It is 2 a.m. in a bank’s operations centre, and a build has just broken. An AI agent — one of Anthropic’s self-hosted Claude Managed Agents — notices, pulls the failing logs, and traces the fault to a single bad dependency. Before any human has woken up, it has a fix ready to review.
The work is flawless — except for one problem. Every step the agent took, every credential it touched, and every line of code it read lived on someone else’s servers. For the bank’s compliance team, that was the deal-breaker.
On November 12, Anthropic offered those teams a different deal. Self-hosted Claude Managed Agents, now in private beta, lets a company run the entire agent service inside its own cloud or data centre. The harness, the sandboxes, the credentials, and the session history all stay behind the company’s own walls.
There is a catch, and Anthropic is not hiding it. The model itself does not move home. Every time an agent needs Claude to think, that request still travels to a provider the customer picks. The walls move — but the brain stays in the cloud.
Self-Hosted Claude Managed Agents: What Anthropic Announced
Anthropic announced the private beta through its developer account, ClaudeDevs, and in the platform’s release notes, according to Help Net Security. The message was short: companies can now host the agent harness, sandboxes, and session history in their own cloud or on-premises, and choose where requests to Claude are sent.
Managed Agents is the service Anthropic uses to host autonomous Claude agents that work through long jobs on their own. It arrived as a fully hosted service in April 2026, and it was built for the unglamorous work that eats engineering weeks: fixing broken builds, testing releases, triaging alerts, and chewing through bug backlogs.
Later, Anthropic added self-hosted sandboxes. That step moved an agent’s tool execution onto customer systems, while Anthropic kept running the agent itself. The November 12 announcement brings the rest in-house too, and that is what makes it different from everything before it.
What Actually Runs on Your Side Now
A self-hosted setup has three customer-operated pieces. The first is cma-server, the Managed Agents server. It exposes the same API as the hosted service, runs the agent loop, and stores agents, sessions, and their histories.
The second is a PostgreSQL database, version 16 or later, that holds all of that history. Without it, the server keeps data only in memory — and a restart erases it. The third piece is the workers, the machines where agents actually run their shell and file tools inside the customer’s sandboxes.
One design choice matters here. The server itself never runs an agent’s shell or file tools. Tool execution stays in the workers, inside the sandboxes, so a rogue command cannot touch the machine that holds the session records.
Because the server exposes the same Managed Agents API as the hosted service, apart from documented differences, the usual tools connect to it directly. The Claude SDK and the ant command-line tool work against a self-hosted server the same way they work against Anthropic’s cloud.
The Model Still Calls Home
Here is the part that surprises people. Self-hosting the service does not mean self-hosting Claude. Each model call goes to a provider the customer picks: Anthropic by default, or Amazon Bedrock, Claude Models on Google Cloud, Microsoft Foundry, or the customer’s own model gateway.
The choice is set with the inference.provider setting. And the company is clear about the boundary: Anthropic has no remote access to the server or its logs. The server only connects to Anthropic when the provider is the Claude API.
That distinction changes the security picture in a useful way. The agent’s history, its credentials, and its tool activity stay inside the customer’s perimeter. The model traffic does not — unless the customer routes it through its own gateway, or relies on a zero data retention agreement with Anthropic.
Anthropic built Managed Agents around four security principles, and the self-hosted version keeps them. Companies can keep agent credentials in their own secrets manager instead of handing them to a hosted service. Every step an agent takes, including each tool call and what came back, can be exported over OpenTelemetry for auditing.
What You Give Up in the Move
The private beta is not a feature-for-feature copy of the hosted service, and teams planning a move should read the gaps first. Scheduled deployments, dreams, and webhooks are all unavailable on the self-hosted server.
Web search and web fetch stay switched off until a team explicitly enables them. Anthropic’s documentation also warns that the Docker Compose setup it describes is for development only — it is not appropriate for production, and a persistent install needs separate Helm-based deployment tooling.
Nothing transfers from the hosted service either. Agents and saved data have to be rebuilt from scratch on the new server. And the operational work Anthropic used to handle — securing the server, patching it, keeping it running — now belongs to the customer.
There is also no public price, no list of covered countries, and no schedule for leaving beta. Access is deliberately narrow: the only channel is the Anthropic account team, which hands over the release archive, and customers install each release themselves.
Why Companies Wanted This Anyway
So why would anyone take on that work? The answer is the same one that has slowed AI agents in regulated industries for two years: control. Banks, hospitals, and government contractors have data that cannot leave their walls, and an agent that reads their code is an agent that sees their secrets.
Keeping credentials, session history, and tool logs inside the customer’s own environment removes the biggest objection those teams had. It also fits a pattern at Anthropic. The same week brought Claude Code 2.1.319, with deny-instead-of-prompting controls for unattended coding — more autonomy, but with guardrails a company can actually operate.
The timing is not accidental either. Anthropic is in the middle of its IPO roadshow, pricing expected around November 18, and it is pitching enterprises hard. That same day, it launched Claude for Manufacturing, a plugin with 17 skills and connectors to Autodesk Fusion, Infor, Microsoft 365, and Oracle NetSuite.
The message to big customers is consistent: Claude is not just a chatbot you visit, it is a workforce you can run — and now, a workforce you can run on your own machines.
What Happens Next
For now, most companies will have to wait. The private beta is available only to eligible organisations, and Anthropic has said nothing about when it will open more widely. The hosted service is not going anywhere, and for teams without strict data rules it remains the simpler option.
But the direction is clear. Agents that work unattended — fixing builds at 2 a.m., triaging alerts, grinding through backlogs — need the same trust as any employee with production access. Anthropic’s bet is that the way to earn that trust is to let the agent live where the work lives.
The bank’s compliance team, the one that said no to a hosted agent reading its code, may finally have an answer it can accept. The agent still phones home to think. But its memory, its keys, and its work now stay inside the building.
