Claude Managed Agents Explained: Anthropic's New Way to Run AI at Scale

Most AI agent demos are deceptively simple. The hard part isn't getting Claude to complete a task — it's keeping it running reliably when the task takes hours, spans multiple tool calls, hits unexpected errors, or needs to resume after a crash. The engineering teams that have shipped agents in production will tell you: the majority of the work is the harness, not the model. (See also: Claude Code Routines) (See also: Claude API pricing) (See also: Model Context Protocol) Project Glasswing: How Anthropic Is Using Claud... KPMG Just Gave 276,000 Employees Access to Clau...

Claude Managed Agents abstracts that harness. Instead of building your own session management, execution sandboxes, retry logic, and credential vaulting, you hand that off to Anthropic's infrastructure. Your code defines what you want the agent to do. Managed Agents handles making it durable.

Anthropic built Managed Agents around a key architectural decision: decouple the three components of an agent into independent interfaces.

This mirrors how operating systems virtualized hardware decades ago. The read() command works the same whether it's hitting a 1970s disk pack or a modern SSD. Managed Agents applies the same thinking: stable interfaces on top, swappable implementations underneath.

Before decoupling, Anthropic ran all three components in a single container. If the container crashed, the session was lost. If it was unresponsive, engineers had to shell into it — which was also where user data lived, creating a security problem. And if a customer wanted to connect Claude to their own VPC, they had to peer their network with Anthropic's, because the harness assumed everything it needed was sitting next to it.

After decoupling: if a sandbox dies, the harness catches it as a tool-call error and provisions a new one. If the harness crashes, a new one boots, calls getSession(id) to retrieve the event log, and resumes from the last event. No data loss. No manual intervention. Containers become cattle, not pets.

One of the trickier problems in agentic systems is credential security. If Claude generates and runs code in a sandbox, and that sandbox also has access to API keys, a prompt injection attack only needs to convince Claude to read its own environment. Managed Agents solves this structurally.

Credentials never reach the sandbox where Claude's generated code runs. For Git, repos are cloned using the access token during sandbox initialization and wired into the local git remote — Claude can push and pull without ever handling the token directly. For custom tools and OAuth integrations, tokens are stored in a secure vault. Claude calls tools via a dedicated proxy that fetches credentials from the vault at call time. The harness never sees credentials at all.

Long-horizon tasks — the ones Managed Agents is designed for — frequently exceed Claude's context window. The standard approaches (summarization, compaction, trimming) all involve irreversible decisions about what to keep. Managed Agents handles this differently.

The session log is the context object. It lives outside the context window, stored durably. The harness can call getEvents() to fetch specific slices — pick up from the last checkpoint, rewind a few events before a critical action, or re-read context before making a consequential decision. Nothing is discarded; it's all selectively surfaced. This means an agent can pause, crash, resume, and never lose the thread of what it was doing.

VentureBeat noted the obvious concern: this is a meaningful vendor lock-in play. Managed Agents is deeply integrated with the Claude platform — the session format, sandbox provisioning, tool proxy, and credential vault are all Anthropic infrastructure. Teams that build on it are building on Anthropic's abstractions, not portable ones.

The counter-argument is that most enterprise teams were already going to build proprietary harnesses anyway — the lock-in was just self-imposed. Managed Agents trades homegrown complexity for Anthropic-hosted complexity, and gets you faster time-to-production in exchange.

For startups and small engineering teams, the calculus is clearer: months of infrastructure work, or use Managed Agents and ship. The answer is usually ship.

Claude Managed Agents is available via the Claude Platform. Access is through the API — this is not a consumer product. Anthropic's engineering blog has a detailed technical walkthrough, and the documentation covers session interfaces, sandbox provisioning, and the MCP tool proxy setup.

If you're a developer building with Claude's API: Managed Agents removes the biggest barrier to shipping agents that do real work over extended time horizons. The session durability and crash recovery alone are worth evaluating for any workflow that runs longer than a few minutes.

If you're evaluating AI infrastructure for enterprise: the security architecture here is notably mature — credential isolation via vault, sandbox separation, no agent access to its own auth tokens. These are the patterns that make agents safe to run in production environments with real data.

If you're watching the competitive landscape: Managed Agents puts Anthropic directly in competition with agent infrastructure startups like LangChain, CrewAI, and AWS Bedrock AgentCore. Anthropic is betting that the best inference provider is also the best place to run the agent layer.

Anthropic Engineering — Scaling Managed Agents: Decoupling the brain from the hands · VentureBeat — Claude Managed Agents gives enterprises a new one-stop shop · The New Stack — Anthropic wants to run your AI agents for you · Wired — Anthropic's New Product Aims to Handle the Hard Part of Building AI Agents