Anthropic decouples Claude's brain from its hands with Managed Agents
Claude Managed Agents puts the agent harness on Anthropic's infrastructure and isolates the code-execution sandbox from the model loop. The pitch is faster first tokens, safer credentials, and resumable sessions that survive past the life of a container.
Builders, integrators, prompt engineers · 2 min read
Anthropic is rolling out Claude Managed Agents, a hosted layer that sits above the Claude Agent SDK and runs the agentic loop for you. The architectural move worth paying attention to: the harness that calls Claude is decoupled from the sandbox where code executes, and a server-side session log connects them.
That split is the whole pitch. In Anthropic's framing, most production agent stacks today run the model loop, the tools, and the credentials inside one container. That container has to spin up before Claude can even start thinking, it dies with the run, and prompt-injected code lives next to your tokens.
Managed Agents is organized around three resources:
- Agents — a config: model, prompt, tools, guardrails.
- Environments — the sandbox container, networking rules, pre-installed packages. Anthropic says these can run on their cloud or on infrastructure you control.
- Sessions — one run pairing an agent with an environment, with its own isolated sandbox. The full event history, sandbox state, and outputs persist server-side.
A few claims worth flagging for builders:
- Latency. Because Claude starts reasoning while the sandbox spins up in parallel — and skips the container entirely if no tool is called — Anthropic reports time-to-first-token improvements of roughly 60% at p50 and over 90% at p95 in internal testing. The baseline isn't specified, so treat this as directional until third-party numbers land.
- Credentials. Tokens for MCP servers, CLIs, and GitHub repos live in a Vault outside the sandbox, fetched on demand via a proxy, with envelope encryption and signed request tokens. This is a real answer to the "prompt injection reads your env vars" problem, though the trust boundary now shifts to the proxy.
- Sessions as event logs. Runs are append-only streams of model calls, tool calls, and results. Idle sessions are checkpointed, so you can resume without managing your own save points, and the Claude Developer Console gets a visual timeline for debugging.
- Memory and "Dreaming." Anthropic is also surfacing two features that ride on session durability: persistent Memory, and Dreaming, a scheduled process that reviews past sessions and memory stores to extract patterns between runs. The post is light on guardrails here — what gets written, who can read it, how you audit it — so this is the area we'd push hardest on in pilots.
The meta-argument Anthropic is making is that the harness has to evolve with the model. They cite "context anxiety" on Sonnet 4.5, where they patched the harness with context resets — and then Opus 4.5 didn't need them, leaving the resets as dead weight. The unspoken corollary: if you maintain your own loop, you're signing up to retune it every model generation. Managed Agents is the bet that most teams shouldn't.
The tradeoff is the usual one. You get less yak-shaving on infrastructure and a harness that tracks model behavior; you get more lock-in to Anthropic's runtime, scheduler, and vault. Teams that need fully custom orchestration still have the SDK. Everyone else now has a hosted option to evaluate against LangGraph, OpenAI's Agents platform, and the various agent runtimes from cloud providers.
The interesting question for the next quarter: how priced, how portable, and how observable this really is once teams run it against real workloads.
