Anthropic has opened a private beta of self-hosted Claude Managed Agents, a way to run the company’s agent control plane inside a customer’s own cloud or data center. In an announcement on November 12, Anthropic said customers can now host “the agents, credentials, and session history” themselves and “choose where requests to Claude are sent.” The model still runs outside the customer’s network. This is self-hosted orchestration, not an on-premises copy of Claude.
Quick Take
- What launched: A private beta of self-hosted Claude Managed Agents, announced November 12, 2026. Access is requested through an Anthropic account team.
- What you run: The Managed Agents server, a PostgreSQL database for agents and session history, and the workers where agents run shell and file tools in sandboxes.
- What stays outside: Requests to Claude go to Anthropic, Amazon Bedrock, Google’s Agent Platform, Microsoft Foundry or a company gateway. The weights do not move in-house.
- Why it exists: Anthropic says agents now fix builds, test releases, triage alerts and work through bug backlogs unattended, so some teams want the whole service, not just the sandbox, in their environment.
- Who is affected: Enterprises in regulated settings that already use Managed Agents, or that have been waiting for session history and credentials to stay internal.
In plain English
Anthropic will let some customers run its agent control software on their own computers, instead of on Anthropic’s. The company still provides the Claude model over a network call, so this is not a fully offline Claude. What stays inside the company are the records of what an agent did, the keys it uses, and the isolated boxes where it runs commands. Access is limited to a private trial, through an Anthropic account manager.
What happened
Managed Agents is Anthropic’s suite of APIs for long-running agents: a harness, sandboxes, credential handling and session history. It first shipped as a hosted service. Later, Anthropic let customers host only the sandboxes. The November 12 beta goes further. “With self-hosted Managed Agents, every part of the service runs in your own cloud or on-premise, including the harness, sandboxes, credentials, and session history,” the company wrote. Developers keep the same core APIs as the hosted product.
Anthropic’s quickstart starts teams on one machine with Docker Compose: the server, PostgreSQL, and a worker per session in its own sandbox container. That stack is for development, not production. It serves plain HTTP and, by default, publishes port 8400 only on the host loopback address. Anthropic warns that some older Docker Engine releases before 28.3.3 can also expose that port on the local network, and that agent tools run in containers on the host, so the machine should not hold anything that must stay protected. For production, it points to two Helm charts for Kubernetes.
What stays yours, and what does not
Session history lives in the customer’s database. If the organization has a zero data retention agreement with Anthropic, that agreement applies to the Claude requests “in the same way as any other Messages API call.” Credentials can sit in the customer’s own secrets manager. Anthropic says a proxy outside the sandbox attaches credentials for MCP tools and supported API calls, so those secrets are not placed inside the sandbox. That protection is limited to those supported calls; other services an agent reaches still need a careful review.
Anthropic describes four design principles that apply whether it hosts everything, the customer hosts only the sandbox, or the customer hosts the full service. The harness (which calls Claude) is kept separate from the sandbox (where the agent’s code runs). Credentials stay out of the sandbox. Network access can be limited to an allowlist of hosts. Every session leaves a record, including tool calls and their results, exportable over OpenTelemetry. “When an agent runs unattended inside your code and systems, you can’t rely on a person checking every step, so the limits have to be built into the system itself,” the company wrote.
| Piece of the stack | Hosted Managed Agents | Self-hosted Managed Agents (private beta) |
|---|---|---|
| Agent harness and control-plane server | Runs on Anthropic’s platform | Customer runs the server in their cloud or on premises |
| Sandbox workers (shell and file tools) | Anthropic, or already optional on the customer side | Customer operates the workers |
| Credentials and session history | Held in the hosted service | Customer’s database and secrets manager |
| Where Claude runs | Anthropic or a chosen cloud API | Still outside the customer network; the customer chooses the destination |
| How to get access | Existing hosted product | Request access via an Anthropic account team |
The comparison summarizes Anthropic’s announcement and documentation. Pricing and a general-availability date have not been published.
Pros and cons
For security and compliance teams
- Pro: Session history, credentials and agent logs can stay in the company’s environment, which is the main request from regulated industries.
- Con: Claude still receives prompts and returns completions from outside that environment, so a self-hosted control plane is not the same as an air-gapped model.
For platform engineers
- Pro: The same APIs as the hosted service, with a documented path from Docker Compose to Kubernetes.
- Con: The customer now operates a server, a database and a fleet of sandbox workers, including the usual patching and access-control work that Anthropic used to do.
For agent developers
- Pro: Agents that already work on internal code and systems can keep that work closer to the systems they touch.
- Con: Coverage of MCP and “supported API calls” is not a blanket promise for every tool an agent might invoke.
What’s still open
- When the private beta will open more widely, and what it will cost.
- Which hosted features do not ship in the beta. Anthropic’s public announcement does not include a full feature-by-feature comparison with the hosted service.
- Whether existing hosted agents, skills, vault items and session histories can be moved across, or must be rebuilt.
- How well allowlists and the credential proxy hold up once agents start calling services outside the supported set.
About the analysis
Researched and written with AI assistance under the editorial responsibility of the i10X News team. The title image is an AI-generated image. Read our AI Use Policy. Spotted an error? Request a correction.
This independent i10x analysis is based on Anthropic’s November 12 announcement, “Operate Claude Managed Agents inside your security perimeter,” and the self-hosted Managed Agents quickstart documentation. i10x did not get access to the private beta and did not run the stack.
i10x Perspective
The split Anthropic is selling is the one enterprises actually argue about: who holds the agent’s memory and keys, not who owns the model weights. That will be enough for some regulated buyers. It will not satisfy teams that wanted Claude itself to never leave the building. The more interesting test is operational. Once a company is on the hook for the control plane, the question is no longer whether the APIs match, but whether the customer can run sandboxes, allowlists and credential proxies as carefully as Anthropic did when it hosted them.
