Anthropic has added a self‑hosted deployment option for its Claude Managed Agents platform, moving the coordination server and sandbox workers from Anthropic‑managed clouds into a customer’s own cloud account or on‑premises data centre. The change means that credentials, session histories, and any persisted data can remain behind the customer’s firewall, while the underlying language model calls are still routed to a configurable inference provider such as the Anthropic API, Amazon Bedrock, or Microsoft Foundry.
What changed for the platform
The new offering packages the previously separate server component and sandbox workers into a single binary distribution that customers install themselves. The binary is proprietary and cannot be modified, patched, or re‑compiled by the customer. Licensing explicitly limits the models that can be invoked to Claude variants unless Anthropic grants an exception, and it prohibits the use of third‑party models. Additionally, the license requires the software to emit “usage signals” – telemetry that reports observability data back to Anthropic – and forbids customers from blocking or altering that data.
Architectural impact
From an architecture perspective, the self‑hosted option introduces a new trust boundary. The coordination server now runs inside the customer’s network, but it still depends on an external inference endpoint. Engineers must provision compute for the server and sandbox workers, typically in Kubernetes pods or VMs, and optionally configure a PostgreSQL instance to retain session state across restarts. Network design must allow outbound traffic from the server to the chosen inference provider while keeping inbound access limited to internal services that invoke the agent APIs.
Because the binary cannot be altered, any security hardening or custom logging must be applied around the process rather than inside it. The inability to replace the server code also means that vulnerability remediation must rely on Anthropic‑issued updates.
Operational and security considerations
The license imposes a strict eight‑hour deadline for responding to written safety, security, or misuse notices. Within that window, customers must either disable the flagged feature or roll back the affected version across every deployment. A separate requirement gives one business day to install a designated safety update. This reverses the typical self‑hosted model where the operator controls the change window, and it forces rapid, coordinated actions across potentially distributed environments.
Telemetry requirements raise additional security questions. Since usage signals cannot be blocked, any data exfiltration concerns must be evaluated against the mandatory outbound flow to Anthropic. Engineers should audit what information is included in those signals and consider network segmentation or egress controls that comply with the license while protecting sensitive payloads.
Model access restrictions also affect capacity planning. If Anthropic decides, on safety grounds, to reserve certain Claude models for hosted‑only use, customers may lose access to higher‑capability models without warning, potentially impacting workloads that rely on those capabilities.
What to watch next
Practitioners should monitor the following areas:
- Release cadence of safety notices and the practical ability to meet the eight‑hour remediation window in their deployment pipelines.
- Updates to the telemetry schema that could introduce new data elements or change the volume of outbound traffic.
- Anthropic’s policy announcements regarding model reservation for hosted access, which could affect feature parity.
- Community feedback from early adopters in the private beta, especially around patching, observability, and integration with existing CI/CD workflows.
Related CloudNinjas coverage: AI engineering.
What This Means For Practitioners
Self‑hosting Claude Managed Agents gives you data residency and control over the execution environment, but it comes with a proprietary, non‑modifiable server, mandatory telemetry, and a tight safety‑response deadline. Teams must design their deployment pipelines to support rapid rollbacks, ensure egress paths for required usage signals, and plan for potential model access changes. Evaluating whether the operational overhead and licensing constraints align with your risk posture is essential before committing to the self‑hosted route.
