What actually moves in-house
Managed Agents is Anthropic's API suite for long-running autonomous agents: the harness that calls the model, the sandboxes where agent code runs, credential handling and session history. Anthropic launched it as a hosted service, then added self-hosted sandboxes for teams whose code had to stay in their own environment. The rest of the service stayed on Anthropic's side.
The beta moves the rest. The harness, sandboxes, credentials and session history all run in the customer's cloud or on-premises, and the customer operates the server, the database behind it and the workers. Anthropic's stated reason is the work these agents now do unattended: fixing broken builds, testing releases, triaging alerts, clearing bug backlogs, with access to internal systems. For that class of agent, some teams wanted the platform itself inside their perimeter — and until now, Anthropic says, the alternative was building the platform themselves.
The part that does not move
Self-hosted describes the control plane, not the model. There are no Claude weights in this release and no self-hosted inference. When an agent thinks, the request follows the route the customer has configured: Anthropic directly, a cloud provider (Amazon Bedrock, Google's Agent Platform or Microsoft Foundry), or the customer's own gateway, and the completion comes back along it. A zero data retention agreement, where one exists, covers those requests, but it is a contract term, not an architecture.
That distinction is the whole story for a security review. The customer operates the agent server, the database and the workers, and stores session history locally, so Anthropic is no longer the operator of your agent sessions, your credential store or your execution logs. What the beta does not settle is where inference runs or which boundaries your prompts cross on the way to it. Teams whose rule is "our credentials, our session records, our audit trail" get most of what they asked for. Teams requiring prompt content to remain within a defined boundary must assess the inference route separately; this beta does not provide self-hosted Claude inference.
The security design is the product
Anthropic builds the pitch on four constraints. The harness and the sandbox are kept apart, so agent code never runs where session history and vault secrets live, and sandboxes start only when a tool needs one. Credentials stay out of the sandbox: a proxy outside it adds the credential to a request, and self-hosted customers can keep credentials in their own secrets manager. Each environment can be limited to an allowlist of hosts, so a build-fixing agent might reach only a git host and a package registry. And every session leaves a full record, exportable over OpenTelemetry into the monitoring tools a team already runs.
None of this is new in the beta; Anthropic says the same principles applied to the hosted service. What changes is who operates them. The customer now owns the uptime, the patching and the database as well.
What to check before asking for access
There is no published price, no GA date and no self-serve signup; access runs through an Anthropic account team. Ask what the beta commits Anthropic to: support terms, upgrade path to whatever ships at GA, and what happens to self-hosted deployments if the product changes shape. Ask, too, what content and telemetry each configured provider or gateway receives, and which retention terms apply, because "self-hosted" will be quoted back to your own compliance team in a shorter form than Anthropic uses.
Sources
- [1] Anthropic, "Operate Claude Managed Agents inside your security perimeter" (claude.com, 12 November 2026)Read source
- [2] Help Net Security, "Self-hosted Claude Managed Agents keeps agent credentials in your environment" (12 November 2026)Read source