Reported News
Anthropic opens self-hosted Claude Managed Agents in private beta: server, sandboxes and history on your infra
Anthropic has put self-hosted Claude Managed Agents into private beta, saying "every part of the service runs in your own cloud or on-premise." Customers run the server, a PostgreSQL 16 or later database and the sandbox workers; model calls go to Anthropic, Bedrock, Google Cloud, Foundry or their own gateway.
- Changes reported
- 5
- listed below, each from a source we read
- We tested
- Not tested yet
- reported from sources; we did not run it ourselves
- Gaps we flag
- 4
- things we could not verify
- Sources
- 4
- 2 primary, linked below
What changed
| # | What the source says | Status |
|---|---|---|
| 01 | The whole Managed Agents service can now run on customer infrastructure: the agent harness, sandboxes, credentials and session history, in a customer cloud account or an on-premise data center. Access is a private beta requested through an Anthropic account team; Help Net Security reports it opened on Nov 12, 2026. | Reported |
| 02 | Customers operate three pieces: the server (cma-server), which serves the API and runs the agent loop; a PostgreSQL 16 or later database for agents and session history; and workers that run the agent's shell and file tools in sandboxes. Without a database, a restart erases the data. | Reported |
| 03 | Model requests can go to the Claude API, Amazon Bedrock, Claude models on Google Cloud, Microsoft Foundry, or the customer's own gateway. Developers keep the same core APIs, SDK and ant CLI as the hosted service. | Reported |
| 04 | Credentials can live in the customer's own secrets manager; a proxy outside the sandbox adds them to MCP tool and supported API calls. Environments can be limited to allowlisted hosts, and every session's steps export over OpenTelemetry. | Reported |
| 05 | Anthropic's docs say the customer now owns jobs Anthropic does on the hosted service, including securing the server, hosting memory stores, detecting unusual usage and installing each release. The server is licensed under a separate Software License Agreement. | Reported |
reported by the sourcemeasured or run by usnot verified
Primary source: Anthropic: Operate Claude Managed Agents inside your security perimeter. We are the fast, independent index; the vendor’s own page is the source of record for this release.
The three ways to run Managed Agents now
| Option | Sandboxes | Service (API, loop, history) | Model |
|---|---|---|---|
| Cloud sandboxes (default) | Anthropic | Anthropic | Anthropic |
| Self-hosted sandboxes | You | Anthropic | Anthropic |
| Self-hosted Managed Agents | You | You | Anthropic, or a provider you choose |
What you take on when you self-host
Our reading: this is not an air-gapped Claude. The model still runs at Anthropic or a cloud provider, and the docs say each model call sends the conversation so far, including tool inputs and results, plus session, agent and environment IDs when the call goes to the Claude API. What moves in-house is storage, credentials and the control plane.
The operational load moves too. The docs warn that the bash tool is a real shell with the worker's permissions, so isolation depends on running each worker in a disposable container or VM (the Docker Compose stack and cma-sandboxes Helm chart do this per session). Each trust level needs its own deployment, and you install every release yourself.
License terms buyers should read first (reported)
The New Stack reports that the server ships as a proprietary binary customers cannot modify, that the license bars non-Claude models unless Anthropic permits them, and that customers have eight hours to disable a feature or roll back after a written safety notice, plus one business day to install a designated safety update. It also reports customers cannot block usage signals sent to Anthropic. Procurement teams used to owning their change windows should check those clauses against internal policy before a pilot.
In the source’s words
“For agents with that level of access, some teams want the whole service in their own environment, not just the sandbox.”
“The worker doesn't isolate that shell.”
What we have not verified
- We do not have beta access, so we have not installed the server or run a session.
- Pricing for the self-hosted option is not stated in the announcement or the docs we read.
- The license terms below (an eight-hour window to act on safety notices, one business day for safety updates, model reservation, usage signals) are as reported by The New Stack; we did not read the full license text ourselves.
- Anthropic does not name beta customers or say when the private beta will open more widely.
This brief is Reported: written from the sources below, not from running the release ourselves.
Sources
- Anthropic: Operate Claude Managed Agents inside your security perimeterprimary source · fetched 2026-11-14
- Claude docs: Self-hosted Claude Managed Agentsprimary source · fetched 2026-11-14
- Help Net Security: Self-hosted Claude Managed Agents keeps agent credentials in your environmentsource · fetched 2026-11-14
- The New Stack: Anthropic now lets you self-host Claude Managed Agentssource · fetched 2026-11-14
Related
Spotted an error? See our corrections policy or email the address on the contact page. Markdown version for agents: /news/anthropic-self-hosted-claude-managed-agents.md
Want these briefs in your Google Top Stories? Add Agentic Weekly as a preferred source on Google.
Newsletter
The Weekly Verdict. Free, every Monday.
A free email every Monday: the week's few big AI releases, then 5 short use cases for the new models, each with a prompt you can paste.
Free. Double opt-in. One click to unsubscribe.