Anthropic lets enterprises self-host the full Claude Managed Agents stack — private beta now open

Anthropic is handing enterprises the keys to its agent platform. The company opened a private beta on November 12 for self-hosted Claude Managed Agents, a version of its service for running long-lived autonomous agents that lives entirely inside the customer's own cloud account or data center — the control plane, the database, the sandboxes, the credentials and the session history. Until now, companies that wanted Claude agents working unattended on internal systems had to accept that Anthropic ran the service, even when the agents' tools ran on their own machines.

The audience is specific: teams that already trust agents with real work — fixing broken builds, testing releases, triaging alerts, working through bug backlogs — but whose security rules forbid the data and credentials involved from living on someone else's infrastructure. For them, the hosted service was a non-starter no matter how capable the model. Self-hosting removes that blocker, and trades it for a new one: running the platform yourself.

What moves inside your walls#

A self-hosting customer operates three pieces. The first is cma-server, which exposes the Managed Agents API, runs the agent loop, and stores agents and sessions. The second is a PostgreSQL database, version 16 or later, that holds agents, sessions and their histories — without it, the server keeps data only in memory and a restart erases it. The third is the workers where agents run their shell and file tools inside sandboxes. Credentials stay on the customer's side too, in their own secrets manager.

Developers build agents with the same core APIs as the hosted version, so the SDK and the ant CLI work against a self-hosted server as well. In principle a team can prototype on the hosted service and move to self-hosting without rewriting its agents. For development, Anthropic's documentation describes a Docker Compose setup and warns explicitly that it is not appropriate for production; a production install uses separate Helm charts for the server and the sandboxes, on a Kubernetes cluster running version 1.30 or later.

The security model is built around four ideas Anthropic has described for Managed Agents: keep credentials in the customer's environment, lock each environment to an allowlist of hosts so requests to anything else are blocked, and keep a complete log of every step an agent takes — each tool call and what came back — exportable over OpenTelemetry. Anthropic says it has no remote access to the self-hosted server or its logs.

The model still lives outside#

The distinction worth stating plainly is that self-hosting the service does not keep model traffic inside the customer's network. Claude itself still runs outside. Each time an agent queries the model, the conversation travels to an outside provider — and the customer picks which one.

With self-hosting, companies choose where requests to Claude are sent: straight to Anthropic, through a cloud provider, or through their own gateway. The supported cloud options named in the announcement are Amazon Bedrock, Google's Agent Platform and Microsoft Foundry, set with the inference.provider setting. That gives organizations that already buy Claude through one of those clouds a way to keep billing, logging and access rules in one place. Anthropic also says that if an organization has a zero data retention agreement in place, it applies to the requests sent to Claude the same way it does for any other Messages API call.

So what self-hosting actually buys is control over the orchestration layer — where credentials live, where history is stored, where requests are routed, and what gets logged — not data residency for the model calls themselves. For a security team, that is still a large difference: the secrets an agent uses to reach internal systems no longer sit in Anthropic's vault, and the record of what each agent did sits in the customer's own database.

How it got here#

Managed Agents began as a hosted service on the Claude Platform, introduced on April 9, 2026: Anthropic ran the infrastructure, and customers built long-running agents on its APIs. On May 19, Anthropic added self-hosted sandboxes, which moved an agent's tool execution onto customer systems while Anthropic kept running the agent itself — the API, the agent loop, the session archive, the credentials. The November 12 announcement brings the rest in-house too.

The timing fits a pattern. Agents are being trusted with more consequential work, and the labs are competing on who can run that work inside the most guarded environments. Moonshot AI launched a hosted agent service of its own earlier in November, and Anthropic's move is the mirror image: not more hosting, but less of it — the platform, delivered as software the customer operates.

What you give up#

The trade is real, and Anthropic does not hide it. The private beta is not a feature-for-feature copy of the hosted service: scheduled deployments and webhooks are unavailable on the self-hosted server, and teams planning a move should read the gaps before they start. Nothing is copied from the hosted service either — not agents, not skills, not vault credentials, not memory stores, not session history. A team that adopts self-hosting rebuilds everything from scratch.

Then there is the operating work Anthropic previously handled: running a server, a database and worker machines, and keeping them secure and updated. Smaller teams without strict data rules will probably be better served by the hosted version, which removes that burden. Access is deliberately narrow for now: the private beta is available only to eligible organizations, and the only channel is the Anthropic account team, which hands over the release archive; customers install each release themselves. Anthropic has published no pricing, no list of covered countries, and no schedule for leaving beta.

What to watch#

Whether the beta widens, and on what terms: pricing and a general-availability date are the two numbers every enterprise buyer will wait for. Whether regulated industries adopt it — finance, health care and government are the obvious candidates, since they are the teams whose rules made the hosted service a non-starter. Whether rivals answer in kind: if self-hosted agent platforms become the enterprise default, OpenAI and Google will face the same question about their own agent infrastructure. And whether the first public deployments hold up under security review — the whole pitch rests on the claim that a customer-operated agent platform is safer than a vendor-operated one, and that claim will be tested by the first incident, not the first press release.

Sources: Help Net Security — Self-hosted Claude Managed Agents keeps agent credentials in your environment (Nov. 12, 2026); AI Parabellum — Anthropic Lets Companies Self-Host Claude Managed Agents in Beta; The Circuitry — Anthropic opens self-hosted Claude agents in a private beta (Nov. 12, 2026); Pivot News — Anthropic opens self-hosted Claude Managed Agents, with model routing in customer hands (Nov. 12, 2026); Inspire Viral Times — Anthropic Lets Enterprises Run Claude Managed Agents on Their Own Servers — in Private Beta (Nov. 12, 2026). The announcement was made via Anthropic’s ClaudeDevs account on November 12, 2026.