On April 8, 2026, Anthropic moved Claude Managed Agents into public beta. It is a set of composable APIs for cloud-hosted agents: the parts nobody enjoys building yourself — sandboxed execution, state and memory management, permissioning, scheduled execution — are folded into a managed layer, and you define the tasks and the tools. Billing is consumption-based: standard token rates, plus $0.08 per session-hour of active runtime.
Why it matters is the shape of the change. Running a production-grade agent stops being an infrastructure project and becomes a set of API calls. Anthropic’s headline claim is 10x faster time to production, and the early customer list — Notion, Sentry, Atlassian, Rakuten, Asana, Vibecode — reportedly went from prototype to launch in days to weeks instead of months.
What Ships in the Beta
The core is an Anthropic-operated orchestration harness that decides when to call tools, how to manage context, and how to recover from errors. Around it:
- Secure sandboxing and tool execution, with authentication and scoped permissions
- Long-running sessions that operate autonomously for hours and survive disconnections
- Cross-session built-in memory, plus scheduled deployments backed by vault-stored credentials
- Multi-agent coordination and outcome-based mode (both research previews)
- Session tracing, analytics, and per-tool-call debugging in the Claude Console
There are four entry points: the docs, an agent quickstart in the Console, a new CLI, and the built-in claude-api Skill inside Claude Code.
Brain, Hands, Session: The Architecture
Anthropic’s engineering team explains the design with an operating-system analogy: the “brain” is Claude plus its harness; the “hands” are the sandboxes and tools that act; the “session” is an append-only event log. Each is a separate interface that can fail or be swapped independently.
The original version packed all three into one container, which made the sandbox a “pet” — unrecoverable once lost. In the redesign, the sandbox is modeled as a tool call: execute(name, input) returns a string, a dead container surfaces as a tool error, and the harness can re-provision via provision when Claude retries. The harness itself is stateless and restartable: on a crash it reboots, calls wake(sessionId) and getSession(id) to retrieve history, and resumes from the last event. The team’s punchline is that the harness “doesn’t know whether the sandbox is a container, a phone, or a Pokémon emulator.”
One subtle point: the session is not the context window. getEvents lets the brain read positional slices of the log, and the harness can compact, trim, or optimize for prompt caching before anything reaches the model.
The Security Model: Credentials Stay Out of the Sandbox
Credential isolation is the load-bearing wall. A sandbox running Claude-generated code can never reach credentials: Git tokens are consumed only during sandbox initialization (cloning the repo, wiring the remote), and MCP OAuth tokens live in an external vault accessed through a dedicated proxy that the harness never sees. Combined with scoped permissions, identity management, and execution tracing, that is the governance story.
Performance and Pricing
The engineering post gives real numbers. Containers are provisioned only when a tool call needs one, which eliminates upfront setup: p50 time-to-first-token dropped roughly 60%, and p95 dropped more than 90%. On task success, internal testing showed up to a 10-point gain over a standard prompting loop, with the largest gains on the hardest problems. Pricing is standard token rates plus the $0.08 per session-hour runtime fee. Indragie Karunaratne, Senior Director of Engineering for AI/ML at Sentry, said the product gave Sentry a secure, fully managed agent runtime and let the team ship its integration in weeks without maintaining agent infrastructure.
What Developers Should Weigh
Three practical observations. First, this complements Claude Code rather than replacing it — local terminals and cloud hosting serve different workflows, and what the managed layer removes is operations, not all control. Second, the pricing turns idle agent time into an explicit line item; budget session-hours before committing to long-running jobs. Third, managed agent infrastructure is becoming a commodity — it sits squarely in the “platforms for building agents” layer of the three-layer agentic infrastructure model, with the only real question being who pays the operations cost.
Sources
- Claude Managed Agents: get to production 10x faster — Claude
- Scaling Managed Agents: Decoupling the brain from the hands — Anthropic Engineering
- Claude Managed Agents bring execution and control to AI agent workflows — Help Net Security
AI-assisted summary compiled from the sources above, reviewed by a human before publishing.