What came out on November 12
Claude Managed Agents is the service through which Anthropic runs autonomous agents without the customer having to manage infrastructure. I covered it in April, at launch, in the Managed Agents guide.
In May came a first opening: sandboxes, the isolated environments where the agent runs code and tools, could run in an environment the customer controls. On November 12 the step is longer. In private beta, on request through your Anthropic account team, you can host everything else: the agent server, the database, the workers, the credentials and the session history.
In one sentence: the agent lives in your house, the model doesn't. And that split is exactly what makes this interesting for regulated companies.
What you host and what stays outside
In the self-hosted version the customer runs the Managed Agents server and its PostgreSQL database, where session history lives. It runs the workers where agents use shell and files, the sandboxes, the firewall rules and the allowlists of hosts agents can reach. And it handles patching and configuration of all of it.
The model stays outside the company network: prompts go out and completions come back. The choice is where to send them. Requests can go directly to Anthropic, to Amazon Bedrock, to Google Cloud's agent platform, to Microsoft Foundry or to a company gateway. For customers with zero data retention at Anthropic, model requests are covered like any other API call.
In other words: the history of what agents did, the files they worked on and the access keys to internal systems never leave the company's infrastructure. Only what the model needs to respond leaves, towards the provider you chose.
Get updates on Claude and AI for business
One email when there's something worth reading. No spam.
Evaluating Claude for your organization? Learn what it costs or which plan fits best
The security part, which is the most interesting
The strongest technical point is the separation between the agent's brain and the place where it carries out actions.
Credentials never enter the sandbox. An external proxy attaches them to calls to MCP-connected tools and to some supported APIs, so even an agent manipulated by malicious content doesn't have the keys within reach. Whoever hosts the system can keep credentials in their own secrets manager.
Each environment has a host allowlist: requests to any other host are blocked. And every tool call, with its result, is logged and exportable via OpenTelemetry to the monitoring systems already in use.
Help Net Security summed up the principle with a phrase I agree with: the limits have to be built into the system itself. You don't ask the agent to behave, you take away its ability to do damage. It's the same reasoning I made commenting on the Mythos 5.2 system card: if tests aren't enough to guarantee behavior, you need minimal permissions and complete logs.
What it costs, in work
Hosting a service means taking responsibility for it, and the self-hosted version is no exception.
The customer takes on patches, updates, configuration, database and server availability. The APIs are in beta and may change before general availability, so anyone starting now should expect to redo part of the work.
Migration from the managed service isn't automatic: nothing is copied. Agents, skills, credentials and memory stores have to be recreated in the new installation. And some features aren't there yet, such as scheduled agent runs.
Anthropic hasn't published pricing for the self-hosted version. On the managed service the cost was $0.08 per runtime hour plus tokens, and it's reasonable to expect a different structure when the customer pays for the infrastructure.
Who it's really for
Not for those just starting. For a first agent project the managed service is faster, cheaper to maintain and more than adequate for most cases.
The self-hosted version makes sense in three situations. Banks, insurers and healthcare, where the history of an agent's operations is itself regulated data and must sit within a precise perimeter. Companies with policies that forbid internal system credentials on third-party infrastructure. And groups that have already chosen a cloud for the model, Bedrock, Google Cloud or Foundry, and want everything else in the same place.
For European companies with constraints like these it's a concrete step, because it removes one of the recurring objections in assessments. For the broader picture on where data goes when you use Claude, there's Claude and GDPR, and for agent architecture autonomous agents with the Agent SDK.