Anthropic Ships Self-Hosted Claude Agents With In-VPC Secrets

(SAN FRANCISCO —) Anthropic has opened a private beta for a self-hosted edition of Claude Managed Agents, shifting the entire agent control plane—including the orchestration harness, sandboxed workers, credential proxies, and session history—inside customer-managed cloud VPCs or on-premise data centers. Announced on November 12 with access gated through Anthropic account teams, the release directly targets enterprises running unattended autonomous agents across production engineering workflows such as repairing broken CI builds, validating release candidates, triaging operational alerts, and clearing bug backlogs.

Previously, organizations adopting Managed Agents faced a split-plane compromise: they could self-host the execution sandbox where agent-generated code ran, but Anthropic still operated the surrounding orchestration service, credential handling layer, and execution audit trail. Teams operating under strict data-residency or secret-containment mandates had no choice but to engineer bespoke agent harnesses internally. By packaging the Managed Agents server, its PostgreSQL state store, and tool-execution workers for customer-operated infrastructure while preserving identical core APIs, Anthropic removes that build-versus-buy barrier while keeping Claude model inference external.

Technical Architecture & Engineering Breakdown

Autonomous coding and operations agents introduce a fundamentally different threat model than interactive chat interfaces. When an agent operates unattended—pulling repositories, executing shell commands, installing dependencies, and invoking internal APIs—human-in-the-loop approval at every tool call collapses throughput. Anthropic’s engineering premise for Managed Agents is explicit: because organizations cannot rely on a human reviewer inspecting every intermediate step, structural limits must be enforced by the runtime architecture itself.

Decoupling the Agent Harness, PostgreSQL State, and Tool Workers

In the self-hosted topology, the customer’s operations team provisions and maintains three distinct infrastructure components: the Managed Agents server, a backing PostgreSQL database, and the worker nodes that host isolated sandboxes for shell and file tools. Application developers continue targeting the exact same core APIs exposed by Anthropic’s hosted service, ensuring portability between hosted prototypes and hardened production deployments.

The Managed Agents server acts as the control plane. It drives the agentic reasoning loop, dispatches model requests to the configured inference endpoint, and persists every turn, tool invocation, and state transition into the customer’s PostgreSQL instance. Because session history resides exclusively in that customer-owned database, sensitive repository snippets, stack traces, and internal ticket context accumulated across long-running sessions never sit in a vendor-managed multi-tenant store. Meanwhile, the worker tier remains stateless and ephemeral: a sandbox container or microVM is spun up only when a tool invocation explicitly requires code execution or filesystem manipulation.

This separation directly addresses the class of vulnerabilities highlighted in recent agent sandbox breach analyses, where co-locating orchestration state or ambient credentials inside the same execution boundary as untrusted model-generated code allowed prompt injections or malicious package scripts to pivot laterally. By keeping the harness, session store, and secret material strictly outside the worker sandbox, a compromised shell execution environment cannot read historical sessions or extract long-lived tokens from memory.

The Four Security Principles: Enforcing Limits in System Design

Anthropic designed Managed Agents around four foundational security invariants that apply uniformly across fully hosted, hybrid-sandbox, and fully self-hosted deployments. Understanding how responsibility shifts under self-hosting is critical for platform architects:

• Harness-to-Sandbox Isolation: The control-plane harness that communicates with Claude sits outside the execution sandbox. The agent loop, session history, and vault secrets never enter the sandbox filesystem or environment variables, and sandboxes initialize on demand rather than idling with persistent state.
• Out-of-Sandbox Credential Proxying: Credentials remain outside the execution environment. For Model Context Protocol (MCP) tools and supported API calls, an external proxy intercepts outbound requests from the sandbox and attaches the required authentication headers or tokens in flight. Self-hosted teams back this proxy with their own enterprise secrets manager.
• Host-Level Network Allowlisting: Each agent environment can be pinned to an explicit allowlist of permitted destination hosts, dropping all other egress traffic. For a build-repair agent, Anthropic notes that this allowlist may be restricted solely to the corporate Git host and an internal package registry.
• Step-Granular OpenTelemetry Logging: Every action an agent performs—each tool call and its corresponding return payload—is emitted as structured telemetry over OpenTelemetry (OTel), enabling security operations centers to correlate agent behavior alongside standard infrastructure and SIEM logs.

Credential Proxying, MCP Scope Boundaries, and Egress Allowlists

The credential proxy mechanism is arguably the highest-leverage security boundary in the self-hosted release, yet it carries an important operational caveat that architects must audit prior to production rollout. Anthropic explicitly scopes its credential-injection protection to MCP tools and “supported API calls.” Any third-party service, legacy internal webhook, or custom CLI binary that an agent reaches outside those supported pathways will not automatically benefit from proxy-level token attachment.

In practice, this means platform security teams must inventory every downstream endpoint an unattended agent can touch—especially as organizations adopt proactive agent architectures that trigger autonomously on CI failures or monitoring alerts. If a build tool requires an unproxied token or SSH key inside the worker, that secret re-enters the blast radius of the sandbox. Similarly, in the self-hosted model, the host allowlist is no longer enforced by Anthropic’s cloud edge; it becomes the customer’s firewall and network-policy configuration to get right. A misconfigured egress rule on the worker subnet can silently negate the host-pinning guarantee.

Benchmark Evaluation & Rigorous Architectural Comparison

Because self-hosted Claude Managed Agents is a control-plane and security-architecture release rather than a new foundation model checkpoint, its performance cannot be measured via static coding benchmarks like SWE-bench Verified or HumanEval. Model reasoning capability remains invariant—determined by whichever Claude model version the customer targets via the inference endpoint. Instead, the decisive engineering evaluation lies in comparing operational isolation, credential residency, and maintenance overhead across the four viable enterprise deployment topologies.

Compared to the hybrid customer-sandbox option, full self-hosting closes the remaining governance gap: session transcripts and credential routing never traverse Anthropic’s orchestration tier. Compared to building a DIY harness from scratch, teams avoid re-implementing loop state machines, MCP credential injection, and OpenTelemetry instrumentation while retaining standard Managed Agents APIs.

Deployment, Infrastructure Footprint & Inference Routing

Unlike open-weight model deployments where engineering teams size GPU clusters for VRAM footprints and KV-cache concurrency, self-hosting Claude Managed Agents is a CPU, memory, I/O, and network-policy exercise. The customer’s infrastructure hosts the control-plane server, PostgreSQL persistence, and sandboxed worker pools—not the foundation model weights.

Hybrid Inference Paths: Messages API, Bedrock, Foundry, and ZDR

Because Claude itself continues to execute outside the customer’s network boundary, every reasoning turn generates outbound prompt traffic and receives inbound completion payloads. Anthropic provides explicit routing flexibility for this inference leg: operators can point the Managed Agents server directly at Anthropic’s Messages API, route through cloud-provider endpoints such as Amazon Bedrock, Google’s Agent Platform, or Microsoft Foundry, or terminate traffic at an internal corporate LLM gateway for centralized rate-limiting and DLP inspection.

For regulated enterprises with a Zero Data Retention (ZDR) agreement with Anthropic, model requests originating from the self-hosted Managed Agents server are governed identically to standard Messages API calls under ZDR. This architectural split—local state and secrets, remote stateless inference—also integrates cleanly with broader enterprise automation stacks, allowing teams already orchestrating event-driven workflows via tools like n8n to hand off complex, multi-step repository or incident-remediation tasks to an isolated Managed Agents worker pool.

OpenTelemetry Step Auditing and Operational Patch Responsibility

When an unattended agent modifies source code or triages a production incident at 3:00 AM, post-hoc reconstructability is non-negotiable. Managed Agents emits an OpenTelemetry trace for every discrete step, capturing the exact tool invoked, its arguments, and the returned output. Piping this stream into Datadog, Splunk, Grafana Tempo, or an internal SIEM lets SecOps teams correlate agent shell commands directly against network firewall drops and secret-access logs.

That operational visibility comes with a clear transfer of ownership. By moving the Managed Agents server, PostgreSQL database, worker fleet, and egress firewall rules inside their own perimeter, customer platform teams inherit full lifecycle responsibility. Database vacuuming, TLS rotation, server upgrades, worker image patching, and strict validation of host allowlists now sit squarely on internal SRE and security engineering teams.

# Customer-Operated 3-Tier Control & Execution Plane
control_plane:
  server: "managed-agents-server:latest"       # Same core API as hosted service
  state_store:
    engine: "postgresql"                       # Session history stays in-perimeter
    ssl_mode: "verify-full"
  inference_router:
    target: "internal-llm-gateway"             # Routes to Messages API / Bedrock / Foundry
    zdr_policy: "enforced"

security_boundaries:
  credential_proxy:
    backend: "customer-secrets-manager"        # Vault/KMS outside sandbox
    scope: ["mcp-tools", "supported-apis"]     # Audit non-supported services pre-prod
  worker_sandbox:
    ephemeral: true                            # Starts only when tool requires sandbox
    egress_allowlist:                          # Enforced by customer VPC firewall
      - "git.internal.corp:443"
      - "registry.internal.corp:443"

telemetry:
  exporter: "otlp"
  endpoint: "https://otel-collector.internal.corp:4317"
  capture: ["tool_calls", "tool_responses", "step_latency"]

For organizations that have delayed deploying autonomous build-repair or alert-triage agents due to multi-tenant secret exposure or compliance prohibitions on vendor-hosted session logs, Anthropic’s self-hosted Managed Agents beta removes the primary architectural blocker—provided internal teams are prepared to own the underlying database, network policy, and patching discipline.