Anthropic lets companies host its AI agent service in private beta

Companies can now run the machinery behind Claude’s autonomous agents inside their own cloud or data center—not just the workspace where agents execute code. Anthropic introduced self-hosted Claude Managed Agents in private beta on November 12, 2026. The shift gives customers control over the service and its stored history, while model requests still go to a chosen provider.

From hosting the workspace to hosting the service

Managed Agents began as an Anthropic-hosted service. It supplies the software that coordinates an agent’s work, handles credentials and preserves session history. Anthropic later added self-hosted sandboxes: isolated workspaces where customers could run an agent’s tools while Anthropic continued operating the service.

The new option moves that remaining service into the customer’s environment. Anthropic describes the demand as coming from teams whose agents work unattended on internal code and systems, doing jobs such as fixing broken builds and triaging alerts. Those teams may want control over more than the place where code runs.

Customers operate a server that receives requests, coordinates model calls and stores agents, sessions and their histories. Separate workers run shell commands and file tools in sandboxes; the server never executes those tools itself. The service uses the same programming interface as the hosted version, so Anthropic’s software development kit and ant command-line tool can connect to it.

Self-hosting does not bring the model on-premise

The distinction is important for teams deciding what can leave their network. The model runs at Anthropic or another chosen provider. Supported routes include Amazon Bedrock, Claude Models on Google Cloud, Microsoft Foundry and a customer’s own model gateway. Anthropic’s Claude API is the default destination.

For every model call, the server sends the conversation accumulated so far, including tool inputs and results. Calls to the Claude API also carry identifiers for the session, agent and environment. Keeping session history in a customer database therefore does not mean keeping all conversation content inside that network.

Anthropic says an organization’s existing zero-data-retention arrangement applies to requests sent to Claude just as it does to other Messages API calls. That is a condition attached to an existing arrangement, not a blanket retention promise for every self-hosted deployment.

The customer becomes the operator

Self-hosting shifts operational responsibility alongside control. Customers must secure the server, database and sandboxes, detect unusual usage and install each release themselves. Persistent storage requires PostgreSQL 16 or later. Without a database, the server holds data in memory, and a restart erases it.

The security documentation makes a particularly concrete warning: an agent’s bash tool is a real shell with the worker process’s permissions and network access. The worker does not isolate it. Protection depends on the container or virtual machine around it, and Anthropic advises disposable environments containing nothing that needs protection when customers start workers themselves.

• Credential handling: Anthropic says supported API requests can receive credentials through a proxy outside the sandbox; self-hosted customers can use their own secrets manager.
• Network limits: Customers hosting sandboxes set allowed network access through their own firewall.
• Activity records: Session records include tool calls and results and can export through OpenTelemetry to existing monitoring tools.

Access remains gated through Anthropic account teams. Before requesting the download, teams also need to check feature compatibility: some capabilities remain exclusive to the hosted service. For customers who only need tools to run on their infrastructure, Anthropic still directs them to self-hosted sandboxes rather than operating the full service.