Anthropic Lets Enterprises Self-Host the Claude Agent Control Plane

Anthropic has opened a private beta for Self-hosted Claude Managed Agents, allowing organizations to run the agent orchestration stack in their own cloud account or on-premises. The announcement covers the Managed Agents server, database, execution workers, sandboxes, credentials, and session history.

Managed Agents provides APIs and infrastructure for running long-lived agents. Its control plane coordinates calls to Claude, dispatches tool operations, stores session state, injects credentials, and records activity. Keeping those components within an organization’s environment gives security teams direct control over agent data and access to internal systems.

The control plane changes hands

Anthropic now offers three deployment models with different ownership boundaries:

Claude inference still runs at the selected model endpoint. Organizations can route requests through Anthropic, Amazon Bedrock, Google Cloud, Microsoft Foundry, or an internal gateway. Prompts and model responses remain subject to the networking, retention, and compliance terms of that route.

Production access drove the shift

Agents that repair failed builds, test releases, triage alerts, or process bug backlogs need unattended access to proprietary code, internal services, and production credentials. The hosted control plane left transcripts, memory, and orchestration under Anthropic’s management even when tool execution occurred in a customer-operated sandbox.

The fully self-hosted model stores session history in the organization’s database. If an organization has a zero-data-retention agreement with Anthropic, that policy applies to requests sent to Claude under the same terms as other Messages API calls. Regulated deployments still require separate confirmation of HIPAA eligibility.

Inside an agent run

The organization-operated server receives each API call, loads the session state, and sends the model request to the configured endpoint. A typical run proceeds through four stages:

1. Request handling: The application calls the same Managed Agents API used by the hosted service.
2. Model routing: The server assembles the context and sends it through the configured provider or gateway.
3. Tool execution: A worker runs shell, file, or other supported tools inside an isolated sandbox.
4. State and telemetry: The server records results in the customer-operated database and exports activity to the configured observability system.

Using the same API surface across deployment modes should limit application changes when teams move an agent from Anthropic’s hosted service to their own infrastructure.

The sandbox remains the trust boundary

The self-hosted architecture preserves the security controls used by the hosted service while placing their configuration under customer control:

• Separated orchestration and execution: The agent loop, session history, and vault secrets stay outside the sandbox where model-generated code runs.
• Proxy-based credential injection: Credentials for MCP tools and supported API calls are added by a proxy outside the sandbox. Deployments can connect that proxy to an existing secrets manager.
• Per-environment network rules: Administrators define allowed hosts for each environment, and the firewall blocks other destinations. A build-repair agent might receive access only to a Git host and package registry.
• Auditable tool activity: Tool calls and responses are logged and can be exported through OpenTelemetry to an existing monitoring or security platform.

The beta carries real overhead

Every Managed Agents endpoint requires the managed-agents-2026-04-01 beta header, although Anthropic’s official SDK adds it automatically. Beta APIs and deployment requirements may change before general availability.

Anthropic’s earlier self-hosted-sandbox guidance listed two feature gaps: the service did not mount files or stage GitHub repositories, and memory was unavailable at launch. That guidance covers the earlier deployment mode, so teams evaluating the fully self-hosted beta should confirm the current status of both features.

Operating the control plane also transfers responsibility for capacity planning, upgrades, database durability, worker isolation, secret-store integration, and monitoring. The hosted service carries less operational work for prototypes and workloads whose policies permit vendor-managed orchestration.

Cloud rivals double as model routes

AWS, Google Cloud, and Microsoft already sell agent runtimes designed for customer cloud accounts. Anthropic’s beta competes for that orchestration layer while supporting those vendors as model routes. Organizations can keep the Managed Agents API and direct inference traffic through the provider that matches their contracts, network architecture, and compliance requirements.

Access stays gated

The private beta is limited to eligible organizations, which must request access through their Anthropic account team. Anthropic has not provided a self-service enrollment path or a general-availability date.