Anthropic has moved the whole agent service inside the customer walls. On November 12, the company opened a private beta of self hosted Claude Managed Agents, a version firms run in their own cloud or on their own site. The harness, the sandboxes, the credentials and the session history all run there now, not just the sandbox alone.
That is a bigger step than it may sound. Managed Agents is Anthropic’s suite of tools for building agents that work for hours without a person watching each step, fixing broken builds, testing releases, triaging alerts and clearing bug backlogs. Work like that needs deep access to code and internal systems, and deep access is exactly what made some firms refuse a hosted control plane.
The Announcement
Anthropic announced the beta in a post titled Operate Claude Managed Agents inside your security perimeter, published November 12, and in its platform release notes the same day. The post says every part of the service now runs in the customer environment. Developers still build agents with the same core tools as the hosted service, a suite Anthropic describes as composable building blocks for agents that run on their own.
The customer operates three things. First, the Managed Agents server, which serves the tools, runs the agent loop and stores agents and sessions. Second, its database, where session history lives, with PostgreSQL 16 or later needed for a setup that survives a restart, according to the docs coverage. Third, the workers, the machines where agents run shell and file tools inside customer sandboxes. The server itself never runs those tools.
Until now, the middle ground was self hosted sandboxes, added in May 2026. In that setup the tool work ran at home, but Anthropic still ran the loop, held the credentials and kept the record of what each agent did. The new beta moves all of that home as well. Anthropic says it has no remote access to the self hosted server or its logs, a claim firms will test in their own reviews before production use.
Important Details
| Item | Where it stands |
|---|---|
| Status | Private beta from November 12, 2026 |
| Access | Eligible firms only, through an Anthropic account team |
| Customer runs | The server, its database, and the workers for shell and file tools |
| Database | PostgreSQL 16 or later for a lasting setup, per docs coverage |
| Model providers | Anthropic directly, Amazon Bedrock, Google Agent Platform, Microsoft Foundry, or a customer gateway |
| Pricing | None published |
| Wider release | No date given |
The one thing that does not move home is Claude itself. Each model call still leaves the customer site and goes to a provider the customer chooses, set in the server config. Anthropic is the default. The other named routes are Amazon Bedrock, the Google Agent Platform and Microsoft Foundry, or a gateway the firm runs itself. If a firm holds a zero data retention deal with Anthropic, Anthropic says it applies to those requests in the same way as any other Messages call.
That split is the honest core of this launch. A firm gains control of the harness, the history and the keys. It does not gain control of the model traffic, because the prompts still go out and the answers still come back. Firms with strict rules on what may leave the building will read that line first, and some will still say no.
Designed for Agent Security
Anthropic built Managed Agents around four security ideas, and the post says they apply in all three setups, hosted, sandbox only and fully self hosted. The first splits the brain from the hands. The harness calls Claude, while the sandbox is where agent code runs, and the two stay apart by design. Session history and vault secrets sit outside the sandbox, and a sandbox starts only when a tool needs it.
The second keeps credentials out of the sandbox. For tools that use the Model Context Protocol and for supported calls, a proxy outside the sandbox adds the credential to the request. In the self hosted setup, firms can also store those credentials in their own secrets manager. The third limits network access. Each environment can carry a list of allowed hosts, and calls to any other host are blocked. A build fixing agent might list only its code host and its package source. At home, the firm sets the same limits in its own firewall.
The fourth is the record. Managed Agents logs every step an agent took, each tool call and what came back, and that record can flow out over OpenTelemetry into the monitoring tools a firm already uses. For an agent that works while the team sleeps, that record is not a bonus. It is the only way anyone can later say what the agent did and why.
The Catch
Self hosting is a trade, and the costs land on the customer. The firm now patches and guards the server, the database and the firewall rules itself. Nothing moves over from the hosted service either. Agents, skills, vault credentials and stored history must be built again on the new server, according to reports based on the docs.
Docs coverage also lists gaps against the hosted service. Scheduled runs and webhooks are reported as missing in the self hosted build, along with cloud environments and the Files tool set, and web search stays off until a firm turns it on. Treat that list as reported rather than final, since beta docs change fast. The licence adds one sharp duty of its own. The server licence, in effect from November 12, gives a firm eight hours to roll back a version after a safety notice and one working day to apply a safety update, according to coverage of the licence text.
Rivals are moving the same way. Mistral took its studio toward customer sites this month as well, a shift we covered in Mistral Studio: Managed Agents Go Public Preview. The pattern is plain. Agent vendors learned that the firms with the most valuable work also have the strictest walls, and the product now goes behind those walls or it does not go in at all.
- April 2026Anthropic launches Managed Agents as a hosted service on the Claude Platform
- May 19, 2026Self hosted sandboxes arrive, moving tool work into the customer environment
- November 12, 2026The whole service goes self hosted in private beta, server, database and history included
What’s Next
Confirmed steps are short. Eligible firms ask their Anthropic account team for access, get the release from that team, and install each release themselves. Anthropic has published no price for the server, no list of countries covered and no date for a wider release, and it has named no beta customers.
The open questions matter more. Nobody outside the beta can yet say how the self hosted build holds up under real load, how painful the rebuild from hosted proves in practice, or when the missing pieces arrive. What is settled is the direction. The agent platform no longer asks firms to bring their most sensitive work out to the vendor. It asks to be let in, on the firm terms, with the keys staying in the firm vault.
Facts checked November 13, 2026, against Anthropic’s announcement and licence, with docs details as reported by Help Net Security and other launch coverage named below.
Sources
- Anthropic, Operate Claude Managed Agents inside your security perimeter, November 12, 2026: https://claude.com/resources/articles/self-hosted-claude-managed-agents
- Anthropic, Software License Agreement: Claude Managed Agents Server, effective November 12, 2026: https://www.anthropic.com/legal/self-hosted-managed-agents-license
- Help Net Security, Self-hosted Claude Managed Agents keeps agent credentials in your environment, November 12, 2026: https://www.helpnetsecurity.com/2026/11/12/anthropic-self-hosted-claude-managed-agents/
- GeekByte, Anthropic opens a private beta for self-hosting the whole Claude Managed Agents service, November 12, 2026: https://www.geekbyte.com/post/claude-managed-agents-self-hosted/
- CellCog, Self-Hosted Claude Managed Agents: Beta, Limits, License, November 12, 2026: https://cellcog.ai/blog/claude-managed-agents-self-hosted/
- Diagram: Anthropic, from the announcement above
- Hero and vault illustrations: Dirty Static
END OF TRANSMISSION
Stay curious. Question everything.
