Anthropic Lets Companies Run Claude's Agent Service Behind Their Own Firewall, but Claude Itself Still Runs Outside It
Anthropic released self-hosted Claude Managed Agents in private beta on November 12. Customers run the agent harness, sandboxes, credentials and session history in their own cloud or on-premises, operating the server, its database and the workers, and send model requests to Anthropic, Amazon Bedrock, Google's Agent Platform, Microsoft Foundry or their own gateway. Claude itself does not run inside the customer's network. Access is by request through Anthropic account teams, and The Next Web reports that some hosted features, such as webhooks and scheduled runs, are missing.
The selling point is where the agent's records and keys live, not where the model runs. Anthropic released self-hosted Claude Managed Agents in private beta on November 12, letting companies run its agent service in their own cloud or data centre. Agents, credentials and session history stay on the customer's systems; each request to Claude still leaves them.
What moves in-house#
Managed Agents is Anthropic's set of APIs for building long-running agents that use tools and keep session history. Until now Anthropic hosted the service, and customers could host only the sandbox where an agent's code runs. In the self-hosted version, the customer runs the Managed Agents server, its database and the workers where agents run their shell and file tools, Anthropic says. Session history sits in the customer's database, and credentials can be kept in the customer's own secrets manager.
Model requests go wherever the customer points them: to Anthropic directly, to Amazon Bedrock, Google's Agent Platform or Microsoft Foundry, or to the customer's own gateway. Developers use the same core APIs as the hosted service. Customers with a zero data retention agreement get the same treatment for these requests as for any other Messages API call, Anthropic says. Access is by request through an Anthropic account team.
The trade#
Anthropic frames the product around four security principles that apply however the service is hosted: the harness that calls Claude is kept separate from the sandbox, credentials stay out of the sandbox, network access can be limited to a list of allowed hosts, and every step is logged and exportable over OpenTelemetry. Help Net Security notes that the credential proxy covers only MCP tools and "supported API calls", and that customers who host the sandbox enforce the host allowlist in their own firewall.
The cost is operational. Customers now patch and configure the server, database and firewall rules, and nothing transfers from the hosted service, so agents and saved data must be rebuilt, The Next Web reported. It said some features, including webhooks and scheduled runs, are missing. Anthropic has offered other hosting choices recently, such as an Anthropic-managed Claude option on Google Cloud, and rivals like Mistral are building their own managed agent runtimes.
Limits#
- This is a private beta; Anthropic gave no pricing, general-availability date or list of early customers.
- The missing-features detail comes from The Next Web; Anthropic's announcement does not list them.
- Keeping the agent service in-house does not keep prompts in-house: Claude runs at Anthropic or the chosen cloud provider.
Sources#
- Anthropic: Operate Claude Managed Agents inside your security perimeter (November 12, 2026)
- Help Net Security: Self-hosted Claude Managed Agents keeps agent credentials in your environment (November 12, 2026)
- The Next Web: Anthropic lets companies run Claude's agent service on their own servers (November 12, 2026)