Anthropic shipped something yesterday that most people will scroll past. Please don't.
Self-hosted Claude Managed Agents, now in private beta, lets a company run Anthropic's entire agent service inside its own cloud or its own data center. The agent loop, the credentials, the session history, the sandboxes where code actually runs. All of it sits on your side of the firewall, and you decide where the calls to Claude go.
That sounds like an infrastructure footnote. I think it's the most important agent news of the quarter, and it has nothing to do with how smart the model is. Here's why.
the thing that's been stalling agents isn't the model#
Most agent projects don't die in the demo. They die in the security review. The pilot works, then someone asks where the credentials live, what the agent can reach, and who can see what it did. If the answer is "a vendor's cloud," a lot of companies stop there. This release changes that answer.
We sort AI work into five levels. Levels one and two are people using AI tools: a chat window, then shared projects and skills. Level three is where it changes. You map out the steps of a task and take the human out of kicking it off. The agent fixes the broken build, triages the alert, works the bug backlog, and nobody watches each step.
That's the whole point of level three, and it's also the whole problem. When a person is in the loop, the person is the safety system. When they're not, the safety has to be in the architecture. In every production system we've put in place with real security and compliance requirements, you need guardrails, logs and a clear answer on access. None of that changes because the model got better.
what actually shipped, in plain English#
Managed Agents is Anthropic's set of APIs for building agents that run on their own for a long time. Think of an agent as four parts.
The brain is the loop that calls Claude, decides the next step and keeps going. The hands are the sandbox where the agent runs shell commands and edits files. The keys are the credentials it uses to reach your systems. The memory is the session history, the record of everything it did.
When Managed Agents launched, Anthropic hosted all four. Then it let teams run the hands themselves, so code could stay in their own environment. Now you can run all four. The brain and the server run on your infrastructure, the keys can sit in your own secrets manager, and the history lands in your own database.
The model calls are your choice too. They can go straight to Anthropic, through Amazon Bedrock, Google's Agent Platform or Microsoft Foundry, or through your own gateway. If you already have zero data retention with Anthropic, it covers these calls the same way it covers any other.
Developers use the same APIs as the hosted version. So you can prototype on Anthropic's infrastructure and move it inside when it's ready, without a rewrite.
four design rules worth stealing, even if you never use this#
The part of the announcement I'd print out isn't the product. It's the four design principles underneath it. They hold whether Anthropic hosts everything or you do, and they're the right checklist for any agent that touches your systems.
- Split the brain from the hands. The loop that calls the model lives outside the sandbox that runs the code. Sandboxes spin up only when a tool needs one, and the agent doesn't depend on any single sandbox surviving the whole run. If the hands crash, the brain still knows where it was.
- Keep the keys out of the sandbox. The agent never holds a password. When it calls a tool, a proxy outside the sandbox attaches the credential on the way out. Code that never sees a secret can't leak one.
- Give every agent a short list of places it can go. Each environment gets an allowlist of hosts, and everything else is blocked. Anthropic's example is an agent that fixes builds and can reach exactly two things: the git host and the package registry.
- Make every session leave a full record. Every step, every tool call, every result gets logged and exported through OpenTelemetry, the open standard most monitoring tools already read. Your existing dashboards can watch your agents.
Here's the test I'd run tomorrow. Pick the agent you most want in production. Can you write its allowlist on one line? If you can't name the two or three systems it needs, the task isn't designed yet, and no hosting choice will fix that.
the Excel lesson, again#
I keep coming back to Excel when I talk about AI. Excel is one of the most powerful tools ever put on a desk, and a big reason why is that it ran on your machine, against your data, without asking anyone. It's also where a lot of company information goes to die: a model nobody can audit, emailed around, owned by whoever touched it last.
Agents can go the same way. An agent with broad access, no log and a vague job becomes the place where accountability dies. Self-hosting fixes where the agent runs. It doesn't fix what you point it at.
That second part is the work. We break every agent task into four pieces we call the anatomy of a task: where the data comes from, what logic gets applied, how you check the output, and where the result goes. The tighter each piece, the better the agent. When portfolio companies report numbers every month, for example, we don't let the model decide whether adjusted EBITDA ties out. A plain rules engine, ordinary code, does that inside the agent workflow, and the model handles the reading, sorting and routing it's good at. Hallucinations disappear by design when you stop giving the model jobs it shouldn't have.
what this doesn't solve yet#
Self-hosting means you operate it. You run the Managed Agents server, its database and the worker infrastructure. That's real platform work, and a company without an engineering team that already runs production services should go in with eyes open.
It's also early. This is a private beta, you request access through an Anthropic account team, and the announcement doesn't publish pricing, limits or supported regions. I'd treat the next quarter as the time to design for it, not to bet a launch date on it.
three questions for Monday#
If you run operations, IT or a data team at a company adopting AI, here's where I'd start.
Which agent use case is stuck in security review right now? That's your first candidate, because this release was built for exactly that conversation.
Can you name what it needs to reach? Write the allowlist. Two or three hosts is a good sign. Fifteen means the task needs to be broken up.
Who reads the logs? A full record of every session only helps if it lands in a tool someone already watches, with a person whose job is to look.
The gap between an agent demo and an agent in production was never mostly about intelligence. It was trust and plumbing. This release closes a real piece of the plumbing, and it puts the trust question back where it belongs: inside your own walls, under your own rules. We build on Claude, and this is the release a lot of our clients' security teams have been asking for. The companies that design their tasks well now will be the ones running agents unattended next year.
Josh Miramant is the CEO and founder of Blue Orange Digital, an AI consulting and implementation firm.