Managed agents

A managed agent is an AI agent that runs on the AI provider's servers. You describe the task, the tools it may use and the rules it must follow. The provider supplies the computer it works on, keeps the access keys it needs out of its reach, and keeps it running for hours if needed. Anthropic launched such a service in April 2026, Google in May.

What do you define, and what does the provider run?

Anthropic sums up its version in the launch post of 8 April 2026: "You define your agent's tasks, tools, and guardrails and we run it on our infrastructure." The documentation splits this into an agent (the model, system prompt, tools, MCP servers and skills, defined once), an environment (by default a cloud sandbox run by Anthropic) and sessions, each a running instance of the agent that carries out a task. In the sandbox the agent can run shell commands, edit files, search the web and call outside services through the Model Context Protocol (MCP). With the plain Messages API you write that agent loop yourself; the documentation recommends Managed Agents for long-running and asynchronous work.

How does it work inside?

Anthropic's engineering post of the same day describes three separate parts: the session, a log of everything that happened; the harness, the loop that calls Claude and routes its tool calls; and the sandbox, where Claude runs code and edits files. Each can fail and be replaced on its own: a new harness reads the session log and continues from the last event.

The split also serves security. In an earlier design, code that Claude generated ran in the same container as the credentials, so a prompt injection only had to get Claude to read its own environment. Now access tokens stay out of the sandbox. The platform uses a repository's Git token to clone it when the sandbox starts, and OAuth tokens for MCP servers sit in a vault that a proxy uses on the agent's behalf.

Who offers managed agents?

Anthropic put Claude Managed Agents into public beta on 8 April 2026 (release notes). The launch post promises agents "10x faster", a figure that rests on customer statements such as Vibecode's "at least 10x quicker than before". Later Anthropic made memory a public beta (23 April) and added Dreams, a memory clean-up that resembles the unreleased Kairos (6 May), sandboxes on your own infrastructure (19 May) and scheduled runs (9 June).

Google used the same name for Managed Agents in the Gemini API on 19 May 2026: one API call starts its Antigravity agent, built on Gemini 3.5 Flash, in an isolated Linux environment hosted by Google.

Where are the limits?

• Each service runs its maker's models: Claude Managed Agents is "purpose-built for Claude", and Google's service runs on Gemini.
• Your data sits with the provider. In September 2026 Anthropic's documentation said Managed Agents was not eligible for zero data retention or for HIPAA coverage of US health data, because sessions are stored on Anthropic's side. With a self-hosted sandbox the tools run on your own servers, but tool inputs and outputs still go to Anthropic, where Claude runs.
• In September 2026 it was still a beta, and Anthropic warned that behaviour may change between releases.
• The costs have two parts: in September 2026 the normal token prices plus $0.08 per session hour while a session runs (pricing).

Example

Suppose a web agency lets a managed agent handle small change requests from clients. The agent gets instructions about the agency's code style and access to its ticket system through MCP. A ticket asks to change the opening hours on a client's contact page. The platform starts a session and clones the client's repository into a fresh sandbox. The agent edits the page, runs the tests and opens a pull request, which a developer reviews before it goes live. The agency runs no server for the agent; it pays for tokens and session time.