Anthropic launches private beta for self-hosted Claude Managed Agents

On November 12, 2026, Anthropic opened a private beta that lets companies run Claude Managed Agents from their own infrastructure. The sandboxes, which are isolated environments where code runs, credentials, and session history remain on systems the customer controls, and companies may run the harness from a cloud account they control or an on-premises environment. To get started, customers ask their Anthropic account team for access.

Earlier, the sandbox was the only piece customers could run themselves, with Anthropic keeping credentials and session records. In the earlier model, Anthropic ran the agent while customers only hosted the sandbox, and Anthropic also stored skills and memory stores there. Teams that wanted everything behind their own perimeter previously had to construct the platform on their own.

Customers ask their Anthropic account team for the download, then handle installation of each release themselves. The cma-server runs the agent loop and provides the Managed Agents API. It keeps agents, sessions, and histories in storage and reaches out to the inference provider that was configured.

Shell and file tools run in customer sandboxes through workers, while the server itself does not run those tools. A deployment that persists needs PostgreSQL 16 or a later version, meaning the open-source database must be at least that release. With no database, the server stores information in memory alone, and restarting removes it.

An API similar to the hosted version connects customers to the server, though some documented differences exist. An API is a way for programs to communicate. The Claude SDK and ant CLI link to the server that customers operate.

Customers can send model requests to Anthropic directly, Amazon Bedrock, Microsoft Foundry, Claude Models on Google Cloud, or their own gateway. A gateway routes traffic between networks. The Claude API handles model calls unless another provider is chosen. An inference provider is the service that generates model responses. Agents use Claude API IDs to name models, and the server converts them for each provider. Every model request sends the live conversation, with prompts, tool inputs, and tool results, to whichever inference provider was selected.

Claude runs outside the customer network, so prompts leave and completions come back. The customer network is the organization’s own computing environment. Putting the service on customer infrastructure does not guarantee that model traffic stays inside the customer network. According to the security documentation, the server contacts Anthropic only when the Claude API is the chosen provider.

Anthropic has no remote access to the server a customer runs or to its log. If an organization has a zero data retention agreement, its requests are processed like Messages API calls.

Managed Agents rests on four security principles that apply no matter how it is hosted. The company argues that relying on a human to check every agent step is not workable. Anthropic says, “the limits have to be built into the system itself.”

The harness that calls Claude operates apart from the sandbox where agent code runs. The harness is the software that manages how agents work. Vault secrets, session history, and the agent loop remain outside the sandbox. A sandbox starts only when a tool requires one. Credentials never enter the sandbox.

For MCP tools or supported API calls, a proxy outside the sandbox inserts the credential into the outgoing request. MCP is a standard that lets agents connect to external tools. Customers running their own deployment can keep those credentials in their own secrets manager. Anthropic’s credential coverage includes just MCP tools and supported API calls, so every other service an agent contacts needs checking before launch.

A customer can limit an environment to an approved list of hosts, and requests to any other host are blocked. An allowlist is a list of permitted destinations. For a build-repairing agent, the approved list may consist of the git host plus the package registry. Customers who run their own sandbox must enforce those limits through a firewall, leaving the allowlist setup to them.

Managed Agents keeps a log of every agent step, recording each tool call and its response. Logs export through OpenTelemetry, so security teams can send the data to their current monitoring tools. OpenTelemetry is a framework for collecting telemetry data. The customer now runs the server, database, and firewall rules, and must maintain them with patches and correct configuration.

Customers now take on release installation, unusual-usage detection, memory-store hosting, and server security, which Anthropic previously managed. These duties now fall to the customer instead of Anthropic.

According to the migration guidance, nothing moves from Anthropic’s hosted service, not even session history. On their own server, customers rebuild memory stores, vault credentials, skills, and agents. Groups that already operate self-hosted sandboxes can connect the same worker software to the new server. Webhook-triggered workers will not function, because the server run by customers does not send webhooks.

One deployment supports only one tenant and one trust level. A tenant is a separate customer or group within a deployment. Different trust levels or separate tenants require separate deployments, each carrying its own database, API keys, and workers. Customer databases retain sessions and histories until deletion, rather than letting them expire by age. When a session is deleted, it leaves the database, though memory stores, backups, exported logs, traces, and Kubernetes workspace volumes still keep it. Kubernetes is a system for managing containerized applications.

Scheduled deployments, dreams, and webhooks are not available in the self-hosted option. A webhook is a message sent automatically when an event occurs. Web search and web fetch remain off until turned on, with availability set by the inference provider. The Claude API, Claude Models on Google Cloud, and Microsoft Foundry all work with web search. The Claude API or Microsoft Foundry enables web fetch.

Agents can examine past sessions, merge duplicate notes, and flag repeated mistakes through dreaming, without altering model weights. Anthropic launched dreaming on May 6, 2026, at its Code with Claude event. Harvey, a legal AI company, saw benchmark task completion rise sixfold in early tests after dreaming was applied. Dreaming runs in the background and processes between one and 100 session transcripts per run.

Learnings turn into plain-text notes and structured playbooks, while the original inputs remain intact. The research preview supports claude-opus-4-8, claude-opus-4-7, and claude-sonnet-4-6 for dreaming. Use of dreaming requires an access request, so not every Claude developer can use it. Dreaming remains behind a request-for-access gate, while other conference features moved to broader public beta.

The idea is to give careful companies more control over where agent data lives. Christine Lagarde, president of the ECB, has warned about risk from relying on foreign AI. The ECB is the European Central Bank. Mistral and comparable competitors have long offered sovereign AI as the solution.

OpenAI took another route in September, allowing companies to run agents inside Amazon’s cloud. Nvidia built hardware meant to make agents safer.