Anthropic opens self-hosted Claude Managed Agents in private beta

Anthropic said on November 12, 2026 that self-hosted Claude Managed Agents is available in private beta. Customers run the Managed Agents server, its database, credentials and session history in their own cloud or on-premise, but model calls still leave the customer's network. Access is by request through the Anthropic account team.

Anthropic's announcement describes Managed Agents as "a suite of composable APIs for building and deploying autonomous agents" that "provides the agent harness, sandboxes, credential handling, and session history to get long-running agents into production." Anthropic's self-hosted docs say: "For each model call, the server sends the conversation so far, including tool inputs and tool results, to your inference provider. By default, that is the Claude API." Anamarija Pogorelec, writing for Help Net Security on November 12, 2026, put the same limit this way: "Claude itself still runs outside the customer’s network, so prompts go out and completions come back."

#What changed?

Anthropic wrote: "We first launched Managed Agents as a hosted service on the Claude Platform, where Anthropic runs the infrastructure for you." It later added self-hosted sandboxes for teams that needed their code to stay in their own environment. Some teams, it said, "want the whole service in their own environment, not just the sandbox."

Anthropic says: "With self-hosted Managed Agents, every part of the service runs in your own cloud or on-premise, including the harness, sandboxes, credentials, and session history." Customers "operate the Managed Agents server, its database, and the workers where agents run their shell and file tools." "Session history is stored in your own database." The docs describe the product as "Managed Agents on your own infrastructure, which can be a cloud account or an on-premise data center". They list the database requirement as "PostgreSQL 16 or later." "Your developers still build agents with the same core APIs as the hosted Managed Agents service."

On credentials, Anthropic says: "Vaults are designed to keep credentials out of the sandbox." For MCP tools and supported API calls, "a proxy outside the sandbox adds the credential to the request". "With self-hosted Managed Agents, you can also store credentials in your own secrets manager." That proxy covers only Model Context Protocol (MCP) tools and supported API calls. Pogorelec wrote: "Anthropic limits that protection to MCP tools and “supported API calls,” so any other service an agent reaches is worth checking before the agent goes live." The same concern, keeping credentials out of an agent's reach, came up in Microsoft's ARTEX case, in which an AI agent reached Azure Key Vault data in five minutes.

Anthropic says it designed Managed Agents around four principles. "These principles apply whether Anthropic hosts everything, you host just the sandbox, or you host the whole service." "You can limit each environment to a list of allowed hosts", and "requests to any other host are blocked." "When you host the sandbox yourself, you set the same limits in your own firewall." That pairs with a guide to limiting which hosts coding agents can reach on a Mac.

Anthropic's data and access docs state: "Anthropic has no remote access to the server or its log." "Anthropic issues none of the credentials that the server accepts, and it holds none of them." The overview says: "With self-hosted Managed Agents, you run and secure a server, its database, and your sandboxes, and you install each release yourself." Pogorelec wrote that the server, the database, and the firewall rules are the customer's to run, "and so is the job of keeping them patched and set up correctly."

#Where do model calls go?

Anthropic says: "Model requests go where you choose, whether that's Anthropic directly, your cloud provider (Amazon Bedrock, Google's Agent Platform, or Microsoft Foundry), or your own gateway." The docs say: "You host the service and the sandboxes. The model runs at Anthropic or at a provider that you choose."

The data and access page says: "Each model call carries the conversation so far, including prompts, tool inputs, and tool results." "The server connects to Anthropic only when the Claude API is its inference provider." When the Claude API is the provider, "A call to the Claude API also carries the IDs of its session and of that session’s agent and environment." "With these headers, Anthropic can attribute usage to a session, an agent, or an environment. No setting turns them off." "Under any other inference provider, the server never sends them."

On retention, Anthropic says: "If your organization has zero data retention (ZDR) in place with Anthropic, it applies to the requests sent to Claude in the same way as any other Messages API call." The docs explain that when Anthropic runs the service, "it stores session transcripts until you delete them." In the self-hosted option, the customer stores those transcripts.

#How to get it

The announcement says: "Contact your Anthropic account team to request access, or read the docs to learn more." The docs say access to the product and to the download is by request through the Anthropic account team. Pogorelec wrote: "The option opened as a private beta on November 12, and customers request access through their Anthropic account team."

Anthropic's quickstart starts the stack "on one machine with Docker Compose." It warns: "The Compose stack is for development, not for production." "For production, Anthropic recommends the release’s two Helm charts."

#How does it compare?

The docs set out three hosting options for Managed Agents:

The differences page lists capabilities that exist only on the self-hosted server, including a choice of inference provider: "The server can send model calls to a cloud provider or your own model gateway instead of the Claude API." The server can also store new vault secrets in the customer's own secret manager.

Some hosted features are missing. The same page says: "Nothing is copied from the hosted service, session history included." Customers have to create agents, skills, vault credentials and memory stores again on their server. The self-hosted server has only self-hosted environments, does not serve the rest of the Claude API such as the Messages API, and does not include the Files API, OAuth vault credentials for MCP, prebuilt docx, pdf, pptx and xlsx skills, or webhooks. It also has no routes for scheduled deployments and dreams.

Related coverage: Claude Sheets, Whiteboards and Claude Data.

Our analysis: Self-hosted Claude Managed Agents moves the harness, credentials and session history into the customer's cloud or on-premise environment, a step beyond hosting only the sandbox. The limit, stated by Anthropic and by Help Net Security, is that each model call still sends the conversation so far to an inference provider, and the credential proxy covers only MCP tools and supported API calls. Teams also take on patching and securing the server, database and firewall themselves, and they have to create agents, skills, vault credentials and memory stores again, because nothing is copied from the hosted service.