- Anthropic members of technical staff Michael and Harrison introduce Claude Managed Agents, a platform that handles the infrastructure complexity (context/memory, reliability, security, latency, observability) that has become the real bottleneck to running capable agents in production.
- The platform exposes composable primitives — define an agent (system prompt, model, skills, tools, permissions), give it a sandboxed environment, kick off a session, and observe everything through a typed event stream of user, agent, session, and span events.
- New and advanced features were announced, including multi-agent orchestration, outcomes, memory, dreaming, self-hosted sandboxes (with Cloudflare, Daytona, Modal, Vercel), and MCP tunnels — followed by a panel where those infrastructure partners share what they are betting on.
How to get to production faster with Claude Managed Agents
- Model intelligence is no longer the main constraint; the bottleneck to letting agents "skate the exponential" is infrastructure — reliability, scalability, security, latency, and observability around the models.
- To accomplish more, agents need access to more: secure credentials, internal systems, private GitHub repos, and an identity/auth so they can use tools the way a human employee would.
- Interaction is shifting from conversational text-in/text-out toward outcome-oriented activity, where you hand the agent a task and it works autonomously, even pausing and resuming weeks or months later.
- Getting started has four steps: define an agent (a bundle of configuration and identity), give it a sandboxed environment (network allow list, pre-installed packages), kick off a session, and listen to the event stream to observe it.
- The event stream is split into user events, agent events, session events, and span events so developers can understand exactly what is happening, why, and when, all exposed via API.
- Advanced features include multi-agent orchestration (spawning agent threads with their own context windows), outcomes (a rubric Claude iterates against in a loop), memory (long-lived stores that make each session better), and dreaming (reflecting across thousands of sessions to refine memories).
- Two newly announced features: self-hosted sandboxes let you bring your own compute/VPC (via Cloudflare, Daytona, Modal, or Vercel), and MCP tunnels expose private MCP servers to Claude without exposing anything to the public internet.
- Panelists framed the emerging "human emulator" idea — give an agent a sandbox and it can do almost any digital knowledge-work task — while flagging open problems around identity propagation, egress filtering, and resume-ability of paused tasks.
Claude Managed Agents — Anthropic's platform that provides managed infrastructure and composable primitives for running production agents.
Primitive — A composable building block (e.g. agent definition, sandbox, session) you pick and choose to build your product on top of.
Sandbox — An isolated environment where an agent runs code, with configurable network allow lists and pre-installed packages.
Event stream — The ordered log of events for a session, split into user, agent, session, and span events, exposed via API.
Outcome — A rubric or set of goals that Claude iterates toward, grading its own output in a loop until satisfied.
Memory — Long-lived stores Claude reads from and writes to so each session improves on the last.
Dreaming — A research-preview capability where Claude reflects over thousands of sessions to produce and refine memories.
Self-hosted sandbox — Bringing your own compute/VPC for tool execution; Anthropic signals when a new sandbox must be provisioned.
MCP tunnel — A way to expose private MCP servers to Claude via a proxy layer without exposing anything over the public internet.
Multi-agent orchestration — Letting Claude spawn other agent threads with their own context windows to delegate specialized work.
Hi everybody. I hope everybody's having a good time today. I am Michael. I'm a member of technical staff here at Anthropic working on Claude Managed Agents. What's up everybody? My name is Harrison and I'm also a member of technical staff working on Claude Managed Agents. Lot of members of technical staff. Yeah.
Okay. So today we want to talk to you about Claude Managed Agents. But before we do that, we wanted to do a quick recap over the last couple of years and the exponential that I think everybody in this room has been experiencing. After that, we'll talk a little bit about the motivations behind why we built Claude Managed Agents, followed by a deep dive into some of the primitives that we offer. And then afterwards, we will bring out some of the partners that we've been working with on some of the new features that we announced today. And then we'll wrap it up with a little bit of a getting started.
So AI capabilities over the last couple of years have been on like an absolute rocket ship of an exponential. We started with the Claude 3 family of models. Even back then you were starting to see the semblance of really capable things starting to happen, but you could only really get very simple, short things going. Then with Opus 4, we went on an absolute tear, and things like Claude Code started becoming really prominent. And these days, with some of the newer model families that we have, we're seeing that the bottleneck towards increasing capabilities is really the infrastructure around these models and not so much the intelligence of them.
So with Opus 3, you could maybe have Claude generate a test function for you. You would steer it a lot throughout and you were approving every single tool. With Opus 4 and Claude Code, you were able to have it drive an entire feature. It could put up a PR for you, but you were still steering it a lot. And then with Opus 4.7, the newest model that we have, people are clearing their entire backlogs and are waking up to a bunch of merge-ready PRs, which is amazing to see. Who doesn't love waking up in the morning to a bunch of PRs that you have to review. What we think we're seeing going in the future is entire quarters' worth of work being accomplished within a couple of hours. So you can imagine a full M&A pipeline being done end-to-end with a swarm of agent teams. And when these agents work for a couple of hours, things like prompt plus tool use are okay, but really where we need to start getting going is towards task completion and overall agent infrastructure pipelines.
But in order for your agents to be able to accomplish more, they need access to more. And that's where Claude Managed Agents is here to help you manage some of the complexity. You can imagine that if you have an entire team running an M&A deal, they need access to secure credentials, internal systems. If you're making code changes, you need access to your private GitHub repositories and the credentials that allow that kind of access. And additionally, you need identity and auth for your agents. This is essentially an identifier for who they are. Like I as an engineer have access to Slack and my email and a bunch of tools internally. Our agents are going to need access to those systems as well.
But additionally, we're seeing more and more different conversational methodologies for interacting with our agents. The first is probably the most familiar, which is you send the agent text and it gives you a response conversationally. But we're seeing more of a transition towards outcome-oriented agentic activity. So give the M&A deal that needs to happen to the agent, and have them just go off and accomplish the task, coming back to you only when they feel relatively confident that the entire activity is complete. Additionally, as an agent platform, we'd be remiss to not support other methodologies, like starting an agent and then picking it up later on, maybe weeks or months in the future when you want the agent to pick back up right where it left off.
So it was very clear that we're going to start expecting a lot out of these agents, and our developers will as well. When we were doing a bunch of research as we were starting to develop Claude Managed Agents, we saw a lot of key sticking points around infrastructure and primitive development. The first was figuring out things like context management and memory. These things work really, really well if they are working, but if you get it wrong, it can completely destroy how well your agents are going to work. And infrastructure concerns was another big sticking point. It was actually the number one thing cited as preventing people from being able to skate the exponential and really benefit from these improved model intelligences. You need things like reliability, scalability, security, even latency starts mattering when you're having these things running in prod. And then finally, none of this really matters if you don't have observability into what these things are doing. If you can't tell whether or not your agent is succeeding, it doesn't really matter — how can you even assess that the thing is good?
So with Claude Managed Agents, we did all of that platform work so that you don't have to, so that you can pick and choose the primitives that we have available out of the box around infrastructure, agent primitives, and observability, all available on the Claude platform, where you can pick and choose the composable primitives and build your product on top of them.
So how do you actually get started building with Claude Managed Agents? The first step is just to define an agent. This is essentially a bundle of configuration that identifies who your agent is and what it can do. It's a system prompt, model, skills, tools, permissions, and generally the identity of the thing that's actually taking the action. Second, you need an environment in which the agent will actually run. It really helps to give Claude access to a computer. Your agent needs a sandboxing environment where you can configure the network allow list and pre-installed packages. When all that's ready to go, you can kick off the session. Ask your agent to go and complete some piece of work and then come back to you when it's ready to rock. And through it all, if you want to observe the agent as it's doing its thing, you can just listen to the event stream and understand what the agent is doing, why it's doing it, and interact with it however you see fit.
So let's demystify what we mean by this event stream. Every session you start in Claude Managed Agents is effectively a log of events where you or your end users are interacting with Claude and Claude's responding. We split up the domains of events so that it's easier to understand what each event means. The first is user events. These are things that your own end users or your platform are sending to Claude Managed Agent sessions. These could include text messages, images, documents. You can interrupt your agent if you see it's going off course and you want to steer it back onto its tracks. Tool results for custom tools that you implement and execute on your end. And even confirmations for human-in-the-loop controls for any tools executed on Anthropic servers. And then finally, outcome definitions, which we'll go into more detail about later. Next, we have agent events. Agent events are anything that Claude is doing on its side — responding to the user with a message, executing tools on its end, or coordinating with other agents, which we'll go into later. Next we have session events. These are the overall lifecycle of the session itself — descriptions around the status changing from idle to running, error recovery, and outcome processing. And then finally we have span events which make it really easy to understand when certain things are starting and ending, like Claude starting to write a really long response.
So we know that's a ton of information. So let's make it concrete by doing a quick demo of Pascal, a fictitious agent that's responsible for understanding a little bit more about grocery shopping habits of our users. If we jump into the demo, we're going to start by showing our dashboard that's integrated with Managed Agents. We're kicking off an analysis run where we've clicked this Analyze button in the top right. Jumping back to the console, we can see everything that the agent is doing in real time. We can see the list of events coming through the event stream, tool runs, agent events, understanding what's happening in real time. On the right side, you can see our agentic definition. This includes the system prompt, model, and all of the MCP tool configuration. And as we click into the environment, we can see our networking configuration as well as the packages we've installed into our container. Jumping back to our application, we can see all of this shown on our surface because all of this is exposed via an API. And Claude came back and found some bits for us. Looks like bananas are super popular. I like bananas. And if you want to avoid the crowds, it turns out that Sunday is not the right time to go shopping for groceries.
But that's not enough for us. We want to understand more about how our shoppers are going to behave in the future. So we had our agent kick off a predictive analysis and reorder probabilistic understanding of our users. But again, that's not enough. We want our agent to get even better over time. So we've clicked this Ask Claude button in the top right, where Claude is actually reading the transcript of our session and is offering inputs for how we can optimize the way we've configured it. In this case, on the right side, we'll see that a Python script ran for over 20 seconds. This is a Python script we uploaded to the session, and maybe there's a chance to optimize that runtime so things can feel a little bit snappier for our users. So in a nutshell, that's a whirlwind tour of the console and many of the features we support out of the box with Managed Agents.
So as developers, you might want to figure out how to get started. If you have Claude Code installed, which I hope many of you do — it's my favorite tool of all — feel free to just jump in and use the skill that we ship with Claude Code directly, the Claude API skill. It knows all about Managed Agents and will make getting integrated an absolute breeze. Second, we also shipped a CLI that lets you interact with your agents and your sessions seamlessly via a simple command line interface. And lastly, if you just want to see some examples of real code, copy-paste ready, we have a set of cookbooks that'll show off what it looks like to integrate with all of our API services.
So we covered a lot of the basics, but I wanted to go over some of the more advanced features we've been releasing over the last couple of weeks. The first, and probably my favorite, is multi-agent orchestration. It allows Claude to spawn other agent threads with their own context windows in order to delegate work to them. The cool aspect is that Claude can pass messages back and forth through other Claudes in order for them to do whatever specialized work they get to do. Outcomes allows you as an end user to define a rubric or a set of goals for Claude to iterate toward. After its first pass at something, it'll start triggering its outcome grading and keep going in a loop until it feels satisfied with the outputs it's given you. Memory allows Claude to get better over time by reading and writing from long-lived memory stores, which makes every session better than the last. And then finally, we have dreaming, which we announced in research preview, which allows Claude to reflect and codify over thousands of sessions all at once in order to produce new memories, edit existing ones, and make sure the memories we're dealing with are top-notch.
And earlier this morning, you heard us announce two new features that'll make your agents even more powerful. The first is self-hosted sandboxes, effectively giving you the option to bring your own compute infrastructure to Claude if you want to run tools within your own VPC. Shout out to our partners at Cloudflare, Daytona, Modal, and Vercel, who we've been working with to support this seamlessly out of the box. And second, we shipped a feature in research preview called MCP tunnels, which is basically a way for you to expose your private MCP servers directly to Claude via Managed Agents without ever having to expose anything over the public internet directly.
Diving a little deeper into how self-hosted sandboxes work: you can bring your own sandboxing infrastructure fleet where you can contain your own private files, services, and packages. You get to control how these sandboxes are provisioned without using our native Anthropic Claude sandboxes. Inside your own perimeter, you can control things like network policies, your audit logs, when these sandboxes are spawned and idled. Everything is in your control without having to cede that over to Claude Managed Agents. All we'll do is send you a signal whenever we need to have a new sandbox provisioned because Claude needs to do some work in there. And the nice aspect is that you can either use your own sandboxing fleet or use one of the partners we just mentioned.
And let's talk a little bit about MCP tunnels. MCP tunnels are basically just a way for you to get your private MCPs in your network exposed to Claude Managed Agents without having to do any fancy network configuration on your side. Essentially, all you have to do is expose a fairly basic proxy layer to our MCP tunnels, enabling your network infrastructure to speak directly with Claude via a secure tunnel in the middle.
Okay. So to get a little bit deeper about self-hosted sandboxes, I wanted to welcome to the stage Mike from Cloudflare, Yvon from Daytona, Akshat from Modal, and Luke from Vercel to talk a little bit more about this. Thanks everybody for joining us. You all run companies or work at companies that run sandboxing fleets for agents, but you've all built them slightly differently, and I'm curious what you are each betting on here.
Luke (Vercel): One of the things that's foundational to us is we build all of our infrastructure on top of the same foundation — we talk about this as fluid compute. Internally, we've called it a system of hive. That allows us to give everyone basically the full VM, whether you're running a build, a sandbox, or a function. All of these things interoperate well. We can reuse the same features between them. We just made public our firewall for sandboxes where you can filter traffic and inject secrets. We can build that for one thing and reuse it across it all. That's really powerful when you're building something like Claude Managed Agents and you can call it from a function into a sandbox and vice versa.
Akshat (Modal): Modal is a compute platform we've built for today's use cases. One of the things we're really good at is we run a lot of compute across the world. Since we have our own scheduler, we can spin up hundreds of thousands of sandboxes in order of minutes. We're betting on the fact that people need a lot of scale and want to get there quickly for use cases like RL. We run in every region, so you can get low latency if you care about it. We were designed around flexibility — persistent volumes, customizing your images. And we have GPUs, and GPU sandboxes are a pretty big growing use case for us.
Yvon (Daytona): For us, we are a company that started out building sandboxes from scratch, and we had one definite principle: agents will need what humans need. At that time, a lot of people were just doing code execution boxes, but what we understood was that agents, like humans, will need different sizes and specs — CPU, RAM, memory, different operating systems, CPUs, GPUs. The difference is you have to have that at an insane amount of speed and scale, with things like pausing, resuming, and forking so that agents can try multiple outcomes. Nothing that existed in the market could offer that from an infrastructure perspective, so we built our own schedulers to enable this.
Mike (Cloudflare): One of our big bets is actually on two different sandboxing primitives. We have the micro VM — if your agent is acting like a developer, you give it everything a developer has. You can run CLI tools, compile Rust, whatever. But we also have a different sandboxing technology called isolates, which we think in the long term, as the price of intelligence drops, we're just going to get a massive amount of agents and we're going to run out of compute. We need something that can scale even more aggressively than a micro VM. This other technology can still do sandboxing, still isolate your processes, but it spins up in milliseconds. You can still write files, execute arbitrary code, but it's much more lightweight — you're running multiple tenants in a single process. The ability to flex between these two technologies is a big part of what we're focusing on.
(Panel discussion continued on what excites each partner about Managed Agents.) Luke: Everything that was asynchronous is now synchronous and vice versa. All of the synchronization you used to spend time coding, and then take a meeting to get product alignment — agents allow me to delegate all of that asynchronous work into the background much more effectively. Everyone now has a chief of staff; that used to be an executive role. Every engineer can have one doing market research, understanding the product they're working on, how customers are using it. Akshat: There are so many use cases. We have DoorDash automating account management with agents. Personally, I'm excited about Claude optimizing inference — you give it a workload and a benchmark and it'll hill climb it, run the Nvidia profiler, read the profiles, and make things better, all running on Modal because we have GPU sandboxes. With CMA I'm excited to make this a background agent that works in Slack. Yvon: The thing stopping the progression of agents getting tasks done is infrastructure now, not the models. The term is the "human emulator" — anything a digital knowledge worker can do, you can have an agent do if you give it a sandbox. For example, an agent that can't give you an end-to-end report because data is locked in a legacy Windows application can spin up a sandbox, install the application or log into the system, and give you an end-to-end result. Mike: When we launched the Managed Agents integration, we leaned into programmability and customization. You can easily write tools that reach into the rest of Cloudflare. We have a new email service, so we wrote something that gives every agent an email address. We also have our browser rendering service, so you can run a browser with audit logs. I'm excited for the toolbox of all these things being readily available.
(On what customers are building now that they couldn't six months ago.) Yvon: Continuous learning — customers enabling their own customers to take the data they have every day, every week, every month, and do RL, so the next morning they have a more intelligent model. Akshat (on the next infrastructural need after sandboxes): Improving isolation and permission boundaries for agents — can you run Claude Agent SDK in the same sandbox as code execution but with better isolation? Longer term, there's a lot to play with around compute and persistent storage, like spawning sub-agents that fork off and can time travel back to previous states, and equipping the agent to reify its own code and update it in place. Mike (on harder problems running agents at scale): It's easy to get a vibe-coded platform where people spin up agents internally, but deploying that means facing all these security challenges — how do we properly filter egress, assign identities to agents, and propagate identity all the way down the chain when an agent creates another agent, such that it only gets access to the right data? And how do you get every service behind something that understands that identity? Luke (on assumptions breaking when the end user is an agent, not a human): Authentication is one — if I have permission to do something, should an agent have permission to do it on my behalf? Resume-ability of tasks is something everyone is still working to solve, and the very synchronous single-player activity of today's harnesses is going to give way to a multiplayer game we haven't fully understood yet, because agents, once on a track, just want to execute, whereas humans can diverge and say the plan has changed.
Okay, thank you everybody for joining me. I hope you learned some stuff and had some fun. Go try Claude Managed Agents.
TL;DR
- Anthropic members of technical staff Michael and Harrison introduce Claude Managed Agents, a platform that handles the infrastructure complexity (context/memory, reliability, security, latency, observability) that has become the real bottleneck to running capable agents in production.
- The platform exposes composable primitives — define an agent (system prompt, model, skills, tools, permissions), give it a sandboxed environment, kick off a session, and observe everything through a typed event stream of user, agent, session, and span events.
- New and advanced features were announced, including multi-agent orchestration, outcomes, memory, dreaming, self-hosted sandboxes (with Cloudflare, Daytona, Modal, Vercel), and MCP tunnels — followed by a panel where those infrastructure partners share what they are betting on.
Takeaways
- Model intelligence is no longer the main constraint; the bottleneck to letting agents "skate the exponential" is infrastructure — reliability, scalability, security, latency, and observability around the models.
- To accomplish more, agents need access to more: secure credentials, internal systems, private GitHub repos, and an identity/auth so they can use tools the way a human employee would.
- Interaction is shifting from conversational text-in/text-out toward outcome-oriented activity, where you hand the agent a task and it works autonomously, even pausing and resuming weeks or months later.
- Getting started has four steps: define an agent (a bundle of configuration and identity), give it a sandboxed environment (network allow list, pre-installed packages), kick off a session, and listen to the event stream to observe it.
- The event stream is split into user events, agent events, session events, and span events so developers can understand exactly what is happening, why, and when, all exposed via API.
- Advanced features include multi-agent orchestration (spawning agent threads with their own context windows), outcomes (a rubric Claude iterates against in a loop), memory (long-lived stores that make each session better), and dreaming (reflecting across thousands of sessions to refine memories).
- Two newly announced features: self-hosted sandboxes let you bring your own compute/VPC (via Cloudflare, Daytona, Modal, or Vercel), and MCP tunnels expose private MCP servers to Claude without exposing anything to the public internet.
- Panelists framed the emerging "human emulator" idea — give an agent a sandbox and it can do almost any digital knowledge-work task — while flagging open problems around identity propagation, egress filtering, and resume-ability of paused tasks.
Vocabulary
Claude Managed Agents — Anthropic's platform that provides managed infrastructure and composable primitives for running production agents.
Primitive — A composable building block (e.g. agent definition, sandbox, session) you pick and choose to build your product on top of.
Sandbox — An isolated environment where an agent runs code, with configurable network allow lists and pre-installed packages.
Event stream — The ordered log of events for a session, split into user, agent, session, and span events, exposed via API.
Outcome — A rubric or set of goals that Claude iterates toward, grading its own output in a loop until satisfied.
Memory — Long-lived stores Claude reads from and writes to so each session improves on the last.
Dreaming — A research-preview capability where Claude reflects over thousands of sessions to produce and refine memories.
Self-hosted sandbox — Bringing your own compute/VPC for tool execution; Anthropic signals when a new sandbox must be provisioned.
MCP tunnel — A way to expose private MCP servers to Claude via a proxy layer without exposing anything over the public internet.
Multi-agent orchestration — Letting Claude spawn other agent threads with their own context windows to delegate specialized work.
Transcript
Hi everybody. I hope everybody's having a good time today. I am Michael. I'm a member of technical staff here at Anthropic working on Claude Managed Agents. What's up everybody? My name is Harrison and I'm also a member of technical staff working on Claude Managed Agents. Lot of members of technical staff. Yeah.
Okay. So today we want to talk to you about Claude Managed Agents. But before we do that, we wanted to do a quick recap over the last couple of years and the exponential that I think everybody in this room has been experiencing. After that, we'll talk a little bit about the motivations behind why we built Claude Managed Agents, followed by a deep dive into some of the primitives that we offer. And then afterwards, we will bring out some of the partners that we've been working with on some of the new features that we announced today. And then we'll wrap it up with a little bit of a getting started.
So AI capabilities over the last couple of years have been on like an absolute rocket ship of an exponential. We started with the Claude 3 family of models. Even back then you were starting to see the semblance of really capable things starting to happen, but you could only really get very simple, short things going. Then with Opus 4, we went on an absolute tear, and things like Claude Code started becoming really prominent. And these days, with some of the newer model families that we have, we're seeing that the bottleneck towards increasing capabilities is really the infrastructure around these models and not so much the intelligence of them.
So with Opus 3, you could maybe have Claude generate a test function for you. You would steer it a lot throughout and you were approving every single tool. With Opus 4 and Claude Code, you were able to have it drive an entire feature. It could put up a PR for you, but you were still steering it a lot. And then with Opus 4.7, the newest model that we have, people are clearing their entire backlogs and are waking up to a bunch of merge-ready PRs, which is amazing to see. Who doesn't love waking up in the morning to a bunch of PRs that you have to review. What we think we're seeing going in the future is entire quarters' worth of work being accomplished within a couple of hours. So you can imagine a full M&A pipeline being done end-to-end with a swarm of agent teams. And when these agents work for a couple of hours, things like prompt plus tool use are okay, but really where we need to start getting going is towards task completion and overall agent infrastructure pipelines.
But in order for your agents to be able to accomplish more, they need access to more. And that's where Claude Managed Agents is here to help you manage some of the complexity. You can imagine that if you have an entire team running an M&A deal, they need access to secure credentials, internal systems. If you're making code changes, you need access to your private GitHub repositories and the credentials that allow that kind of access. And additionally, you need identity and auth for your agents. This is essentially an identifier for who they are. Like I as an engineer have access to Slack and my email and a bunch of tools internally. Our agents are going to need access to those systems as well.
But additionally, we're seeing more and more different conversational methodologies for interacting with our agents. The first is probably the most familiar, which is you send the agent text and it gives you a response conversationally. But we're seeing more of a transition towards outcome-oriented agentic activity. So give the M&A deal that needs to happen to the agent, and have them just go off and accomplish the task, coming back to you only when they feel relatively confident that the entire activity is complete. Additionally, as an agent platform, we'd be remiss to not support other methodologies, like starting an agent and then picking it up later on, maybe weeks or months in the future when you want the agent to pick back up right where it left off.
So it was very clear that we're going to start expecting a lot out of these agents, and our developers will as well. When we were doing a bunch of research as we were starting to develop Claude Managed Agents, we saw a lot of key sticking points around infrastructure and primitive development. The first was figuring out things like context management and memory. These things work really, really well if they are working, but if you get it wrong, it can completely destroy how well your agents are going to work. And infrastructure concerns was another big sticking point. It was actually the number one thing cited as preventing people from being able to skate the exponential and really benefit from these improved model intelligences. You need things like reliability, scalability, security, even latency starts mattering when you're having these things running in prod. And then finally, none of this really matters if you don't have observability into what these things are doing. If you can't tell whether or not your agent is succeeding, it doesn't really matter — how can you even assess that the thing is good?
So with Claude Managed Agents, we did all of that platform work so that you don't have to, so that you can pick and choose the primitives that we have available out of the box around infrastructure, agent primitives, and observability, all available on the Claude platform, where you can pick and choose the composable primitives and build your product on top of them.
So how do you actually get started building with Claude Managed Agents? The first step is just to define an agent. This is essentially a bundle of configuration that identifies who your agent is and what it can do. It's a system prompt, model, skills, tools, permissions, and generally the identity of the thing that's actually taking the action. Second, you need an environment in which the agent will actually run. It really helps to give Claude access to a computer. Your agent needs a sandboxing environment where you can configure the network allow list and pre-installed packages. When all that's ready to go, you can kick off the session. Ask your agent to go and complete some piece of work and then come back to you when it's ready to rock. And through it all, if you want to observe the agent as it's doing its thing, you can just listen to the event stream and understand what the agent is doing, why it's doing it, and interact with it however you see fit.
So let's demystify what we mean by this event stream. Every session you start in Claude Managed Agents is effectively a log of events where you or your end users are interacting with Claude and Claude's responding. We split up the domains of events so that it's easier to understand what each event means. The first is user events. These are things that your own end users or your platform are sending to Claude Managed Agent sessions. These could include text messages, images, documents. You can interrupt your agent if you see it's going off course and you want to steer it back onto its tracks. Tool results for custom tools that you implement and execute on your end. And even confirmations for human-in-the-loop controls for any tools executed on Anthropic servers. And then finally, outcome definitions, which we'll go into more detail about later. Next, we have agent events. Agent events are anything that Claude is doing on its side — responding to the user with a message, executing tools on its end, or coordinating with other agents, which we'll go into later. Next we have session events. These are the overall lifecycle of the session itself — descriptions around the status changing from idle to running, error recovery, and outcome processing. And then finally we have span events which make it really easy to understand when certain things are starting and ending, like Claude starting to write a really long response.
So we know that's a ton of information. So let's make it concrete by doing a quick demo of Pascal, a fictitious agent that's responsible for understanding a little bit more about grocery shopping habits of our users. If we jump into the demo, we're going to start by showing our dashboard that's integrated with Managed Agents. We're kicking off an analysis run where we've clicked this Analyze button in the top right. Jumping back to the console, we can see everything that the agent is doing in real time. We can see the list of events coming through the event stream, tool runs, agent events, understanding what's happening in real time. On the right side, you can see our agentic definition. This includes the system prompt, model, and all of the MCP tool configuration. And as we click into the environment, we can see our networking configuration as well as the packages we've installed into our container. Jumping back to our application, we can see all of this shown on our surface because all of this is exposed via an API. And Claude came back and found some bits for us. Looks like bananas are super popular. I like bananas. And if you want to avoid the crowds, it turns out that Sunday is not the right time to go shopping for groceries.
But that's not enough for us. We want to understand more about how our shoppers are going to behave in the future. So we had our agent kick off a predictive analysis and reorder probabilistic understanding of our users. But again, that's not enough. We want our agent to get even better over time. So we've clicked this Ask Claude button in the top right, where Claude is actually reading the transcript of our session and is offering inputs for how we can optimize the way we've configured it. In this case, on the right side, we'll see that a Python script ran for over 20 seconds. This is a Python script we uploaded to the session, and maybe there's a chance to optimize that runtime so things can feel a little bit snappier for our users. So in a nutshell, that's a whirlwind tour of the console and many of the features we support out of the box with Managed Agents.
So as developers, you might want to figure out how to get started. If you have Claude Code installed, which I hope many of you do — it's my favorite tool of all — feel free to just jump in and use the skill that we ship with Claude Code directly, the Claude API skill. It knows all about Managed Agents and will make getting integrated an absolute breeze. Second, we also shipped a CLI that lets you interact with your agents and your sessions seamlessly via a simple command line interface. And lastly, if you just want to see some examples of real code, copy-paste ready, we have a set of cookbooks that'll show off what it looks like to integrate with all of our API services.
So we covered a lot of the basics, but I wanted to go over some of the more advanced features we've been releasing over the last couple of weeks. The first, and probably my favorite, is multi-agent orchestration. It allows Claude to spawn other agent threads with their own context windows in order to delegate work to them. The cool aspect is that Claude can pass messages back and forth through other Claudes in order for them to do whatever specialized work they get to do. Outcomes allows you as an end user to define a rubric or a set of goals for Claude to iterate toward. After its first pass at something, it'll start triggering its outcome grading and keep going in a loop until it feels satisfied with the outputs it's given you. Memory allows Claude to get better over time by reading and writing from long-lived memory stores, which makes every session better than the last. And then finally, we have dreaming, which we announced in research preview, which allows Claude to reflect and codify over thousands of sessions all at once in order to produce new memories, edit existing ones, and make sure the memories we're dealing with are top-notch.
And earlier this morning, you heard us announce two new features that'll make your agents even more powerful. The first is self-hosted sandboxes, effectively giving you the option to bring your own compute infrastructure to Claude if you want to run tools within your own VPC. Shout out to our partners at Cloudflare, Daytona, Modal, and Vercel, who we've been working with to support this seamlessly out of the box. And second, we shipped a feature in research preview called MCP tunnels, which is basically a way for you to expose your private MCP servers directly to Claude via Managed Agents without ever having to expose anything over the public internet directly.
Diving a little deeper into how self-hosted sandboxes work: you can bring your own sandboxing infrastructure fleet where you can contain your own private files, services, and packages. You get to control how these sandboxes are provisioned without using our native Anthropic Claude sandboxes. Inside your own perimeter, you can control things like network policies, your audit logs, when these sandboxes are spawned and idled. Everything is in your control without having to cede that over to Claude Managed Agents. All we'll do is send you a signal whenever we need to have a new sandbox provisioned because Claude needs to do some work in there. And the nice aspect is that you can either use your own sandboxing fleet or use one of the partners we just mentioned.
And let's talk a little bit about MCP tunnels. MCP tunnels are basically just a way for you to get your private MCPs in your network exposed to Claude Managed Agents without having to do any fancy network configuration on your side. Essentially, all you have to do is expose a fairly basic proxy layer to our MCP tunnels, enabling your network infrastructure to speak directly with Claude via a secure tunnel in the middle.
Okay. So to get a little bit deeper about self-hosted sandboxes, I wanted to welcome to the stage Mike from Cloudflare, Yvon from Daytona, Akshat from Modal, and Luke from Vercel to talk a little bit more about this. Thanks everybody for joining us. You all run companies or work at companies that run sandboxing fleets for agents, but you've all built them slightly differently, and I'm curious what you are each betting on here.
Luke (Vercel): One of the things that's foundational to us is we build all of our infrastructure on top of the same foundation — we talk about this as fluid compute. Internally, we've called it a system of hive. That allows us to give everyone basically the full VM, whether you're running a build, a sandbox, or a function. All of these things interoperate well. We can reuse the same features between them. We just made public our firewall for sandboxes where you can filter traffic and inject secrets. We can build that for one thing and reuse it across it all. That's really powerful when you're building something like Claude Managed Agents and you can call it from a function into a sandbox and vice versa.
Akshat (Modal): Modal is a compute platform we've built for today's use cases. One of the things we're really good at is we run a lot of compute across the world. Since we have our own scheduler, we can spin up hundreds of thousands of sandboxes in order of minutes. We're betting on the fact that people need a lot of scale and want to get there quickly for use cases like RL. We run in every region, so you can get low latency if you care about it. We were designed around flexibility — persistent volumes, customizing your images. And we have GPUs, and GPU sandboxes are a pretty big growing use case for us.
Yvon (Daytona): For us, we are a company that started out building sandboxes from scratch, and we had one definite principle: agents will need what humans need. At that time, a lot of people were just doing code execution boxes, but what we understood was that agents, like humans, will need different sizes and specs — CPU, RAM, memory, different operating systems, CPUs, GPUs. The difference is you have to have that at an insane amount of speed and scale, with things like pausing, resuming, and forking so that agents can try multiple outcomes. Nothing that existed in the market could offer that from an infrastructure perspective, so we built our own schedulers to enable this.
Mike (Cloudflare): One of our big bets is actually on two different sandboxing primitives. We have the micro VM — if your agent is acting like a developer, you give it everything a developer has. You can run CLI tools, compile Rust, whatever. But we also have a different sandboxing technology called isolates, which we think in the long term, as the price of intelligence drops, we're just going to get a massive amount of agents and we're going to run out of compute. We need something that can scale even more aggressively than a micro VM. This other technology can still do sandboxing, still isolate your processes, but it spins up in milliseconds. You can still write files, execute arbitrary code, but it's much more lightweight — you're running multiple tenants in a single process. The ability to flex between these two technologies is a big part of what we're focusing on.
(Panel discussion continued on what excites each partner about Managed Agents.) Luke: Everything that was asynchronous is now synchronous and vice versa. All of the synchronization you used to spend time coding, and then take a meeting to get product alignment — agents allow me to delegate all of that asynchronous work into the background much more effectively. Everyone now has a chief of staff; that used to be an executive role. Every engineer can have one doing market research, understanding the product they're working on, how customers are using it. Akshat: There are so many use cases. We have DoorDash automating account management with agents. Personally, I'm excited about Claude optimizing inference — you give it a workload and a benchmark and it'll hill climb it, run the Nvidia profiler, read the profiles, and make things better, all running on Modal because we have GPU sandboxes. With CMA I'm excited to make this a background agent that works in Slack. Yvon: The thing stopping the progression of agents getting tasks done is infrastructure now, not the models. The term is the "human emulator" — anything a digital knowledge worker can do, you can have an agent do if you give it a sandbox. For example, an agent that can't give you an end-to-end report because data is locked in a legacy Windows application can spin up a sandbox, install the application or log into the system, and give you an end-to-end result. Mike: When we launched the Managed Agents integration, we leaned into programmability and customization. You can easily write tools that reach into the rest of Cloudflare. We have a new email service, so we wrote something that gives every agent an email address. We also have our browser rendering service, so you can run a browser with audit logs. I'm excited for the toolbox of all these things being readily available.
(On what customers are building now that they couldn't six months ago.) Yvon: Continuous learning — customers enabling their own customers to take the data they have every day, every week, every month, and do RL, so the next morning they have a more intelligent model. Akshat (on the next infrastructural need after sandboxes): Improving isolation and permission boundaries for agents — can you run Claude Agent SDK in the same sandbox as code execution but with better isolation? Longer term, there's a lot to play with around compute and persistent storage, like spawning sub-agents that fork off and can time travel back to previous states, and equipping the agent to reify its own code and update it in place. Mike (on harder problems running agents at scale): It's easy to get a vibe-coded platform where people spin up agents internally, but deploying that means facing all these security challenges — how do we properly filter egress, assign identities to agents, and propagate identity all the way down the chain when an agent creates another agent, such that it only gets access to the right data? And how do you get every service behind something that understands that identity? Luke (on assumptions breaking when the end user is an agent, not a human): Authentication is one — if I have permission to do something, should an agent have permission to do it on my behalf? Resume-ability of tasks is something everyone is still working to solve, and the very synchronous single-player activity of today's harnesses is going to give way to a multiplayer game we haven't fully understood yet, because agents, once on a track, just want to execute, whereas humans can diverge and say the plan has changed.
Okay, thank you everybody for joining me. I hope you learned some stuff and had some fun. Go try Claude Managed Agents.