Anthropic has opened a private beta that lets companies run its Claude Managed Agents service entirely on their own infrastructure, moving the agent harness, sandboxes, credentials and session history inside the customer’s own cloud or data centre.

The self-hosted option was announced on 12 November 2026. Until now, Managed Agents ran on Anthropic’s servers, and companies that wanted the whole service inside their own perimeter had to build the platform themselves. Anthropic added self-hosted sandboxes in May 2026, which moved the code an agent runs onto customer hardware, but the agent itself, its credentials and its history still lived with Anthropic. The November update brings the rest in-house too.

Claude Managed Agents is Anthropic’s service for running Claude as an autonomous agent on long jobs that run without constant supervision: fixing broken builds, testing releases, triaging alerts and working through bug backlogs. The self-hosted version is aimed at organisations in regulated industries and large enterprises where data, credentials and audit records cannot leave the company’s own systems.

What runs on the customer’s side

A self-hosted deployment has three customer-operated pieces. The first is the Managed Agents server, known as cma-server, which serves the same Managed Agents API as the hosted service, runs the agent loop and stores agents, sessions and their histories. The second is a PostgreSQL database, version 16 or later, that holds that history; without it, the server keeps data only in memory and a restart wipes it. The third is the workers that run the shell and file tools inside the customer’s sandboxes.

Anthropic says the server never runs an agent’s shell or file tools itself. That separation is deliberate: the harness that calls Claude sits apart from the sandbox where the agent’s code runs, and the agent loop, session history and vault secrets sit outside the sandbox, with a sandbox starting only when a tool needs one.

Credentials stay out of the sandbox as well. For MCP tools and supported API calls, a proxy outside the sandbox attaches the credential to the request, and self-hosted customers can keep those credentials in their own secrets manager. Anthropic limits that protection to MCP tools and supported API calls, so teams need to check any other service an agent reaches before it goes live.

The model itself does not move

There is one thing that does not move home: the model. Every request to Claude still goes to an inference provider the customer picks — Anthropic by default, or Amazon Bedrock, Claude models on Google Cloud, Microsoft Foundry, or the customer’s own model gateway. Prompts therefore still leave the customer’s network and completions come back, even though the agent service itself runs inside it.

For organisations with a zero data retention agreement with Anthropic, those model requests are covered in the same way as any other call to the Messages API, Anthropic’s standard interface for model requests. Anthropic says it has no remote access to a customer’s self-hosted server or its logs.

Each environment can also be locked to a list of allowed hosts, with requests to any other host blocked. For an agent that fixes broken builds, Anthropic suggests the list might be just the git host and the package registry. Customers who host the sandbox enforce those limits in their own firewall, which makes the allowlist their configuration to get right.

What is missing, and who can join

The private beta is not a feature-for-feature copy of the hosted service. Scheduled deployments, dreams and webhooks are unavailable on the self-hosted server, and web search and web fetch stay switched off until a team explicitly enables them. Anthropic’s documentation describes a Docker Compose setup for development and warns that it is not appropriate for production, pointing teams toward Helm-based deployment tooling for a persistent install.

Access is deliberately narrow for now. The private beta is available only to eligible organisations, and the only channel is the Anthropic account team, which hands over the release archive; customers install each release themselves. Anthropic has published no pricing, no list of covered countries and no date for general availability.

Managed Agents also keeps a log of every step an agent takes, including each tool call it made and what it got back. The log exports over OpenTelemetry, so security teams can pipe it into the monitoring tools they already run and look at agent activity alongside everything else they watch.

The trade-off is operational: the server, database and firewall rules are now the customer’s to run, patch and configure correctly. For teams that held back because the harness, credentials and history sat outside their perimeter, that control — and responsibility — now sits with them.

Sources: Help Net Security and Anthropic Claude Platform Docs