Summary: Anthropic opened Claude Managed Agents in public beta on April 8, 2026, offering hosted orchestration for sandboxed execution, state, memory, permissions, and scheduling. The service uses standard token rates plus $0.08 per active session-hour, and the article reports large latency reductions and an Anthropic claim of 10x faster time to production. For teams, it converts agent infrastructure work into managed APIs but makes long-running session time a direct cost item.
Claude Managed Agents entered public beta on April 8, 2026, announced by Anthropic. Packaged as composable APIs for cloud-hosted agents, the offering absorbs the pieces teams dread wiring up themselves — sandboxed execution, state and memory management, permissioning, scheduled execution — into a hosted layer, leaving you to spell out the tasks and the tools. You pay as you go: standard token rates, with $0.08 added for every session-hour the agent is actively running.
The significance is the change of shape. Standing up a production-grade agent used to be an infrastructure project; now it collapses into a set of API calls. Anthropic leads with a 10x faster time to production claim, and the early customer roster — Notion, Sentry, Atlassian, Rakuten, Asana, Vibecode — reportedly covered the distance from prototype to launch in days to weeks rather than months.
Inside the Beta
At the center sits an orchestration harness operated by Anthropic, which works out when tools should fire, how context gets handled, and what recovery looks like after a failure. Around that core:
- Sandboxed tool execution with security baked in, along with authentication and scoped permissions
- Sessions that keep working autonomously for hours at a stretch and hold onto their progress through disconnections
- Built-in memory that carries across sessions, plus scheduled deployments drawing on vault-stored credentials
- Coordination among multiple agents, and an outcome-based mode (each currently a research preview)
- Claude Console tooling for session tracing and analytics, with debugging down to each individual tool call
You can enter through four doors: the documentation, the agent quickstart inside the Console, a brand-new CLI, or the claude-api Skill that ships built into Claude Code.
Brain, Hands, Session: An Operating-System Take on the Design
To walk through the design, the engineering team borrows an analogy from operating systems: Claude together with its harness is the “brain”; the sandboxes and tools that do the acting are the “hands”; and the “session” is, at bottom, an append-only event log. The three sit behind separate interfaces, so any one can fail or be swapped out on its own.
The first cut of the system stuffed all three roles into a single container, which turned the sandbox into a “pet” — once lost, it could not be brought back. The redesign recasts the sandbox as a tool call: execute(name, input) hands back a string, a container that dies shows up as an ordinary tool error, and when Claude retries, the harness re-provisions it via provision. The harness itself keeps no state and can restart at any moment: after a crash it boots up again, pulls wake(sessionId) and getSession(id) to fetch the history, and picks up from the final event. The team’s punchline: the harness “doesn’t know whether the sandbox is a container, a phone, or a Pokémon emulator.”
One distinction is easy to miss: the session and the context window are different things. Through getEvents the brain can read positional slices of the log, while the harness is free to compact, trim, or tune for prompt caching before any of it reaches the model.
Keeping Credentials Out of the Sandbox
If the design has a load-bearing wall, it is credential isolation. No sandbox that runs Claude-written code ever gets its hands on credentials: a Git token is spent only while the sandbox initializes (cloning the repo, wiring the remote), and MCP OAuth tokens stay parked in an external vault reachable only through a dedicated proxy — one the harness never lays eyes on. Stack scoped permissions, identity management, and execution tracing on top, and you have the governance story.
The Numbers and the Bill
The engineering post comes with measurements. Because a container gets provisioned only when some tool call actually needs it, upfront setup disappears: p50 time-to-first-token fell by roughly 60%, and p95 by more than 90%. On task success, internal testing recorded gains of up to 10 points over a standard prompting loop, and the harder the problem, the wider the gain. On the bill: standard token rates plus the $0.08 per session-hour runtime fee. Indragie Karunaratne, Senior Director of Engineering for AI/ML at Sentry, credited the product with handing Sentry a secure, fully managed agent runtime and letting the team ship its integration in weeks without maintaining agent infrastructure.
How to Read This as a Developer
Three observations worth weighing. One: treat this as a complement to Claude Code, not a successor — local terminals and cloud hosting fit different workflows, and what the managed layer takes off your plate is operations, not your control. Two: under this pricing, an idle agent becomes its own line item; count your session-hours before you commit to long-running jobs. Three: managed agent infrastructure is on its way to becoming a commodity — the product sits right inside the “platforms for building agents” layer of the three-layer agentic infrastructure model, and the only open question is who carries the operations cost.