Claude Managed Agents: What It Is, How It Works, Pricing and Limits17 min read

Every team that builds an agent hits the same wall around the second week. The prototype works on your laptop, and then someone asks for it to run for an hour without you, keep a database password out of the model’s reach, survive a crashed container, and pick up tomorrow where it stopped. None of that is about prompts. It is plumbing, and it is the plumbing Anthropic decided to run for you.

Claude Managed Agents, launched in public beta on April 8, 2026, is a hosted service on the Claude Platform. You define an agent, give it a cloud sandbox, and start sessions that Anthropic runs for you, with a built-in tool set, streamed events, memory, scheduled runs and a long list of controls. Since launch, Anthropic has shipped something new almost every month, and in late October a free 90-minute workshop on how it works started circulating widely.

This guide is for developers and technical leads deciding whether to build on it. We cover what it is, how a session runs, the features that matter, what it costs, where it stops, and how it compares with running your own loop.

One note on where the results go. A managed session can write reports, spreadsheets and apps into its sandbox, and those files are retrievable through the API. What they need after that is a place where your team and your other assistants can open, review and keep editing them. AgentGrid.io is a shared workspace where people and AI agents create, edit and share documents, apps and files, with one live version and a history of who changed what. We pick that up in the last sections.

What are Claude Managed Agents?

Claude Managed Agents is Anthropic’s hosted agent runtime. Instead of writing the loop that calls the model, runs tools and feeds the results back, you describe the agent and let the service run it. It is in beta, you call it with the managed-agents-2026-04-01 beta header, and it is available on the Claude API, on Claude Platform on AWS, and on Claude Models on Google Cloud, where Anthropic manages it.

The documentation reduces it to four concepts:

How is that different from the Messages API? The Messages API gives you the model and nothing else. You write the loop, the tools and the sandbox, which is exactly what you want when you need fine-grained control. Managed Agents is aimed at long-running and asynchronous work, where you would rather hand over a task and watch the events.

The built-in cloud sandbox ships with Python, Node, Go, Rust, Java, Ruby, PHP and C/C++, plus Postgres, Redis and SQLite. Networking can be set to limited, so the code your agent writes can reach package registries and not much else. The Claude Console also has a visual agent builder and a test session runner, which is the quickest way to feel how it behaves before you write code.

Why did Anthropic split the brain from the hands?

The best explanation of the design is not in the product docs. It is an Anthropic engineering post called “Scaling Managed Agents: Decoupling the brain from the hands”, published the same day as the launch. It starts with a familiar story. The first version put the session, the harness that calls Claude and the sandbox in one container. That made the server a pet, in the old pets-versus-cattle sense: if the container failed, the session was lost, and an unresponsive one had to be nursed back to health.

The fix was to split the agent into three parts that fail and scale independently:

• The session is an append-only log of everything that happened.
• The brain is the harness plus Claude. It reads the log and decides what to do next.
• The hands are sandboxes and tools, reached through one narrow interface, execute(name, input) → string.

Two consequences stand out. First, security: credentials never have to reach the sandbox where Claude’s generated code runs. Git tokens are wired in when the repository is cloned, and MCP calls go through a vault proxy. Second, speed: because the brain now asks for a container through a tool call only when it needs one, so a session that does not need a sandbox right away does not wait for one, Anthropic reported that median time to first token dropped by about 60 percent and the 95th percentile by more than 90 percent. The post’s closing idea is “many brains, many hands”, where one brain can drive several sandboxes.

The same pairing shows up in other agent designs. DeepSeek’s Super-agent article cites this post when it argues for keeping an agent’s compute, state and environment apart. If you want the comparison, our guide to the DeepSeek Super-Agent covers the router and worker side of that story.

What has shipped since launch?

Managed Agents moved quickly after April. This timeline comes from Anthropic’s own announcements.

Live from Code with Claude: we’re launching dreaming in Claude Managed Agents as a research preview.

Outcomes, multiagent orchestration, and webhooks are now in public beta. https://t.co/p4DFRzFEd8

– Claude (@claudeai) May 6, 2026

We’ve just added two new Claude Managed Agents features:

1. Scheduled deployments – run tasks on a schedule

2. Environment variables – expose vault credentials for CLIs as environment variables https://t.co/exfhz4yylr

– ClaudeDevs (@ClaudeDevs) June 11, 2026

How does a session actually run?

The flow is short. You create an agent, create an environment, start a session that points at both, and then exchange events. The quickstart does this in a few commands. The agent is a small file with front matter and a prompt, and the environment is a few lines of YAML:

# coding-assistant.md
---
name: Coding Assistant
model: claude-opus-5-5
tools:
  - type: agent_toolset_20260401
---

You are a helpful coding assistant. Write clean, well-documented code.

# environment.yaml
name: quickstart-env
config:
  type: cloud
  networking:
    type: limited
    allow_package_managers: true

# Create both, then start a session
ant apply coding-assistant.md environment.yaml
ant beta:sessions create \
  --agent "$AGENT_ID" \
  --environment-id "$ENVIRONMENT_ID" \
  --title "Quickstart session"

After that, you send user events and read the stream. Files the agent writes to /mnt/session/outputs/ become available through the Files API, scoped to that session. ant beta:sessions connect opens a viewer for a live session.

Tool use is governed by permission policies. The agent toolset defaults to always_allow, MCP tools default to always_ask, and with auto the server evaluates each call and runs it, denies it or pauses for your approval. Third-party credentials live in vaults, either as MCP OAuth or bearer credentials, or as environment-variable credentials that the agent only ever sees as opaque placeholders, swapped for the real value when a request leaves the sandbox.

What can the agent do beyond one loop?

Subagents, workflows and an advisor

The multiagent setup lets an agent delegate. Delegation is one level deep, with at most 25 child threads. For bigger jobs, a dynamic workflow lets the agent write a program that runs many agents in the background, and the session can consult an advisor model mid-turn for guidance, such as planning an approach or reviewing work, while it keeps doing the work itself.

Outcomes

Outcomes turn a vague “make it good” into a loop. You give a rubric, and a grader working in a separate context scores the result and sends the agent back to improve it. max_iterations defaults to 3 and can go up to 20.

Budgets

A session can carry a hard spending cap, expressed in US cents as a string. It is enforced between model requests, so a single long request can still finish before the cap bites. When the limit is reached, the session goes idle with budget_reached and waits for you.

Memory and dreaming

Memory stores are mounted into the sandbox at /mnt/memory/. Each memory is capped at 100 kB, a store holds up to 10,000 memories, and every change creates an immutable version. Dreaming, still a research preview, reads between 1 and 100 past sessions and proposes a deduplicated, reorganized memory store. It never edits the input store, so you can compare before you adopt it.

Scheduled deployments

A scheduled deployment runs an agent on a cron expression in an IANA time zone. Anthropic adds jitter of up to 15 percent of the interval, with a 5-second minimum and a 9-minute maximum, so thousands of schedules do not fire at the same instant. An organization can have up to 1,000 deployments, and a budget applies to each run.

How do teams get agents into production?

New blog post from our Applied AI team on Claude Managed Agents and the challenges it solves (credentials, sandboxing, observability, & more) … https://t.co/02fp1NMZ6a

– ClaudeDevs (@ClaudeDevs) June 16, 2026

Should the sandbox be in the cloud or on your own machines?

The default is an Anthropic-managed cloud sandbox. If your code, data or network cannot leave your infrastructure, you can run a self-hosted sandbox instead: a worker on your side carries out the bash and file tool calls. The brain still runs on Anthropic’s side, so conversation history and tool results still reach the service.

Since August 19, work done in a self-hosted sandbox can also be saved to memory.

We shipped three updates to Claude Managed Agents.

First, we made it easier to use memory with Self-Hosted Sandboxes.

Any work done in a Self-Hosted Sandbox can be saved to memory. https://t.co/tIoCSU28qk

– ClaudeDevs (@ClaudeDevs) August 19, 2026

How much do Claude Managed Agents cost?

You pay for tokens at the model’s normal rates, plus $0.08 per session-hour, billed only while the session is in the running status. Time spent idle, waiting for you, is not billed. Web search costs $10 per 1,000 searches. US-only inference multiplies token prices by 1.1, and there is no batch discount.

Anthropic’s pricing page works through an example: a one-hour session on Opus 5.5, priced at $4 per million input tokens and $20 per million output tokens, with 50,000 input and 15,000 output tokens.

With prompt caching, the same session comes to $0.428 in the docs’ example. The point of the example is the shape of the bill: for a short, token-light session, runtime is a small slice, and for long sessions that sit mostly idle it is smaller still. Spend is dominated by tokens, which is why session budgets matter.

What are the limits and risks?

• It is a beta. The feature set changes quickly, and MCP tunnels and dreaming are still research previews.
• Compliance gaps. Managed Agents is not eligible for zero data retention or HIPAA, and transcripts persist until you delete them.
• Hard caps. Delegation is one level deep with at most 25 child threads, and an organization can hold 1,000 scheduled deployments.
• No batch discount, and US-only inference costs 10 percent more on tokens.
• Security is still your job. Anthropic’s deployment guidance is to give each agent the smallest tool set that works, use limited networking, keep credentials in vaults, set always_ask on irreversible tools, and never combine always_allow write or execute tools with an agent that reads untrusted input.

Is the free workshop worth your time?

Anthropic ran a four-part, roughly 90-minute Managed Agents workshop at AI Engineer World’s Fair 2026 in San Francisco. It is led by Priyanka Phatak, who leads the Managed Agents engineering team, and Gabe Cemaj, and the recording is on the AI Engineer site. It went viral on X on October 30 with a chapter list:

1. Why the brain and the hands should be separate (00:00)
2. The architecture behind Claude Managed Agents (07:45)
3. Building a research agent step by step (23:40)
4. Scheduled agents that dream between tasks (54:00)
5. Evals, CI/CD and running agents for many customers (1:10:23)

Anthropic engineers just released the best 90-minute course on building AI agents from scratch I’ve ever seen:

• 00:00 – why the brain and the hands should be separate
• 07:45 – the architecture behind Claude Managed Agents
• 23:40 – building a research agent step by step
• 54:00 – agents that run on a schedule and “dream” between tasks
• 1:10:23 – evals, CI/CD and running agents for many customers at once

This alone will replace every $500 agent tutorial you can find on the internet.

Watch it, then go further and build a system that improves itself with the article below.

– Anatoli Kopadze (@AnatoliKopadze) October 30, 2026

Take the “replaces every $500 tutorial” line as enthusiasm. The useful part is concrete: the first section is the same architecture as the engineering post, the research agent build shows a realistic session end to end, and the last section answers the questions teams ask next, namely evals, CI/CD and multi-tenancy.

When should you use Managed Agents, the Messages API or something self-run?

• Use Managed Agents when the work is long-running or asynchronous, needs a sandbox with real tools, and you would rather not maintain the loop, the container lifecycle and the credential plumbing.
• Use the Messages API when you need a custom loop, tight control over every step, or a short request-response interaction.
• Use a self-hosted sandbox when files and execution must stay on your infrastructure, and you can accept that history and tool results still pass through Anthropic.

It also helps to separate it from agent systems that solve a different problem. Managed Agents is infrastructure for where one agent runs and what it can touch. A router such as DeepSeek’s dsh-superagent is about who an agent listens to and when it acts. You could imagine using both.

Where should a managed agent’s output go?

A scheduled agent that writes a Monday competitor digest, or a research session that builds a comparison spreadsheet, ends with a file in /mnt/session/outputs/. The Files API makes it retrievable, but only for that session, and the file is still just a file. Someone has to open it, ask for changes, hand it to another assistant and remember which version is current.

AgentGrid.io is built for that stage. People and AI agents work on the same live documents, apps and files, with a stable address, controlled access and a history that names who changed what, human or agent. Agents connect from a command-capable environment by running npx @animaapp/cli@latest login, and a human approves the agent’s name, team and which of read, write, share and publish it gets. Managed Agents has no built-in AgentGrid.io integration, so the simple pattern is your own code, or a step in your pipeline, that takes the finished file from the Files API and places it in a shared workspace. Our guide to sharing context between Claude and ChatGPT shows the same idea for conversations.

Frequently asked questions

What are Claude Managed Agents?

Claude Managed Agents is Anthropic’s hosted runtime for long-running agents, in public beta since April 8, 2026. You define an agent and an environment, start a session, and Anthropic runs the loop, the tools and the cloud sandbox, streaming events back to your application.

How much do Claude Managed Agents cost?

You pay standard token rates for the model, plus $0.08 per session-hour while a session is running. Idle time is not billed. Web search is $10 per 1,000 searches, and US-only inference multiplies token prices by 1.1. Anthropic’s one-hour Opus 5.5 example with 50,000 input and 15,000 output tokens comes to $0.58.

Is Claude Managed Agents generally available?

Not yet. It is in beta, you opt in with the managed-agents-2026-04-01 beta header, and some features, including dreaming and MCP tunnels, are research previews.

How is Managed Agents different from the Messages API?

With the Messages API you write the agent loop, tools and sandbox yourself, which suits custom loops and fine-grained control. Managed Agents runs the loop and a sandbox for you and suits long-running, asynchronous work.

Can Claude Managed Agents run on my own infrastructure?

Partly. A self-hosted sandbox lets a worker on your infrastructure execute bash and file tools, but Claude itself still runs on Anthropic’s side, so conversation history and tool results still reach the service.

Can Managed Agents work with sensitive data?

Be careful. The service is not eligible for zero data retention or HIPAA, transcripts persist until you delete them, and Anthropic recommends limited networking, vault credentials and approval prompts for irreversible tools.