Anthropic decouples Claude's brain from its hands

Anyone who has tried to deploy autonomous AI agents to production knows the nightmare isn't prompt engineering—it's infrastructure. If a container crashes, the user's multi-hour session vanishes. If Claude runs untrusted code, a clever prompt injection might read the container's environment variables and leak sensitive API keys. And every time the underlying model updates, engineers have to rewrite the orchestration loop to keep up.

Anthropic officially launched Claude Managed Agents into public beta, rolling out a fully hosted service alongside a technical breakdown of how it solved these bottlenecks by decoupling the agent's core components.

The architectural overhaul cut median time-to-first-token (TTFT) by roughly 60% and slashed p95 latency by over 90%. In Anthropic's internal evaluations on structured file generation, the managed setup boosted outcome task success by up to 10 points compared to a standard prompting loop, with the biggest gains on the hardest problems.

Decoupling the brain from the hands

Anthropic initially ran everything—the orchestration loop, the sandboxed execution environment, and the session log—inside a single container. But treating that container as an all-in-one box created what the team described as an infrastructure pet. If the container failed, the session died with it, and engineers couldn't easily debug stuck sessions without opening a shell into an environment containing user data.

The new design virtualizes the system into three distinct interfaces: the harness (the brain calling Claude), the sandbox (the disposable hands running code), and the session (an append-only log of events).

By pulling the harness out of the execution environment, sandboxes became cattle. Claude now interacts with containers through a standard tool-call interface. If a sandbox dies, the harness catches the error and Claude can request a fresh container with a standard configuration. If the harness itself crashes, a new instance simply wakes up via sessionId, reads the session log, and resumes from the exact point of failure.

Plugging the security hole and context anxiety

The separation fundamentally fixes the prompt injection risk. Previously, Claude's generated code lived alongside environment credentials. In the new model, tokens are kept completely out of the sandbox. For Git operations, tokens are wired into the local remote during initialization so code can push and pull without ever seeing the secret. For custom MCP tools, OAuth tokens are stored in an external vault, accessed only through a dedicated session proxy.

It also changes how agents handle memory. As tasks stretch across hours, stuffing full histories into the context window triggers premature task wrapping—what Anthropic calls context anxiety. Instead of forcing irreversible compaction or token trimming, the session log acts as a durable external store. The harness can query positional slices of past events on demand, allowing Claude to inspect older steps without bloating its active window.

Early enterprise adopters are already leaning on the architecture. Notion is using it inside private alpha custom agents to let workers produce code, decks, and documents in parallel. Sentry hooked its Seer debugging agent into Claude to generate pull requests automatically from flagged errors, shipping the integration in weeks instead of months. Other companies like Rakuten, Asana, and Vibecode have rolled out autonomous agents across internal workflows.

Why it matters

We think this launch marks a crucial shift from selling raw model intelligence to providing the foundational runtime for autonomous software. Prototyping an agent loop takes an afternoon, but building bulletproof sandboxes, durable checkpoints, and secure credential vaults typically consumes months of engineering bandwidth. Managed Agents solves that operational headache out of the box, making it well worth testing for teams building complex, multi-step workflows.

The cleverness lies in Anthropic's interfaces: by isolating the harness, the company can adapt to future model shifts—like Claude Opus 4.5 outgrowing context resets that Sonnet 4.5 required—without breaking user code. The trade-off, of course, is platform lock-in. Handing over state, permissions, and orchestration directly to Anthropic creates a tight dependency on the Claude ecosystem, which will inevitably squeeze third-party agent orchestration frameworks and sandbox providers.