Anthropic published a first-party article, dated November 12, 2026, introducing self-hosted Claude Managed Agents. The company said customers can now run agents in their own cloud or on-premises environment, hosting the agents, credentials and session history and choosing where requests to Claude are sent. The offering is in private beta, and access is requested through an Anthropic account team. The story was first flagged in this run as a lead in the November 13 issue of TLDR AI, then resolved to the Anthropic article and to official documentation. Help Net Security's Anamarija Pogorelec reported the same launch on November 12.
Anthropic had already offered Managed Agents as a hosted service on the Claude Platform, and had added self-hosted sandboxes for teams that needed agent code to stay in their own environment. The new option goes further. Anthropic says every part of the service, the harness, sandboxes, credentials and session history, runs in the customer's environment. Official docs describe three hosting patterns. In the default, Anthropic hosts sandboxes, the service and the model. With self-hosted sandboxes, the customer hosts only the isolated workspaces where tools run. With self-hosted Managed Agents, the customer hosts both the sandboxes and the service, and may send model calls to Anthropic, Amazon Bedrock, Claude models on Google Cloud, Microsoft Foundry, or a gateway they operate.
What the customer operates, according to the article and the docs, is the Managed Agents server (documented as cma-server), a PostgreSQL 16 or later database for agents, sessions and history, and workers that run shell and file tools in sandboxes. Developers still use the same core APIs as the hosted service. The docs say the SDK and the ant CLI work with a customer's server. Session history stays in the customer's database. If the organization has a zero data retention agreement with Anthropic, the company says it applies to model requests in the same way as other Messages API calls. Help Net Security underlined a limit that the docs also make explicit: Claude itself still runs outside the customer's network, so prompts go out and completions come back. This is self-hosted orchestration, not an on-premises copy of the model.
Anthropic describes four design principles that apply in hosted and self-hosted modes. The harness that calls Claude is kept separate from the sandbox where code runs. Credentials stay out of the sandbox, with a proxy attaching them for MCP tools and supported API calls, and self-hosted customers may use their own secrets manager. Network access can be limited to an allowlist of hosts. Every session leaves a record, which can be exported over OpenTelemetry. Help Net Security noted that the credential-proxy protection is limited to MCP tools and "supported API calls," so other services an agent reaches are worth checking. Anthropic's docs also warn that the agent's bash tool is a real shell with the worker's permissions, and that isolation is the customer's responsibility.
The docs say some features exist only on the hosted service and that customers should read the differences list before choosing self-hosting. They also say the customer installs each release and is responsible for securing the server, hosting memory stores and detecting unusual usage. No general-availability date or public pricing was stated in the article, the docs, or the Help Net Security report. Until the beta expands, the verified event is that Anthropic has opened a private, account-team-gated path for enterprises to run the Managed Agents control plane themselves, while the model remains with Anthropic or another chosen provider.