Self-Hosted Claude Managed Agents: What Stays on Your Servers?
- AI
- Guides
- Claude
- Privacy
- AI infrastructure
- Written by
- Bhargav Tibadiya
- Published
- Reading time
- 7 min read
Self-hosted Claude Managed Agents moves the agent service and its stored sessions onto infrastructure the customer operates. It does not move Claude's model weights there. Anthropic's November 12, 2026 release notes say the server sends model requests to the customer's chosen provider, with Anthropic as the default[1].
That distinction is the first thing to understand. A company can keep the service, session history and tool environments in its own cloud or data center while still sending the conversation to an outside inference provider. "Self-hosted" describes which product components the customer runs, not a blanket promise that no information leaves the network[2].
This is a guide to Anthropic's public product documentation. It is not a tested deployment, a compliance assessment or a claim that access is available to every account.
What the November release actually adds
Managed Agents has two broad parts customers can host: the environments where tools work, and the service that runs the agent loop and stores agents, sessions and history. Earlier self-hosted sandboxes moved the first part. The new option also moves the service[2].
The practical difference is control over more of the operating environment. A team that already needs to retain session records in its own infrastructure now has a documented option for doing so without building an entire agent service itself.
That also brings responsibility. The customer operates and secures the server, database and tool workers, manages its deployment and installs releases. Moving infrastructure does not remove the need to patch it, monitor it or design permissions carefully.
The release notes date the announcement to November 12. Access remains gated: the documentation directs customers to their Anthropic account team. Help Net Security's same-day coverage describes the release as a private beta[3].
The service, tools and model are different boundaries
Anthropic's public documentation distinguishes the API server and stored history from the workers that execute tool commands. The server calls the selected inference provider when the agent needs the model; tool execution happens in the customer's environments[2].
This matters when somebody asks, "Where is our data?" There is no single answer that applies equally to stored sessions, temporary files, logs and model requests. Each follows a different path.
A proposed deployment review should map those paths using the actual configuration. Identify where records persist, which environment executes a tool, which service receives model requests and who can inspect logs. Those are evaluation questions, not findings from an installation performed for this article.
Avoid treating the word "local" as a substitute for that map. A customer-hosted service can still depend on remote inference, network services and external business systems.
What leaves the customer's network
The documentation says each model call sends the conversation so far, including tool inputs and tool results, to the configured inference provider. The default is the Claude API. A Claude API call also carries identifiers for its session, agent and environment[2].
A team considering the product should therefore evaluate the selected provider's data handling, retention terms, regions and available model features. Hosting session storage yourself does not automatically settle those separate questions.
The provider choices described include Anthropic, Amazon Bedrock, Claude Models on Google Cloud, Microsoft Foundry and a customer-operated model gateway. A gateway changes how requests are routed; its existence alone does not establish that the model runs entirely within the customer's network.
For the same reason, this option should not be described as downloading Claude for offline use. It is a deployment choice for the Managed Agents service.
Persistent history needs persistent infrastructure
Anthropic specifies PostgreSQL 16 or later for the database. Without a database, the service retains data in memory and a restart erases it[2].
That is a concrete operational detail with a larger lesson: a successful first session is not evidence that a deployment will preserve the work a team needs. Persistence, backup and recovery deserve their own checks.
The same applies to workers. The public differences page says model turns can run when no worker is polling an environment, but the first tool call waits until a worker runs it. A session that appears stuck may therefore need an operational check rather than a different prompt[4].
These details make a small pilot useful before a migration. Define what should survive a restart, how a stopped worker is noticed and how the team confirms a job completed. The article did not test any of those behaviors in a live deployment.
The hosted API does not imply identical features
Anthropic says the self-hosted service exposes the same core API apart from documented differences. The exceptions are substantial enough to read before moving an application[4].
The differences page lists unavailable features including webhooks, scheduled deployments and dreams. A workflow that starts a worker from a hosted webhook will not simply start receiving those events from a self-hosted server.
Other features behave differently or need configuration. Some capabilities depend on the selected inference provider. A team should check the specific tools and workflow it uses rather than infer support from a shared API shape.
The page also describes differences in multiagent orchestration. That is another reason not to assume an existing application can move unchanged because a basic session starts successfully.
This is not an argument against self-hosting. It is a reminder that feature compatibility is a separate decision from where storage lives.
Migration does not copy the old environment
The official differences page explicitly says nothing is copied from the hosted service, including session history. Agents, skills, credentials and memory stores need to be recreated on the customer's server[4].
That makes migration planning part of the adoption cost. A team may need to recreate configuration, decide which history must be retained and verify how its application points to the new service.
Do not interpret "same API" as an automatic transfer of old sessions. Likewise, a new console should not be assumed to show the records in the old hosted environment.
For a proposed evaluation, choose a small, noncritical workflow with known inputs and a clear expected outcome. Compare the old and new behavior, record the missing features and test recovery. This is a suggested review method, not a migration this article completed.
More control also means more operating work
Self-hosting can help a team meet an infrastructure requirement, but somebody now owns the database, deployment security, access controls and upgrades. Anthropic's documentation makes that transfer of responsibility explicit[2].
Help Net Security's coverage notes that credentials can stay in the customer's environment and describes allowlists and activity logs. Those controls still depend on correct configuration and on the exact supported integration path[3].
A deployment should not be called safe merely because its tools run on a company machine. Tool permissions, network access, the handling of sensitive inputs and the authority to change a business system remain important.
The guide to separating agents from workflows is useful background. A deployment option does not decide which steps should be autonomous or which require a human decision.
When this option is worth evaluating
Start with the requirement that is driving the change. If it is only that tool commands must run on the customer's infrastructure, self-hosted sandboxes may be the narrower option. If it is also control of service storage and the choice of inference route, the full self-hosted service addresses a broader need[2].
Then compare that need with the feature gaps and operating work. A smaller change that meets the actual requirement can be easier to support than a larger migration chosen because "self-hosted" sounds more private.
The inspected pages do not establish a public price or a universal access path. Ask the vendor for the current commercial and access terms rather than inventing an infrastructure-only cost estimate.
The useful question is not whether self-hosting is better in the abstract. It is which boundary a team needs to control, what still leaves that boundary and whether the team can run the resulting system reliably.
FAQ
Does self-hosted Managed Agents run Claude on my servers?
Not by itself. The customer hosts the Managed Agents service and tool environments, while model requests go to the configured inference provider. It is not a release of local Claude model weights.
How is it different from self-hosted sandboxes?
Self-hosted sandboxes move tool execution to customer infrastructure while Anthropic runs the service. The broader option also moves the service and its agents, sessions and session-history storage.
Does self-hosting mean no data leaves the network?
No. The documentation says model calls send the conversation so far, including tool inputs and results, to the selected provider. Evaluate that provider's terms and the actual deployment configuration.
Can anyone download the service today?
The documentation directs customers to their Anthropic account team for access. The launch was reported as a private beta, not an unrestricted public download.
Does it include all hosted features?
No. The official differences page lists missing or changed features, including webhooks and scheduled deployments. Provider-specific support can differ too.
Will my old sessions move automatically?
No. Anthropic says nothing is copied from the hosted service, including history. Configuration and migration need their own plan and checks.
Sources
- Anthropic: Claude Platform release notes, November 12, 2026 entry (opens in a new tab)
- Anthropic documentation: Self-hosted Claude Managed Agents (opens in a new tab)
- Help Net Security: Self-hosted Managed Agents, November 12, 2026 (opens in a new tab)
- Anthropic documentation: Differences from the hosted service (opens in a new tab)
