How Claude Managed Agents Works

Claude Managed Agents is Anthropic's hosted service for running Claude as an agent. You define an agent once through the Claude API, start a session, and send it messages. Anthropic runs the loop that calls Claude, runs its tools in a sandbox, and keeps the session's history.

It launched in public beta in April 2026. Most of its behavior follows from keeping each session as a log outside both the agent loop and the sandbox. That's why a session can wait for days and survive a crash. The same design decides what you can change mid-session, how long files last, and where your data goes.

What Claude Managed Agents Is

Managed Agents is built on four concepts. An agent is a saved, versioned config with a model, a system prompt, tools, MCP servers, and skills. An environment says where the tools run, in a cloud sandbox that Anthropic manages or on your own infrastructure. A session is one running agent in an environment, and events are the messages, tool results, and status updates it exchanges with your app.

The Python SDK walks through all four and sets the beta header for you:

from anthropic import Anthropic
client = Anthropic()
agent = client.beta.agents.create(    name="Coding assistant",    model="claude-opus-5-5",    system="You write, run, and test small Python programs.",    tools=[{"type": "agent_toolset_20260401"}],)environment = client.beta.environments.create(    name="python-env",    config={"type": "cloud", "networking": {"type": "limited", "allow_package_managers": True}},)session = client.beta.sessions.create(agent=agent.id, environment_id=environment.id)
with client.beta.sessions.events.stream(session.id) as stream:    client.beta.sessions.events.send(session.id, events=[{        "type": "user.message",        "content": [{"type": "text", "text": "Print the first 20 Fibonacci numbers to fibonacci.txt."}],    }])    for event in stream:        if event.type == "session.status_idle":            break

The stream opens before the first message goes out, because a stream only delivers events emitted after it opens.

How a Session Works

Anthropic's engineers describe the design as decoupling the brain from the hands, with the session as an append-only log of everything that happened. The harness that calls Claude keeps nothing of its own, so after a crash a new one reloads the log and continues. A failed container comes back to Claude as a tool error, and a new container replaces it.

The same split keeps credentials out of the sandbox. Git tokens are used only to clone the repository during setup, and MCP tokens sit in a vault that a proxy reads for each call.

From your app's side, a session is running while the agent works and idle while it waits for a message, a custom tool result, or an approval. It keeps its history until you delete it, and its sandbox is checkpointed each time the session goes idle. The sandbox's state, though, lasts only 30 days from creation, and activity doesn't extend that window.

Where It Runs

The environment decides where the agent's tools run and how much of a session stays on your own machines. In a cloud environment, each session gets a fresh Linux container with up to 8 GB of memory and 10 GB of disk.

Python, Node.js, Go, Java, Postgres, and Playwright come installed. You set the network rules, and an environment created through the API gets unrestricted network access unless you choose limited, as the example above does.

A self-hosted sandbox swaps that container for a worker you run on your own machines. It carries out the agent's bash and file tool calls and sends each result back.

The loop, conversation history, tool results, skills, and memory stores stay at Anthropic, so only the sandbox's files and processes stay with you. You also lose file and GitHub repository mounting and environment variable credentials.

Running the whole service yourself is a separate offering, available by request through Anthropic's account team. It supports only Claude models, and its pricing isn't published (how it compares).

Tools, Memory, and the Rest

Around the loop sit features for what an agent can do, what it remembers between sessions, and how its work is divided, scheduled, and checked.

What an agent can do starts with the built-in toolset, which covers bash, file reads and edits, glob, grep, web search, and web fetch. You can add MCP servers, skills, and custom tools that your own app runs.

Built-in tools run without approval unless a permission policy says otherwise. Under the auto policy, Anthropic's server judges each call, and Anthropic warns that auto "is not a human checkpoint."

Vaults hold an end user's credentials for tools that reach other services, and you attach one when you create a session. MCP OAuth tokens are refreshed for you, and API keys are swapped into outbound requests at egress, so the agent never sees the secret.

What an agent remembers between sessions lives in memory stores, sets of text files mounted in the sandbox that it reads and writes with its file tools. Every change creates a version you can audit or roll back. Stores attach read-write by default, which Anthropic flags as a prompt injection risk for agents that read untrusted input.

Over many sessions, a store collects duplicates and stale entries, and a dream produces a cleaned-up copy. It reads the store and up to 100 past sessions, then writes a new, reorganized store and leaves the original untouched. Dreams are in research preview behind an access request. Each one takes minutes to a few hours and bills at normal token rates.

For bigger jobs, an agent can delegate to subagents one level deep, and they share its sandbox and credentials. With dynamic workflows, Claude writes a program that runs many agents in phases in the background.

The remaining features control when work starts and when it stops. Scheduled deployments start sessions on a cron schedule, and webhooks report state changes. An outcome gives the agent a rubric, and a separate grader checks each attempt until the work passes or runs out of tries. Budgets pause a session once its cost reaches a cap.

What It Costs

A session's bill has two parts. You pay Anthropic's standard token rates plus $0.08 per session-hour, metered only while a session is running.

In Anthropic's example, an hour on Claude Opus 5.5 with 50,000 input and 15,000 output tokens costs $0.58. That's $0.50 in tokens at $4 and $20 per million, plus $0.08 of runtime. Claude Managed Agents Pricing works through examples by model and fleet size.

Claude Managed Agents vs Claude Code and the Agent SDK

All three come from Anthropic and give Claude similar tools, but they differ in who runs the loop and where the session lives. Anthropic compares them the same way:

Claude Code is a product you use, and Managed Agents is an API you build on, so the closer comparison is with the Agent SDK. The SDK runs the Claude Code binary, so you get its hooks, plan mode, and .claude/ settings. Its session files stay on the machine that created them unless you add a session store.

Moving to Managed Agents hands the loop to Anthropic. Its migration guide lists what moves to your client in exchange, including hooks, plan mode, and turn limits.

Your App Still Runs a Client

Anthropic runs the loop, but an agent with custom tools or approvals still needs code of yours that answers them. A session that needs one sits idle until your app replies, whether that's a long-running client or a handler that a webhook wakes up.

Reading events takes care too, since reconnecting means opening a new stream, listing the full history, and skipping duplicates. Webhooks make up to three delivery attempts, so Anthropic recommends reconciling by listing resources as well.

Where It Gets Hard

The service's limits show up as an agent moves from a prototype to something customers rely on. Some have workarounds inside the service, and others decide whether it fits at all.

A second model provider has to sit outside the agent. Every agent runs a Claude model, version 4.5 or later, and the agent itself can't run another lab's model or one you host. Routing a cheap triage step elsewhere means building and running a custom tool that calls that model.

Regulated data runs into where sessions are stored. The hosted service isn't eligible for Zero Data Retention or a HIPAA business associate agreement, because sessions keep history, sandbox state, and outputs on Anthropic's servers. A self-hosted sandbox doesn't change that, since tool results still pass through Anthropic's service.

A fix in the middle of a conversation can change only part of a session. Its model, system prompt, and skills are fixed for its lifetime, and agent updates apply only to new sessions. You can swap its tools and MCP servers while it's idle, as long as no workflow run is open, and an interrupt doesn't end one. For smaller corrections on supported models, a system.message event appends guidance without replacing the prompt.

A conversation that lasts months will outlive its sandbox, which resets after 30 days. Anything a long-lived agent needs to keep has to live in memory stores or downloaded outputs, and a store can't be added to a running session.

Serving many customers works through vaults, since you pass each customer's vault when you create a session. The map from customers to sessions and vaults lives in your code. Anthropic advises separate workspaces for different trust levels, because anyone who can start sessions in a workspace can use its vaults. Budgets also cap one session at a time rather than one customer.

Finally, every surface is still in beta. Each endpoint needs a beta header, and memory stores use a different one from the rest of the API. Dreams and MCP tunnels sit in a narrower research preview, where Anthropic says it "might refine behaviors between releases."

How Omnara Compares

Omnara is the open-source managed agent platform, with the same shape as Managed Agents. Every step is saved to Postgres as it happens, and workers keep nothing of their own. After a crash, another worker continues from the last saved step.

A tool call the crash cut off isn't rerun. It comes back to the agent marked interrupted, with its outcome unknown, so the agent can check before trying again.

Where the two differ is in the hard cases above, including the client your app runs:

• A second provider needs no custom tool. Omnara works with models from OpenAI, Anthropic, OpenRouter, Amazon Bedrock, or any compatible endpoint, including models you host, on your own keys. Each subagent can use a different one, so a small model can triage while Claude Opus handles the hard steps.
• For regulated data, you can self-host the whole platform, including the agent loop and every agent's history, in your own Postgres. That works on the HIPAA-eligible services of any cloud that signs a business associate agreement, including AWS, Google Cloud, Azure, and Oracle Cloud. With a model you host, prompts never leave your infrastructure.
• A fix mid-conversation goes through the API, where you change a running agent's model, tools, permissions, or instructions. The change applies at its next model call.
• A months-long conversation is a single agent, which keeps one history for its whole life. Omnara compacts what it sends to the model when the context fills up, and memory stores share files across conversations. For files that need to last, agents can also run commands on your own servers through a daemon that only makes outbound connections.
• For many customers, agents are API objects you launch per customer, ticket, or thread, inside organizations and projects with their own roles. Inputs can be attributed to your own end users. The API reports usage and cost per agent, project, and organization, so your app enforces its own per-customer limits.
• On the client side, streams resume from the last saved event after a reconnect. Approvals and custom tool calls wait as long as your people and systems need.

Omnara runs its own agent loop instead of Anthropic's harness. On Terminal-Bench 4.0, Omnara matched the pass rates of Claude Code and Codex on the same models. It ran 12% faster than Claude Code and 11% cheaper than Codex. It also had the top score. Terminal-Bench's own runner graded every run, and the traces and harness are public.

On Omnara Cloud, there's no platform fee or session-hour fee, and your own model keys and machines cost nothing. Models bought through Omnara cost the provider's token rates, and its machines are billed by usage. Both are paid with credits that carry a 5% service fee covering provider costs.

Self-hosting is free under Apache 2.0, and Omnara's team can also deploy and manage it in your own cloud (BYOC) or on premises. To set that up, book a call with the founders. You can export all your data at any time, including every agent's full history, and run it on your own self-hosted Omnara by emailing [email protected].

Which One to Use

Claude Managed Agents fits a Claude-only prototype or internal tool where you want nothing to host. Dreams, outcomes, and dynamic workflows come built in, as long as you're fine with Anthropic holding your sessions in a beta service.

For agents people depend on, choose Omnara, because it runs any model and you can self-host all of it. You can also fix a running agent without starting a new session. Agents per customer come with roles and usage reporting, with no platform fee.

To move existing agents, see migrating from Claude Managed Agents. For other options, see Claude Managed Agents alternatives.

FAQ

What is Claude Managed Agents?

It's Anthropic's hosted service for running Claude as an agent. You create agents, environments, and sessions through the Claude API's /v1/agents, /v1/environments, and /v1/sessions endpoints, and Anthropic runs the loop and the sandbox. It's in public beta and runs only Claude models.

How much does a Claude managed agent cost?

You pay standard token rates for the model, plus $0.08 for each hour a session is running, and idle time is free. In Anthropic's example, an hour on Claude Opus 5.5 with 50,000 input and 15,000 output tokens costs $0.58.

What's the difference between Claude Managed Agents and Claude Code?

Claude Code is Anthropic's coding agent, which developers use in a terminal, IDE, desktop app, or browser. Managed Agents is an API for building agents into your own product, with Anthropic hosting the loop and the sandbox. The Claude Agent SDK sits between them, giving you Claude Code's loop as a library you run on your own servers.

Can Claude be used as an agent?

Yes. Claude Code is a ready-made coding agent, and the Agent SDK runs Claude Code's loop inside your app. Managed Agents hosts the loop for you, while with the Messages API you write it yourself. Omnara also runs Claude agents on your own Anthropic key or Amazon Bedrock, alongside models from other labs.

Does Claude Managed Agents have memory?

Yes. Memory stores are versioned text files mounted in a session's sandbox, and they carry preferences and context from one session to the next. Dreams, in research preview, read a store and up to 100 past sessions, then write a cleaned-up copy with duplicates merged and stale entries replaced.