How Claude Managed Agents Works

Anthropic launched Claude Managed Agents in public beta in April 2026, a hosted service that runs Claude as an agent by keeping each session as an append-only log outside both the agent loop and the sandbox, so a session can wait for days and survive a crash. The service is built on four concepts — agents, environments, sessions and events — with cloud sessions running in a fresh Linux container with up to 8 GB of memory and 10 GB of disk, while sandbox state lasts only 30 days from creation and activity does not extend that window. A self-hosted sandbox option keeps only files and processes on the customer's machines, with the loop, conversation history, tool results, skills and memory stores remaining at Anthropic, and a fully self-run offering is available by request with unpublished pricing.

All guides https://www.omnara.com/guides How Claude Managed Agents Works Agents, environments, sessions, and events, what it costs, how it differs from Claude Code, and where it gets hard in production On this page Claude Managed Agents https://platform.claude.com/docs/en/managed-agents/overview is Anthropic's hosted service for running Claude as an agent. You define an agent once through the Claude API, start a session, and send it messages. Anthropic runs the loop that calls Claude, runs its tools in a sandbox, and keeps the session's history. It launched in public beta in April 2026. Most of its behavior follows from keeping each session as a log outside both the agent loop and the sandbox. That's why a session can wait for days and survive a crash. The same design decides what you can change mid-session, how long files last, and where your data goes. What Claude Managed Agents Is Managed Agents is built on four concepts https://platform.claude.com/docs/en/managed-agents/overview core-concepts . An agent is a saved, versioned config with a model, a system prompt, tools, MCP servers, and skills. An environment says where the tools run, in a cloud sandbox that Anthropic manages or on your own infrastructure. A session is one running agent in an environment, and events are the messages, tool results, and status updates it exchanges with your app. The Python SDK walks through all four and sets the beta header for you: The stream opens before the first message goes out, because a stream only delivers events emitted after it opens. How a Session Works Anthropic's engineers describe the design as decoupling the brain from the hands https://www.anthropic.com/research/managed-agents , with the session as an append-only log of everything that happened. The harness that calls Claude keeps nothing of its own, so after a crash a new one reloads the log and continues. A failed container comes back to Claude as a tool error, and a new container replaces it. The same split keeps credentials out of the sandbox. Git tokens are used only to clone the repository during setup, and MCP tokens sit in a vault that a proxy reads for each call. From your app's side, a session is running while the agent works and idle while it waits for a message, a custom tool result, or an approval. It keeps its history until you delete it, and its sandbox is checkpointed each time the session goes idle. The sandbox's state, though, lasts only 30 days https://platform.claude.com/docs/en/managed-agents/events-and-streaming resume-an-idle-session from creation, and activity doesn't extend that window. Where It Runs The environment decides where the agent's tools run and how much of a session stays on your own machines. In a cloud environment, each session gets a fresh Linux container https://platform.claude.com/docs/en/managed-agents/cloud-sandboxes-reference with up to 8 GB of memory and 10 GB of disk. Python, Node.js, Go, Java, Postgres, and Playwright come installed. You set the network rules, and an environment created through the API gets unrestricted network access unless you choose limited , as the example above does. A self-hosted sandbox swaps that container for a worker you run https://platform.claude.com/docs/en/managed-agents/choosing-an-environment on your own machines. It carries out the agent's bash and file tool calls and sends each result back. The loop, conversation history, tool results, skills, and memory stores stay at Anthropic, so only the sandbox's files and processes stay with you. You also lose file and GitHub repository mounting and environment variable credentials. Running the whole service yourself is a separate offering, available by request through Anthropic's account team. It supports only Claude models, and its pricing isn't published how it compares https://www.omnara.com/guides/self-hosted-managed-agents self-hosted-claude-managed-agents . Tools, Memory, and the Rest Around the loop sit features for what an agent can do, what it remembers between sessions, and how its work is divided, scheduled, and checked. What an agent can do starts with the built-in toolset, which covers bash, file reads and edits, glob, grep, web search, and web fetch. You can add MCP servers, skills, and custom tools https://platform.claude.com/docs/en/managed-agents/tools custom-tools that your own app runs. Built-in tools run without approval unless a permission policy https://platform.claude.com/docs/en/managed-agents/permission-policies says otherwise. Under the auto policy, Anthropic's server judges each call, and Anthropic warns that auto "is not a human checkpoint." Vaults https://platform.claude.com/docs/en/managed-agents/vaults hold an end user's credentials for tools that reach other services, and you attach one when you create a session. MCP OAuth tokens are refreshed for you, and API keys are swapped into outbound requests at egress, so the agent never sees the secret. What an agent remembers between sessions lives in memory stores https://platform.claude.com/docs/en/managed-agents/memory , sets of text files mounted in the sandbox that it reads and writes with its file tools. Every change creates a version you can audit or roll back. Stores attach read-write by default, which Anthropic flags as a prompt injection risk for agents that read untrusted input. Over many sessions, a store collects duplicates and stale entries, and a dream https://platform.claude.com/docs/en/managed-agents/dreams produces a cleaned-up copy. It reads the store and up to 100 past sessions, then writes a new, reorganized store and leaves the original untouched. Dreams are in research preview behind an access request. Each one takes minutes to a few hours and bills at normal token rates. For bigger jobs, an agent can delegate to subagents https://platform.claude.com/docs/en/managed-agents/multiagent-orchestration one level deep, and they share its sandbox and credentials. With dynamic workflows, Claude writes a program that runs many agents in phases in the background. The remaining features control when work starts and when it stops. Scheduled deployments https://platform.claude.com/docs/en/managed-agents/scheduled-deployments start sessions on a cron schedule, and webhooks report state changes. An outcome https://platform.claude.com/docs/en/managed-agents/define-outcomes gives the agent a rubric, and a separate grader checks each attempt until the work passes or runs out of tries. Budgets pause a session once its cost reaches a cap. What It Costs A session's bill has two parts. You pay Anthropic's standard token rates plus $0.08 per session-hour https://platform.claude.com/docs/en/about-claude/pricing claude-managed-agents-pricing , metered only while a session is running . In Anthropic's example, an hour on Claude Opus 5.5 with 50,000 input and 15,000 output tokens costs $0.58. That's $0.50 in tokens at $4 and $20 per million, plus $0.08 of runtime. Claude Managed Agents Pricing https://www.omnara.com/guides/claude-managed-agents-pricing works through examples by model and fleet size. Claude Managed Agents vs Claude Code and the Agent SDK All three come from Anthropic and give Claude similar tools, but they differ in who runs the loop and where the session lives. Anthropic compares them https://code.claude.com/docs/en/agent-sdk/overview the same way: Claude Code is a product you use, and Managed Agents is an API you build on, so the closer comparison is with the Agent SDK. The SDK runs the Claude Code binary, so you get its hooks, plan mode, and .claude/ settings. Its session files https://code.claude.com/docs/en/agent-sdk/sessions stay on the machine that created them unless you add a session store. Moving to Managed Agents hands the loop to Anthropic. Its migration guide https://platform.claude.com/docs/en/managed-agents/migration from-the-claude-agent-sdk lists what moves to your client in exchange, including hooks, plan mode, and turn limits. Your App Still Runs a Client Anthropic runs the loop, but an agent with custom tools or approvals still needs code of yours that answers them. A session that needs one sits idle until your app replies, whether that's a long-running client or a handler that a webhook wakes up. Reading events takes care too, since reconnecting https://platform.claude.com/docs/en/managed-agents/events-and-streaming reconnect-without-missing-events means opening a new stream, listing the full history, and skipping duplicates. Webhooks https://platform.claude.com/docs/en/managed-agents/webhooks delivery-behavior make up to three delivery attempts, so Anthropic recommends reconciling by listing resources as well. Where It Gets Hard The service's limits show up as an agent moves from a prototype to something customers rely on. Some have workarounds inside the service, and others decide whether it fits at all. A second model provider has to sit outside the agent. Every agent runs a Claude model https://platform.claude.com/docs/en/managed-agents/agent-setup , version 4.5 or later, and the agent itself can't run another lab's model or one you host. Routing a cheap triage step elsewhere means building and running a custom tool that calls that model. Regulated data runs into where sessions are stored. The hosted service isn't eligible https://platform.claude.com/docs/en/managed-agents/overview beta-access for Zero Data Retention or a HIPAA business associate agreement, because sessions keep history, sandbox state, and outputs on Anthropic's servers. A self-hosted sandbox doesn't change that, since tool results still pass through Anthropic's service. A fix in the middle of a conversation can change only part of a session. Its model, system prompt, and skills are fixed for its lifetime https://platform.claude.com/docs/en/managed-agents/session-operations updating-the-agent-configuration , and agent updates apply only to new sessions. You can swap its tools and MCP servers while it's idle, as long as no workflow run is open, and an interrupt doesn't end one. For smaller corrections on supported models, a system.message event appends guidance without replacing the prompt. A conversation that lasts months will outlive its sandbox, which resets after 30 days. Anything a long-lived agent needs to keep has to live in memory stores or downloaded outputs, and a store can't be added to a running session. Serving many customers works through vaults, since you pass each customer's vault when you create a session. The map from customers to sessions and vaults lives in your code. Anthropic advises separate workspaces https://platform.claude.com/docs/en/managed-agents/secure-deployment for different trust levels, because anyone who can start sessions in a workspace can use its vaults. Budgets also cap one session at a time rather than one customer. Finally, every surface is still in beta. Each endpoint needs a beta header, and memory stores use a different one from the rest of the API. Dreams and MCP tunnels sit in a narrower research preview, where Anthropic says it "might refine behaviors between releases." How Omnara Compares Omnara https://github.com/omnara-ai/omnara is the open-source managed agent platform, with the same shape as Managed Agents. Every step is saved to Postgres as it happens, and workers keep nothing of their own. After a crash, another worker continues from the last saved step. A tool call the crash cut off isn't rerun https://docs.omnara.com/agents/failure-handling . It comes back to the agent marked interrupted, with its outcome unknown, so the agent can check before trying again. Where the two differ is in the hard cases above, including the client your app runs: - A second provider needs no custom tool. Omnara works with models from OpenAI, Anthropic, OpenRouter, Amazon Bedrock, or any compatible endpoint https://docs.omnara.com/organization/model-providers , including models you host, on your own keys. Each subagent can use a different one, so a small model can triage while Claude Opus handles the hard steps. - For regulated data, you can self-host https://docs.omnara.com/self-hosting/deployment the whole platform, including the agent loop and every agent's history, in your own Postgres. That works on the HIPAA-eligible services of any cloud that signs a business associate agreement, including AWS, Google Cloud, Azure, and Oracle Cloud. With a model you host, prompts never leave your infrastructure. - A fix mid-conversation goes through the API, where you change a running agent's https://docs.omnara.com/events/sending-input change-the-config-mid-conversation model, tools, permissions, or instructions. The change applies at its next model call. - A months-long conversation is a single agent, which keeps one history for its whole life. Omnara compacts what it sends to the model when the context fills up, and memory stores https://docs.omnara.com/agents/configuration memory-stores share files across conversations. For files that need to last, agents can also run commands on your own servers through a daemon https://docs.omnara.com/machines/overview that only makes outbound connections. - For many customers, agents are API objects you launch per customer, ticket, or thread, inside organizations and projects with their own roles. Inputs can be attributed to your own end users. The API reports usage and cost per agent, project, and organization, so your app enforces its own per-customer limits. - On the client side, streams resume https://docs.omnara.com/events/streaming from the last saved event after a reconnect. Approvals and custom tool calls https://docs.omnara.com/tools/custom wait as long as your people and systems need. Omnara runs its own agent loop instead of Anthropic's harness. On Terminal-Bench 4.0, Omnara matched the pass rates of Claude Code and Codex on the same models. It ran 12% faster than Claude Code and 11% cheaper than Codex. It also had the top score. Terminal-Bench's own runner graded every run, and the traces https://terminal-bench.omnara.com/ and harness are public. On Omnara Cloud https://www.omnara.com/pricing , there's no platform fee or session-hour fee, and your own model keys and machines cost nothing. Models bought through Omnara cost the provider's token rates, and its machines are billed by usage. Both are paid with credits that carry a 5% service fee covering provider costs. Self-hosting is free under Apache 2.0, and Omnara's team can also deploy and manage it in your own cloud BYOC or on premises. To set that up, book a call with the founders https://cal.com/ishaan-sehgal-8kc22w/chat-with-omnara . You can export all your data at any time, including every agent's full history, and run it on your own self-hosted Omnara by emailing \ email protected\ https://www.omnara.com/cdn-cgi/l/email-protection 0d6e6263796c6e794d6260636c7f6c236e6260 . Which One to Use Claude Managed Agents fits a Claude-only prototype or internal tool where you want nothing to host. Dreams, outcomes, and dynamic workflows come built in, as long as you're fine with Anthropic holding your sessions in a beta service. For agents people depend on, choose Omnara, because it runs any model and you can self-host all of it. You can also fix a running agent without starting a new session. Agents per customer come with roles and usage reporting, with no platform fee. To move existing agents, see migrating from Claude Managed Agents https://www.omnara.com/guides/migrate-from-claude-managed-agents . For other options, see Claude Managed Agents alternatives https://www.omnara.com/guides/claude-managed-agents-alternatives . FAQ What is Claude Managed Agents? It's Anthropic's hosted service for running Claude as an agent. You create agents, environments, and sessions through the Claude API's /v1/agents , /v1/environments , and /v1/sessions endpoints, and Anthropic runs the loop and the sandbox. It's in public beta and runs only Claude models. How much does a Claude managed agent cost? You pay standard token rates for the model, plus $0.08 for each hour a session is running, and idle time is free. In Anthropic's example, an hour on Claude Opus 5.5 with 50,000 input and 15,000 output tokens costs $0.58. What's the difference between Claude Managed Agents and Claude Code? Claude Code is Anthropic's coding agent, which developers use in a terminal, IDE, desktop app, or browser. Managed Agents is an API for building agents into your own product, with Anthropic hosting the loop and the sandbox. The Claude Agent SDK sits between them, giving you Claude Code's loop as a library you run on your own servers. Can Claude be used as an agent? Yes. Claude Code is a ready-made coding agent, and the Agent SDK runs Claude Code's loop inside your app. Managed Agents hosts the loop for you, while with the Messages API you write it yourself. Omnara also runs Claude agents on your own Anthropic key or Amazon Bedrock, alongside models from other labs. Does Claude Managed Agents have memory? Yes. Memory stores are versioned text files mounted in a session's sandbox, and they carry preferences and context from one session to the next. Dreams, in research preview, read a store and up to 100 past sessions, then write a cleaned-up copy with duplicates merged and stale entries replaced.