Claude Managed Agents can now run in your own sandbox

Claude's enterprise agents just got permission to operate behind corporate firewalls.

Anthropic rolled out two major features for Claude Managed Agents: self-hosted sandboxes and MCP tunnels. The update effectively splits an agent into two halves. Anthropic continues handling the agent loop, context orchestration, and error recovery in the cloud, while the actual tool execution moves directly onto your own servers or preferred infrastructure.

Self-hosted sandboxes are available in public beta, while MCP tunnels are currently in a gated research preview.

Keeping code and data inside your perimeter

With self-hosted sandboxes, sensitive files, private packages, and arbitrary code execution never leave your enterprise perimeter. Security teams get to keep existing network policies, audit logs, and compliance tooling intact.

Developers also gain direct control over compute environments, choosing exact runtime images, memory limits, and CPU or GPU capacity for heavy workloads like builds or image rendering.

Anthropic launched integrations with several managed sandbox providers out of the gate. Cloudflare provides microVM isolation with zero-trust credential injection, where Amplitude reported standing up an internal design agent in just two days. Daytona supports long-running stateful environments with SSH access and state restoration, used by Clay for autonomous workflow agents. Modal delivers sub-second container starts scaling to hundreds of thousands of concurrent sandboxes, and Vercel Sandboxes inject credentials at the network boundary, currently powering finance AI platform Rogo.

Private tools without public endpoints

The second addition, MCP tunnels, connects Claude Managed Agents to Model Context Protocol servers tucked deep inside private enterprise networks. This turns proprietary databases, internal ticketing systems, and private APIs into callable tools.

Instead of requiring public endpoints or dangerous inbound firewall exceptions, companies deploy a lightweight gateway that establishes a single outbound connection. All network traffic is end-to-end encrypted, and workspace admins manage everything from the Claude Console.

Why it matters

We think this is the exact architecture enterprise AI needed to unblock real agent adoption.

Until now, companies looking to automate work with agents faced a bad tradeoff: build the fragile orchestration loop from scratch internally, or hand sensitive corporate data and execution environments over to a model provider's cloud. Decoupling the orchestration brain from the runtime execution boundary solves the compliance roadblock without forcing engineers to reinvent agent memory and error handling.

If you build internal tooling or handle regulated data, testing self-hosted sandboxes is an immediate no-brainer. You will carry the operational overhead of managing sandbox compute or paying a partner like Modal or Vercel, but keeping proprietary data walled off is well worth the friction.

Strategically, Anthropic is being smart by partnering with modern cloud providers rather than trying to build proprietary virtual machines. By doubling down on MCP and letting infrastructure experts handle compute, Anthropic is establishing Claude as the control plane for enterprise agents while putting immense pressure on competing model providers to offer modular, unbundled runtimes.