Anthropic Now Lets You Host the Whole Claude Agent Service Inside Your Own Perimeter

Running an AI agent inside your own systems used to mean a compromise: you could keep the code it touched on your infrastructure, but the service directing the agent — its credentials, its session history, the record of everything it did — stayed with the vendor. On November 12, Anthropic opened a private beta that moves that service in-house, except inference: self-hosted Claude Managed Agents lets a business run the agent service on its own cloud or on-premises infrastructure, per Self-Hosted Claude Managed Agents: What Businesses Get. The harness, sandboxes, credentials and session history all move in-house. The model still runs elsewhere.

What changed on November 12

Claude Managed Agents is Anthropic's service for long-running agents that work through a bug backlog, fix broken builds, test releases and triage alerts over hours, rather than answering one message and stopping. It launched as a fully hosted beta in April, then added self-hosted sandboxes in May, so only the workspace where code runs could sit on customer infrastructure, per You can now host Claude Managed Agents yourself. November 12 moves the rest of the service.

A self-hosted deployment has three parts the customer operates. The Managed Agents server serves the same API as the hosted service, runs the agent loop, and stores agents, sessions and histories. A PostgreSQL 16 or later database holds that history — without it, data lives only in memory and a restart erases it. Workers run an agent's shell and file tools inside the customer's sandboxes; the server never runs those tools, per Self-hosted Claude Managed Agents keeps agent credentials in your environment. Access is gated: the beta is available only to eligible organisations through an Anthropic account team, with no public pricing and no general-availability date, per the reports linked above.

The model still leaves — so route it deliberately

Self-hosting the harness is not self-hosting the model. Every model call sends the conversation so far — prompts, tool inputs and tool results — to a provider the customer chooses: Anthropic by default, or Amazon Bedrock, Claude Models on Google Cloud, Microsoft Foundry, or the customer's own gateway, per Anthropic lets companies host its AI agent service in private beta. Keeping history in your own database therefore does not keep all conversation content inside your network.

That distinction decides who this helps. If your sensitive material is credentials, code execution and the audit record, those now stay home. If your case depends on no working material leaving the network at all, self-hosting alone does not deliver it: you also need the routing decision, through your own gateway or under a zero-data-retention arrangement, which Anthropic says applies to these calls as it does to other Messages API calls, per the Superpower Daily report linked above. Anthropic says it has no remote access to a self-hosted server or its logs, per the Coheser report linked above.

The harness and the sandbox stay separated

Anthropic built Managed Agents around security principles that carry over to self-hosting, on the reasoning that an unattended agent cannot rely on a person checking each step, so the limits have to be built into the system itself, per the Help Net Security report linked above. The harness that calls the model is separated from the sandbox where code runs, and the agent loop, session history and vault secrets sit outside the sandbox. Credentials stay out of the sandbox too: for MCP tools and supported API calls, a proxy outside the sandbox attaches the credential, and self-hosted customers can keep credentials in their own secrets manager. That protection is limited to MCP tools and supported API calls, so any other service an agent reaches needs checking before go-live.

Each environment can be locked to an allowlist of hosts — for a build-fixing agent, only the code host and package registry. Every step is logged and exports over OpenTelemetry into existing monitoring tools, per the Help Net Security report linked above. An agent's shell is a real shell with the worker's permissions, and the worker does not isolate it — isolation comes from the container or virtual machine you run it in, per the Superpower Daily report linked above.

What you give up against the hosted service

Self-hosting is a trade, not a free upgrade. Seven hosted features are unavailable on the self-hosted server, including cloud environments, the Files API, scheduled deployments, webhooks and the feature Anthropic calls dreams, per Self-Hosted Claude Managed Agents: Beta, Limits, License. Web search and fetch stay off until explicitly enabled. Nothing migrates: agents, skills, vault credentials, memory stores and session history must all be rebuilt, per the Coheser report linked above. Each deployment serves one tenant at one trust level, so separate trust levels need separate deployments, per the Derrington briefing linked above.

Operations move to you as well: you secure the server, database and sandboxes, and install each release yourself. A licence published the same day underlines the pace: after a written safety notice, a licensee has 8 hours to roll back a version and 1 business day to deploy a safety update, per the CellCog report linked above. Docker Compose is for development only; persistent installs point to Helm-based tooling, per the Coheser report linked above. If your team cannot staff that duty, stay hosted.

What this means for your business

1. Name what you are protecting before you apply. List what blocks adoption today: credentials, session history, code execution, or model traffic itself. Self-hosting solves the first three. If the blocker is the fourth, settle the inference route and retention terms first, or the pilot stalls at the same review.

2. Rebuild one bounded agent, not your whole fleet. Nothing migrates, so treat the first deployment as a rebuild. Pick one job with a clear finish line — triaging a week of alerts, working a defined bug backlog — and measure completion without rescue, history surviving a restart, and a complete command log.

3. Budget the operator, not just the licence. There is no public price for the server, and model costs apply on top. The real cost is operations: patching on an 8-hour safety clock, securing and backing up the database, and owning the allowlists. Name an owner before the beta starts.

4. Test the isolation, not the demo. Revoke a credential and confirm the agent fails safely. Point it at a repository it should not touch and confirm the sandbox holds. Restart the server and confirm history is intact. A real shell earns trust through failure tests, not a smooth first run.

5. Decide your exit while entry is cheap. Agents and history rebuilt on your server are yours to keep, but the model, API and licence terms are not. Keep definitions portable — agent definitions, prompts and evaluation results in version control — so changing provider later is a migration, not a rebuild.

6. Confirm the paper before the pilot. Get written answers on five points before any agent runs: whether a zero-retention arrangement covers these calls, how long audit logs are kept, the licence's safety-update duties, what happens when the licence ends, and who owns session history when a team member leaves. Each is an open term in this launch, not a detail to assume.

Anthropic is not alone in selling deployment control: days earlier, another vendor moved its agent studio to customer-run deployments as well, per the Coheser report linked above. That removes a real governance objection — if you price the operations that come with it.

Ready to find where automation would cut cost or cycle time in your operation? Get a free AI audit — we'll map your highest-leverage automation opportunities in one session.