Enterprises have been asking Anthropic the same question since AI agents started doing real work unattended: can the agent run inside our walls, not just yours? On November 12, 2026, Anthropic answered yes — with a caveat. Self-hosted Claude Managed Agents is now available in private beta, letting organizations run the full agent service in their own cloud or on-premises infrastructure. The harness, the sandboxes, the credentials and the session history all live on the customer’s side of the perimeter. The model itself does not — and that distinction is the whole story.
Claude Managed Agents is the service Anthropic uses to host autonomous Claude agents that work through long jobs on their own: fixing broken builds, testing releases, triaging alerts and chewing through bug backlogs. Anthropic introduced it as a hosted service on April 9, 2026, and later added self-hosted sandboxes, which moved an agent’s tool execution onto customer systems while Anthropic kept running the agent itself. The November 12 announcement brings the rest in-house, too. This time the entire control plane moves — server, database, workers, credentials and history — while the customer chooses where requests to Claude are sent.
What Runs on Your Side Now
The self-hosted setup has three customer-operated pieces. The first is cma-server, which exposes the Managed Agents API, runs the agent loop, stores agents and sessions, and calls the configured inference provider. The second is a PostgreSQL database (version 16 or later) that holds agents, sessions and their histories — without it, the server keeps data only in memory and a restart erases it. The third is the workers where agents run their shell and file tools inside sandboxes.
That server exposes the same Managed Agents API as Anthropic’s hosted service, apart from documented feature differences, so the Claude SDK and the ant CLI can connect to it. Anthropic’s documentation describes a Docker Compose setup for development and explicitly warns that the development configuration is not appropriate for production, recommending separate Helm-based deployment tooling for a persistent install.
Model requests go wherever the customer points them: to Anthropic directly, to Amazon Bedrock, to Claude Models on Google Cloud, to Microsoft Foundry, or to a customer-operated gateway. The provider is set with the inference.provider setting. One detail worth stating plainly: self-hosting the service does not by itself keep model traffic inside the customer’s network. Each model call still sends the conversation so far to the chosen provider, and the Claude model weights stay with the provider — this is not an on-premises model. Some organizations have a zero data retention (ZDR) agreement with Anthropic, which changes what happens to that traffic on Anthropic’s side.
Why Enterprises Wanted the Control Plane In-House
The use cases Anthropic names are all unattended jobs that need deep access to internal systems: fixing broken builds, testing releases, triaging alerts and working through bug backlogs. Those jobs are exactly the ones where a hosted control plane creates friction — session history, credentials and agent state sitting on someone else’s servers, governed by someone else’s retention and access policies.
Self-hosting answers that friction in four ways. First, data placement: agents, sessions and their full histories live in the customer’s database, under the customer’s backup and retention rules. Second, credentials: self-hosted customers can keep agent credentials in their own secrets manager rather than handing them to a hosted vault. Third, auditability: a full record of each step, including tool calls and what came back, can be exported over OpenTelemetry into the customer’s own observability stack. Fourth, isolation: the server connects to Anthropic only when the Claude API is the configured provider, and Anthropic says it has no remote access to the customer-run server or its logs.
The pattern is familiar from the wider agent market. NVIDIA’s OpenShell took agent security guardrails open source under the CNCF, and the governance tooling from Commvault and Zscaler aims at the same problem from a different angle — agents are becoming permanent infrastructure, and the companies running them want the same control over agents that they have over any other production system. Anthropic is betting that the enterprise answer is not a locked-down hosted service but a service enterprises can operate themselves.
What Is Missing — and What Migration Really Costs
The private beta is not a feature-for-feature copy of the hosted service, and teams planning a move should read the gaps before they start. Scheduled deployments, dreams and webhooks are unavailable on the self-hosted server. The web search and web fetch tools stay off until explicitly enabled, and their availability then depends on the inference provider. Teams moving from hosted Managed Agents also have to replace webhooks with polling for event-driven workflows.
Migration itself is a fresh start, not a transfer. Nothing is copied from Anthropic’s hosted service — not agents, not skills, not vault credentials, not memory stores, and not session history. Everything has to be recreated on the customer’s own server. That is a real cost, and it is also the point: the history that mattered enough to keep on Anthropic’s servers was the history enterprises were uncomfortable having there in the first place.
Access is deliberately narrow for now. The private beta is available only to eligible organizations, and the only channel is the Anthropic account team, which hands over the release archive; customers install each release themselves. Anthropic has published no pricing, no list of covered countries and no schedule for leaving beta. The Claude Code 2.1.319 release, with its deny-instead-of-prompting controls for unattended coding, shows the same direction of travel — more autonomy, but with guardrails enterprises can actually operate.
What to Watch Next
Three questions will decide how far self-hosted Managed Agents goes. First, will the missing features — scheduled deployments and webhooks in particular — arrive before general availability, or will enterprises have to build around them? Second, will the operational burden of running cma-server, PostgreSQL and workers be worth it for teams that do not have strict data-placement requirements? And third, how will rivals respond — Google’s Gemini Decisions API, launched just a day earlier, handles bounded agent decisions at a very different layer of the stack, while always-on assistants like Databricks Genie show how agents are becoming permanent coworkers rather than one-off tools.
The broader signal is that the agent market is splitting along a trust boundary. On one side are hosted agents for teams that want the work done with no infrastructure to run. On the other are self-hosted control planes for teams whose code, credentials and history cannot leave their perimeter. Anthropic has now planted a flag on both sides — and for regulated enterprises, the second side was the one that mattered.
Conclusion
Self-hosted Claude Managed Agents does not make Claude itself run on your servers, and it does not hide that fact. What it does is move everything around the model — the harness, the sandboxes, the credentials, the session history — into infrastructure the customer controls, with a choice of where model requests go. For enterprises that want autonomous agents working their backlogs without their agent state living on someone else’s cloud, that is the missing piece. It is in private beta now, available through Anthropic’s account team, with no public pricing or general-availability date yet — but the direction is unmistakable: agents are moving inside the perimeter, and the vendors that let them in will win the enterprise.
