AI News · 5 min read
Anthropic opens self-hosted Claude agents in beta
On November 12, 2026, Anthropic opened a private beta for self-hosted Claude Managed Agents. You run the harness and the history. Claude still runs outside your network.
What Anthropic opened on November 12
On November 12, 2026, Anthropic opened a private beta for self-hosted Claude Managed Agents. The announcement ↗ says you can run the agent harness, sandboxes, credentials, and session history in your own cloud or on-premise. Help Net Security ↗ (Anamarija Pogorelec, November 12) dates the beta to that day and says customers request access through their Anthropic account team. The announcement says the same: contact your account team.
The picture above is ours, a server aisle and a blank console. It is not an Anthropic diagram.
Managed Agents started as a hosted service on the Claude Platform. Anthropic later added self-hosted sandboxes, so tool execution sat in your environment while Anthropic still ran the service. This beta is the rest of the service. You operate the server, its database, and the workers where agents run shell and file tools. Developers keep the same core APIs as the hosted product.
What stays inside, and what still leaves
| Piece | Where it runs |
|---|---|
| Harness, sandboxes, credentials, session history | Your cloud or on-prem |
| Server, database, workers | You operate them |
| Model calls | Anthropic, Amazon Bedrock, Google's Agent Platform, Microsoft Foundry, or your gateway |
| Claude itself | Outside your network |
Help Net Security is explicit on the last row: the customer runs the server, a PostgreSQL database, and the workers, and Claude still runs outside the network. Prompts go out. Completions come back. Anthropic's post says a zero data retention agreement applies to those Claude requests the same way it applies to any other Messages API call.
The security docs ↗ say Anthropic has no remote access to the server or its log. The server connects to Anthropic only when the Claude API is the inference provider. Credentials for MCP tools and supported API calls are added by a proxy outside the sandbox, and you can store them in your own secrets manager. Each environment can be limited to an allowlist of hosts. The activity record, every tool call and what came back, exports over OpenTelemetry.
What the beta does not include
The differences page ↗ is the list to read before anyone plans a move.
Nothing is copied from the hosted service, session history included. You create agents, skills, vault credentials, and memory stores again on your server.
Scheduled deployments have no routes on the self-hosted server. The replacement Anthropic names is your own scheduler. Webhooks are absent too, so a worker that starts on a webhook never starts. You follow a session on its event stream, or by listing events, and you keep workers polling.
The announcement and the docs publish no price and no general-availability date. Access is the account team.
How this differs from Gemini's self-hosted environments
Google's Environments docs ↗ describe a different cut. By default Google hosts the Linux sandbox. A self-hosted environment lets the managed agent run tools on computers you control. The sandbox connects out over HTTPS and needs no inbound firewall ports. The model call stays on the Gemini API.
Anthropic's beta moves the harness, the credentials, and the session history into your environment as well. The model still leaves. Google's docs move the tools. Anthropic's docs move the control plane and still send the model call to a provider you pick. Neither one is an on-prem model.
What people are saying
"Self hosted Claude Managed Agents is now in private beta!" — Ado (@adocomplete) ↗
"self-hosted managed agents, private beta, and claude-only?? couldn’t be us 😤" — Ishaan Sehgal ↗
"Will self-hosted Managed Agents be a workaround to bypass the network/application level controls on managed agents? Specifically I’m thinking non-standard ports and websockets" — Justin Massey ↗
"Infra, Security and Cost will play a major role as the deciding factor for Users." — Sam R ↗
Reddit was not reachable for this story.
Our take
Ask for the beta if a security review blocks the hosted service. The fit is a team that already lets agents work unattended on internal code, fixing builds, testing releases, triaging alerts, and that cannot leave credentials or session history on Anthropic's side. You still send every model call out. This is not Claude running in your data center.
Wait if you wanted a price, a migration button, or webhooks. Nothing copies over. Scheduled runs and webhooks are missing. There is no published price and no date for general availability. Teams that do not want to run a server, a database, and workers should stay on the hosted service. The November 10 IPO filing did not change Claude plan prices. This beta does not publish one either.
Do not treat self-hosting as a bypass. Justin Massey asked whether it gets around network and application controls, including non-standard ports and websockets. The docs still refuse MCP hosts and Git hosts until you list them. Each environment can be locked to an allowlist. The sandbox reaches whatever network you give the worker. That is your firewall to configure, not a control Anthropic removed.
Match the product to the cut you actually need. If the requirement is "tools run on our machines, the vendor keeps the agent loop," Google's environment docs already describe that shape. If the requirement is "credentials and transcripts stay in our database," this beta is the one that says yes, with the gaps above. For the coding agent most Claude customers already pay for, the review is Claude Code. Plan comparisons are in ChatGPT vs Claude vs Gemini. Cheaper seats, if the bill is the objection Sam R raised, are in cheaper Claude Code alternatives.