Anthropic opened a private beta of self-hosted Claude Managed Agents on November 12, letting companies operate the full agent service on infrastructure they control. Managed Agents is the company’s set of modular APIs for shipping autonomous agents to production. Until now, a team that wanted agents with deep access to its code had to accept Anthropic’s hosting or build the surrounding platform alone.
The earlier path was a hosted service on the Claude Platform, with a later option to run only the sandboxes at home. Anthropic’s announcement on claude.com says that was not enough for some customers. Agents now fix broken builds, test releases, triage alerts, and work through bug backlogs, often unattended, and that work needs access to internal systems. Those teams asked for the whole service inside their walls.
The self-hosted version delivers that. The customer operates the Managed Agents server and its database, plus the worker machines on which agents use shell and file tools. Session history sits in the customer’s own database. Developers write agents against the same core APIs as the hosted product, so moving between the two should not mean a rewrite.
Model traffic is a separate choice. Requests can go to Anthropic directly, to Amazon Bedrock, to Google’s Agent Platform, to Microsoft Foundry, or to a gateway the company operates. Zero data retention, where a customer already has it with Anthropic, covers what is sent to Claude just as it would for an ordinary Messages API call.
Anthropic frames the security design around four principles, and says they hold whether it hosts everything, the customer hosts only the sandbox, or the customer hosts the full service.
- Split brain and hands. The harness calls Claude, while the sandbox runs the agent’s code. Loop logic, history, and secrets in the vault all stay outside it. A run therefore does not hinge on one sandbox lasting to the end, and a sandbox spins up only once a tool calls for it.
- No credentials in the sandbox. When an agent uses MCP tools or a supported API, a proxy sitting beyond its boundary injects the credential into each outgoing request. Self-hosters can keep credentials in their own secrets manager.
- Allowed hosts only. Each environment can be limited to a list of permitted hosts, and anything else is blocked. For a build-fixing agent, Anthropic suggests the list might hold just the git host and the package registry. Self-hosted sandboxes get the same limits through the customer’s own firewall.
- A record of every step. Tool calls and their results are logged, and the record exports over OpenTelemetry into whatever monitoring a company already runs.
The pitch is straightforward: if an agent works while nobody watches, the limits must live in the architecture rather than in a reviewer’s attention. That is a reasonable argument, and it is also Anthropic’s own description of its own design. The announcement cites no third-party audit, no pricing, and no timeline for general availability.
Access is by request only. Customers contact their Anthropic account team, and the docs cover the technical detail.
The practical test for security and platform teams is the operations burden. Self-hosting hands over the database, the workers, and the firewall rules, and the beta terms will show whether that cost buys enough control to justify skipping the hosted service.
Based on Anthropic’s announcement on claude.com, published November 12, 2026.
