Anthropic Moves the Whole Agent Platform Behind Your Firewall: Self-Hosted Claude Managed Agents Enters Private Beta

Anthropic has opened a private beta of self-hosted Claude Managed Agents, a deployment option that moves the entire agent control plane inside the customer's security perimeter. The announcement went out through Anthropic's developer channels on November 12, and trade outlets including Help Net Security and The Next Web picked it up the same day. For the segment of the market whose security reviews blocked hosted agents outright, this is the release they have been waiting for.

Managed Agents is Anthropic's suite for building and running autonomous agents, and putting one into production requires four things: the harness that runs the agent loop, the sandboxes where tools execute, credential handling, and session history. Until now there were two deployment shapes — run everything on Anthropic's cloud, or, since earlier this year, move only the sandbox in-house while Anthropic kept the rest. The self-hosted option goes all the way: harness, sandboxes, credentials and session history all run on infrastructure the customer controls.

Concretely, the customer operates three things. There is the Managed Agents server, which serves the API, runs the agent loop, and stores agents, sessions and their histories — but never executes the agent's shell or file tools itself. There is its database, PostgreSQL 16 or later, without which the server keeps state only in memory and loses everything on restart. And there are the workers, launched as a CLI command or SDK process, that pick up work from the server and run the agent's shell and file tools inside customer sandboxes. A web console handles sign-in through the customer's own identity provider, and an admin CLI — available for Linux on x86-64 and Arm, plus Apple-silicon macOS — creates environments and keys.

The model is the one part that still calls home — but the customer chooses where. Model requests can route to Anthropic directly, to Amazon Bedrock, Google's Agent Platform or Microsoft Foundry, or to the customer's own LLM gateway. Teams holding zero-data-retention agreements keep that policy for all Claude calls initiated from the self-hosted setup. Anthropic's docs state exactly two reasons to pick this option: when you must store agents, sessions and session history yourself, and when model calls must go to an inference provider you choose. If neither applies, the lighter self-hosted-sandboxes tier remains the right call.

The security architecture rests on four boundaries worth noting for anyone evaluating it. Harness and sandbox are separated, with sandboxes spun up on demand while session histories and vault secrets stay outside the execution container. Credentials for MCP tools and external APIs are never exposed inside sandboxes; an external proxy attaches authentication to requests, and teams can wire in their own secrets managers. Network egress from each sandbox can be locked to explicit host allowlists such as internal git servers and approved package registries. And every action, tool call and returned payload exports via OpenTelemetry into whatever monitoring stack the enterprise already runs.

Availability is the catch: this is a private beta with no self-service enrollment and no announced general-availability date. Access requires a request through an Anthropic account team. The trade is also real — the customer now owns patching, high availability, database management and worker scaling for a distributed system that Anthropic previously ran. That is precisely the deal regulated enterprises have been asking for: the convenience of a managed agent platform with the custody model of on-premises software. Whether the operational burden proves worth it will depend on how much an enterprise values keeping credentials and agent histories inside its own walls — and for banks, healthcare systems and government contractors, that answer is usually yes.