Microsoft Foundry are all supported endpoints. A customer's own gateway is also a valid target, which means organizations that proxy all LLM traffic through an internal service can continue doing so.

This routing flexibility matters for teams that have already standardized on a particular cloud provider's AI platform or that need traffic to pass through an audit proxy. The choice of model endpoint is entirely up to the operator; Anthropic does not prescribe which path requests must take.

04Zero data retention and compliance posture

Organizations that have zero data retention agreements with Anthropic get the same protections on self-hosted Managed Agents as on any other Messages API call. When ZDR is in place, requests sent to Claude are subject to the same data-handling terms regardless of whether the control plane is hosted or self-hosted.

Because session history lives in the customer's own database and credentials stay on the customer's machines, the data surface area outside the organization's perimeter shrinks to the model request itself. For regulated industries or teams with strict data-residency rules, that boundary is the key difference between self-hosting and using the fully hosted version.

05Agents handling builds, releases, alerts, and bug backlogs

Anthropic frames the release around the growing scope of agent work. Agents are now taking on tasks like fixing broken builds, testing releases, triaging alerts, and working through the bug backlog. These agents run unattended on production code and need access to internal systems such as CI pipelines, monitoring dashboards, and issue trackers.

For agents with that level of access, some teams want the entire platform in their own environment rather than just the sandbox. Until this release, the alternative was building the platform from scratch. Self-hosted Managed Agents removes that build-or-buy gap by giving teams a turnkey on-premises option that still uses the same composable API surface.