Anthropic brings self-hosted sandboxes and private MCP tunnels to Claude

Anthropic just gave enterprise security teams a massive reason to stop blocking AI agents.

At its Code w/ Claude London event on May 26, the AI lab dropped two enterprise-focused upgrades for Claude Managed Agents: self-hosted sandboxes and MCP tunnels. The pitch is simple: Anthropic keeps running the agent's brain, but your own infrastructure runs the hands and feet.

During his keynote, Boris Cherny, Head of Claude Code, reflected on his early days hacking TI-83 calculators and learning HTML to sell Pokémon cards on eBay. He argued that modern software stacks pushed the distance between having an idea and seeing it run too far apart. Agents are collapsing that gap again, acting like a calculator that can build a distributed system.

To make that calculator safe for the Fortune 500, however, Anthropic had to solve the data perimeter problem.

Code stays inside the firewall

The first feature, now in public beta, is self-hosted sandboxes.

Anthropic split the agent loop cleanly in two. The heavy lifting of orchestration, context management, and error handling stays on Anthropic's platform. Meanwhile, actual tool execution runs wherever you want, whether that is on-premise hardware or modern cloud runtime providers like Cloudflare, Daytona, Modal, or Vercel.

Because the sandbox sits in your own environment, code repositories and internal files never leave company boundaries. Security teams can apply existing audit logging and network rules, and engineering teams can customize their own runtimes and compute specs for heavy workloads. Early adopters like Amplitude, Clay, and Rogo are already building with it.

A private door for private tools

The second announcement is MCP tunnels, currently in research preview.

Many enterprises have Model Context Protocol servers tucked behind private VPCs. Normally, giving an external model access to those tools requires messy firewall rules or public webhooks that terrify IT admins.

MCP tunnels fix this with a lightweight gateway deployed inside the private network. It establishes a single outbound connection to Anthropic, meaning zero inbound firewall rules, no public IP endpoints, and end-to-end encryption. Organization admins can manage the tunnels directly through the Claude Console, with support spanning both Managed Agents and the standard Messages API.

Why it matters

This is one of the smartest enterprise moves Anthropic has made this year.

The real blocker for AI agent adoption has never been model intelligence; it has been risk compliance. Corporate security teams routinely reject agentic workflows because they refuse to let proprietary code execute on a third-party box. By decoupling orchestration from execution, Anthropic lets companies adopt frontier models without breaking their compliance checklist.

For developers and enterprise architects, this makes Claude significantly easier to pitch internally. Partnering with Cloudflare, Modal, and Daytona also saves Anthropic from building custom enterprise infrastructure from scratch, letting developers bring tools they already trust.

That said, split architectures come with trade-offs. Relying on remote orchestration over an outbound bridge introduces latency and potential sync failures during multi-step tool calls. We think teams blocked by strict compliance policies should jump on the sandbox beta immediately, while smaller setups will likely still prefer fully managed agents to avoid infrastructure overhead.