Anthropic brings the Managed Agents service into customer infrastructure Anthropic brings the Managed Agents service into customer infrastructure

The service joins the sandbox

The earlier self-hosted sandbox option moved tool execution into a customer's environment. Anthropic still operated the service coordinating that work. The new option also moves the agent loop, API and session storage. Developers retain the core interface for defining agents and starting sessions. That separates two decisions often bundled together: where software runs commands and who keeps the record of its work. Anthropic positions the release for tasks such as repairing builds, testing releases and handling internal alerts. Customers can deploy in their own cloud account or an on-premise data center.

Local history still feeds model requests

The data boundary follows the model call. Each request carries the conversation so far, including prompts, tool inputs and tool results, to the selected inference provider. Keeping the database in-house does not by itself keep that request content inside the same network. The default destination is the Claude API. Other configurations can use a cloud provider or a customer's gateway. Anthropic's data documentation says it has no remote access to the customer's server or logs. Logs, monitoring destinations and worker network access are separate parts of the deployment.

An operator inherits the operating work

A deployment combines the service, persistent storage and workers that execute shell and file operations. PostgreSQL version sixteen or later provides persistence; the in-memory alternative loses its contents when the server restarts. Customers install releases and secure these components themselves. A worker does not create an isolation boundary around a shell command. Its container or virtual machine supplies that boundary, along with the permissions and network reach available to the command.

The same interface has migration gaps

Moving an application also requires rebuilding its service state. Agents, credentials, skills and history are not copied from the hosted product. The self-hosted version lacks hosted scheduling and webhooks, so existing automation cannot assume those triggers will survive a move. Another compatibility detail affects evidence: an image or document supplied by URL can be accepted without reaching the model. The documented alternative is inline data. These differences make a successful API response a narrower signal than a completed migration. A workload has to retain its inputs and execution path.

Control has a narrower meaning here

The release gives customers another place to draw their operating boundary. It does not replace the inference service with downloadable Claude weights. Anthropic's announcement describes credential handling outside the sandbox and event records that can feed existing monitoring systems. Those controls address different parts of an agent's work: access to internal services, execution of commands and review afterward. For an organization that already operates isolated infrastructure, the change brings more of that workflow under its own administration. It also adds a server and its update cycle to the systems it owns.