Anthropic gives Claude agents a cron schedule and a secret vault

If you wanted an AI agent to wake up at 2 AM, crunch a spreadsheet, and draft a morning brief, you used to have to build and host the scheduling plumbing yourself—while sweating over where to safely park your API keys.

Anthropic just launched two new public beta features for Claude Managed Agents on the Claude Platform: scheduled deployments and environment variable vaults. In plain English, Claude can now run on a cron schedule natively, and it can use your authenticated command-line tools without ever seeing the raw credentials.

Cron jobs meet AI sandboxes

Scheduled deployments let Managed Agents run on a standard cron schedule. Whenever the trigger fires, the agent spins up a fresh, isolated session, runs its workflow, and shuts down. You do not need to build, host, or monitor external cron infrastructure.

Teams can use it for recurring chores like nightly data syncs, weekly compliance audits, or automated daily digests. Once deployed, you can pause, resume, archive, or manually trigger runs on demand.

Early adopters are already putting it to work. Rakuten runs scheduled agents to parse spreadsheet data and generate weekly reports or decks, while also monitoring production logs so product managers get health updates without building a dashboard. Actively AI ditched its custom-built scheduling stack in favor of Claude's native cron to refresh sales search data, while Ando uses it to monitor team channels, chase overdue action items, and ping people for meetings.

Vaults keep raw keys away from the model

Giving an AI agent a shell is powerful, but handing it naked API keys is an enterprise nightmare. Anthropic's new Vaults feature solves this by keeping secrets out of the model's sight.

Developers register API keys as environment variables tied to specific allowed domains. Inside the agent's sandbox, the CLI tool only sees a dummy placeholder. The actual key is injected at the network boundary when an outbound HTTP request hits an approved destination.

If the agent goes rogue or falls victim to a prompt injection, there is simply no raw key in memory to leak. Rotating a credential just takes one update in the vault. The setup already works with CLIs from Browserbase, KERNEL, Notion, Ramp, and Sentry. Adding Browserbase and KERNEL also gives Managed Agents browser automation powers for the first time.

Why it matters

We think this is Anthropic quietly turning Claude from an on-demand chat partner into a true background workforce.

For developers, the barrier to building autonomous background agents just collapsed. You no longer need AWS Lambda, custom cron daemons, or complicated secrets management wrappers just to run a daily log auditor or report generator. If your team spends engineering hours maintaining brittle agent schedulers, switching to this public beta looks like an easy win.

Injecting credentials at the network boundary is a genuinely smart architectural move. Instead of trusting LLM safety guardrails not to spill a token in conversation, Anthropic pushed security down to the transport layer.

That said, risks remain. While the agent cannot leak the raw API token, it still has permission to invoke actions and read data from authenticated endpoints. If an agent gets manipulated into wiping records or exfiltrating private database contents through a legitimate API, network-level masking will not save you. Still, this is a clear warning shot to standalone agent orchestration frameworks: cloud providers are rapidly eating the agent infrastructure layer.