Self-hosted Claude Managed Agents: what you run, what still leaves your network

Anthropic opened a private beta of self-hosted Claude Managed Agents on Nov 12. Access is by request through your Anthropic account team. Before this, you could self-host the sandbox where an agent's code runs, but Anthropic ran the rest, including credentials and the record of what each agent did. Now the whole service can sit in your cloud or on-prem. What you operate: the Managed Agents server its PostgreSQL database (session history lives here) the workers where agents run shell and file tools You build agents with the same core APIs as the hosted service. What still leaves your network is Claude itself. Model requests go where you point them: Anthropic, Amazon Bedrock, Google's Agent Platform, Microsoft Foundry, or your own gateway. Prompts out, completions back. Zero data retention agreements cover those requests like any other Messages API call. Security bits worth knowing: Agent loop, session history and vault secrets sit outside the sandbox, and credentials stay out of it too A proxy outside the sandbox attaches credentials for MCP tools and supported API calls, and you can keep them in your own secrets manager That covers MCP tools and supported API calls only, so check any other service your agent reaches Per-environment host allowlists block everything else, and when you host the sandbox the limits live in your firewall Every tool call and result is logged and exports over OpenTelemetry The cost is ops work. Patching, securing and configuring the server, database and firewall is on you. The Next Web also reports nothing migrates from the hosted service and webhooks and scheduled runs are missing for now (single outlet, check the docs). Sources: Anthropic: https://claude.com/resources/articles/self-hosted-claude-managed-agents Help Net Security: https://www.helpnetsecurity.com/2026/11/12/anthropic-self-hosted-claude-managed-agents/ The Next Web: https://thenextweb.com/news/anthropic-self-hosted-claude-managed-agents