Anthropic's Claude Managed Agents Finally Work on Your Own Infrastructure

Anthropic pushed three updates to Claude Managed Agents that plug real holes in its enterprise agent stack. Memory now works when your agent runs on your own infrastructure, web tools accept domain filters, and the console session viewer gets a redesign with per-thread cost tracking. All three are live today.

Memory crosses the self-hosted boundary

Managed Agents lets you run the agent loop on Anthropic's servers while tool execution happens inside your own environment. The agent loop that handles orchestration, context management, and error recovery stays on Anthropic's infrastructure, while tool execution moves to your own configured environment, so files and repositories don't leave your perimeter. That model shipped earlier this year, but it came with a notable gap: memory stores didn't work with self-hosted sandboxes at launch, so if your agent depended on persistent memory, you had to stay on cloud sandboxes.

That's fixed now. On self-hosted sandboxes, each memory store's directory is a local copy that the SDK worker manages rather than a live mount, and the worker reconciles each copy with its store after tool calls, at most once per sync interval (15 seconds by default), and once more when the session ends. Stores materialize under /mnt/memory/, one directory per store at the store's mount path. Writes under the mount path are persisted back to the store and stay in sync across sessions that share it, while writes to any other path under /mnt/memory/ fail because the sandbox mounts that parent directory read-only.

Practically, this means an agent doing a nightly ETL job on data that can't leave your VPC can now remember what it did last night without you building your own persistence layer.

Domain allowlists for web tools

The second update adds allowed_domains and blocked_domains parameters to the web_search and web_fetch tools inside Managed Agents. You provide allowed_domains or blocked_domains, not both, or the API returns a 400 error, and entries are bare domains with an optional path like example.com or example.com/blog, without a scheme.

The web search tool docs note an important detail for anyone already using org-level restrictions: those organization-level settings in the Claude Console apply to Messages API requests only, and Claude Managed Agents sessions use only the per-tool allowed_domains and blocked_domains lists on the agent toolset. So if you're mixing Messages API and Managed Agents, you need to configure both.

Configuration looks like this on the agent toolset:

tools = [
  {
    "type": "web_search_20260318",
    "name": "web_search",
    "allowed_domains": ["arxiv.org", "github.com", "docs.python.org"],
    "max_uses": 10
  },
  {
    "type": "web_fetch",
    "name": "web_fetch",
    "blocked_domains": ["twitter.com", "reddit.com"]
  }
]

Use cases are the obvious ones: research agents pinned to trusted sources, compliance-sensitive workflows that need an auditable read surface, and prompt-injection hardening by keeping the model away from untrusted content it might otherwise scrape.

The console gets real observability

The third update reworks the session viewer for multi-agent debugging. The new layout adds:

• A minimap with one lane per agent, so you can see parallel work across sub-agents at a glance
• A streaming transcript grouped by agent iteration, rather than a flat log
• An inspector showing cost in dollars, per thread and per session

The cost breakdown is the most immediately useful piece. Multi-agent runs have been notoriously opaque to price, since a single user request can spawn a tree of sub-agents each burning tokens on their own tool calls and retries. Having a dollar figure attached to each thread makes it much easier to catch a runaway sub-agent or figure out which delegation pattern is actually cost-effective.

Why these three land together

Individually these are small features. Together they close the last major gaps that were pushing teams to build custom agent infrastructure instead of using the managed product. MCP tunnels and self-hosted sandboxes completed the enterprise security story earlier this year, with the orchestration brain living with Anthropic where model reliability, retry logic, and memory management live, and the sensitive parts, what data gets touched and where code runs, staying under your control. Memory in self-hosted sandboxes extends that architecture to stateful workflows, domain controls tighten the trust boundary for web tools, and the console finally makes multi-agent sessions inspectable in production.

If you were evaluating Managed Agents and hit one of these three walls, it's worth another look.