# Claude Managed Agents, Explained for Operators > Claude Managed Agents is Anthropic's hosted platform for running AI agents: you define the agent, Anthropic runs the loop and the sandbox its tools execute in. Here is how it works and when to reach for it. *6 min read · Published 2026-07-04 · [Muhammad Idrees](https://adrees.dev/about)* Every agent post so far has been about frameworks you run yourself. Claude Managed Agents is the other model entirely: Anthropic runs the loop and hosts the sandbox, and you bring the agent and its guardrails. Knowing which half you own is the whole decision. ## Key takeaways - Claude Managed Agents is Anthropic's hosted platform for running agents: you define a persisted, versioned agent (model, prompt, tools) and Anthropic runs the agent loop and provisions a sandboxed container per session where its tools execute. - It decouples the brain from the hands: the loop and orchestration are Anthropic's, the tool sandbox is Anthropic's, and you own the agent's definition, its credentials, and its guardrails. - Credentials live in vaults and never enter the sandbox; they are injected into outbound requests at egress, so a compromised or prompt-injected agent cannot read or exfiltrate your keys. - Reach for managed when you want a stateful agent with a workspace without building loop, sandbox, and session infrastructure; stay on the API's own tool-use loop when you need to host the compute or run a custom runtime. ## What Claude Managed Agents actually is Claude Managed Agents is Anthropic's hosted platform for running agents. The difference from a plain API call is the shape of the work: you do not just send a prompt and read text back. You register an agent: a persisted, versioned configuration of a model, a system prompt, a set of tools, MCP servers, and skills. Then you start sessions against it. Each session runs on Anthropic's orchestration layer and gets its own sandboxed container as a workspace. The mental model is agent, then session, then environment, then container. The agent is the reusable definition; a session is one run of it; the environment is the template for the container; the container is where bash, file edits, and code actually execute. As of 2026 it is a beta product, but the shape is stable enough to build on. ## Brain and hands, decoupled The agent loop (perceive, reason, act, repeat) runs on Anthropic's side. The tools it calls run in the container. That separation is the whole point of the word managed: you do not stand up the loop, you do not run the sandbox, and you do not persist session state. You create the agent once, reference it by ID, and every session inherits its configuration. Because the agent is versioned, you can iterate on the prompt or add a tool without breaking sessions already running on the old version, and pin a session to a known-good version when you need reproducibility. That is a real operational win over a hand-rolled loop, where "what changed" is a much harder question to answer. ## Tools, integrations, and staying in the loop There are three kinds of tools. A built-in toolset (bash, file read, write, and edit, plus search and web fetch), MCP servers for third-party systems like GitHub or Slack, and custom tools that your own application answers. MCP is how the agent reaches the systems a client already runs without you writing a bespoke integration for each one. Autonomy stays a dial, not a switch. Per-tool permission policies let you auto-run the safe calls and gate the risky ones: the session pauses and waits for an explicit approval before it acts. That is human-in-the-loop wired into the platform rather than bolted on afterwards, the same discipline we apply to every agent we ship. ## Where the security story beats DIY The credential model is the strongest part. Secrets live in vaults and never enter the container; they are injected into outbound requests at the edge, after the request has already left the sandbox. So code running in the sandbox, including anything the agent writes and anything a prompt injection coerces it into writing, cannot read or exfiltrate a key. That closes the exact hole that burned the permissive local-first frameworks. Around that sit the rest of the platform primitives: isolated per-session containers, scoped tool permissions, and an event stream that records every message, tool call, and result for audit. Memory stores give an agent state that survives across sessions; multi-agent orchestration lets a coordinator delegate to specialist sub-agents; scheduled deployments fire sessions on a cadence. It is a great deal of the wiring we would otherwise build by hand. ## When we'd reach for it, and when we wouldn't We reach for managed when a client wants a stateful agent with a real workspace and does not want to own the loop, the sandbox, and the session plumbing. The default models fit the range of work: Opus 4.8 for the hard reasoning, Sonnet 5 for cost-sensitive production, Haiku 4.5 for routing and extraction. Anthropic runs the compute; we concentrate on the agent's definition, its guardrails, and how we evaluate it. We stay on the API's own tool-use loop when a client needs to host the compute themselves, run a custom tool runtime, or keep everything on infrastructure they control. Managed offers a self-hosted sandbox for the middle case, where the loop stays with Anthropic but the tools run on hardware you own. If you are weighing hosted-and-managed against the local-first, own-the-runtime approach, the companion pieces "What Is OpenClaw? The Local-First AI Agent, Explained" and "Hermes Agent, Explained for Operators" cover the other side of the decision. ## FAQ **What is Claude Managed Agents?** Claude Managed Agents is Anthropic's hosted platform for running AI agents. You define a persisted, versioned agent (its model, system prompt, and tools) and start sessions against it; Anthropic runs the agent loop and provisions a sandboxed container per session where the agent's tools, such as bash, file operations, and code, actually execute. As of 2026 it is a beta product. **How is Claude Managed Agents different from building an agent on the Claude API directly?** With the Claude API's tool-use loop you own everything: the loop, the compute, session state, logging, and the sandbox your tools run in. With Managed Agents, Anthropic runs the loop and hosts the tool-execution container, and the agent config is a persisted, versioned object. A common path is to prototype on the raw API and move to Managed Agents for stateful, long-running production work. **Are Claude Managed Agents secure with sensitive credentials?** Yes, by design. Credentials are stored in vaults and never enter the session's container; they are injected into outbound requests at egress, so code running in the sandbox, including anything the agent writes or is coerced into writing by a prompt injection, cannot read or exfiltrate them. Combined with isolated containers, scoped tool permissions, and a full event-stream audit trail, that is a stronger default posture than most hand-rolled agents. **When should you use Claude Managed Agents instead of a local-first agent framework?** Choose Managed Agents when you want a hosted, stateful agent with a real workspace and do not want to build the loop, sandbox, and session infrastructure yourself. Choose a local-first framework like OpenClaw or Hermes Agent when you need to own the runtime and keep everything on your own hardware. Managed Agents also offers a self-hosted sandbox for the middle ground, where Anthropic runs the loop but tools execute on infrastructure you control. ## Sources - [Anthropic — Claude Managed Agents overview](https://platform.claude.com/docs/en/managed-agents/overview) --- Canonical page: https://www.sentientarc.com/blog/what-are-claude-managed-agents