Two New Improvements to Claude Managed Agents Solve Enterprise Security Challenges

When enterprises want to connect AI to their internal private networks, models stopped being the bottleneck a long time ago. What’s holding most teams back today is authentication.

In the vast majority of production environments, AI Agents need to carry around authentication tokens whenever they make tool calls. This creates massive risk — it’s like handing your house keys to a robot that could malfunction or get compromised at any time. If the Agent gets hacked or starts acting in unexpected ways, those credentials fall into the wrong hands. This is exactly why so many enterprises have hesitated to fully connect their internal APIs and databases to AI Agents.

Anthropic just rolled out two new solutions for Claude Managed Agents to fix this problem: self-hosted sandboxes and MCP tunnels.

Both features are built around the same core philosophy: keep credential control at your network boundary, and never let the Agent touch sensitive authentication data at all.

Self-Hosted Sandboxes Keep Tool Execution Within Your Infrastructure

With self-hosted sandboxes, engineering teams can contain the entire tool execution process within their own organization’s infrastructure. While the core Agent orchestration — including cycle control, context management, and error recovery — still runs on Anthropic’s cloud, all actual tool calls are executed on the enterprise’s own systems. This means the Agent never needs to hold onto access keys to get work done.

According to Anthropic’s official documentation, this split architecture works seamlessly with the security and compliance tools enterprises already have in place, so you don’t need to rebuild your entire security stack from scratch. Teams can keep monitoring tool calls and auditing access logs using the workflows they already know, and sensitive files and code never leave your organization’s network boundary. You also get full control over your compute resources: you can customize resource sizes and runtime environments, so you can allocate just the right amount of CPU and memory for heavy workloads like long-running builds or image generation.

Sandboxes can run directly on your own infrastructure, or you can use one of Anthropic’s pre-integrated managed providers:

• Cloudflare: Uses micro-VMs and lightweight isolation to run sandboxes at massive scale. All outbound requests are controlled by the enterprise, supports zero-trust key injection, and can connect to internal services through the Cloudflare network. Amplitude already uses it to build their internal design Agent.
• Daytona: A composable compute environment with persistent long-term state that handles both short and long-running tasks. You can access sessions via SSH mid-run, and pause sessions to save their full state to resume later. Clay uses Daytona to run their GTM workflow automation Agent.
• Modal: Built specifically for AI workloads. Sandboxes integrate seamlessly with Modal’s functions, storage, and networking components, custom containers spin up in under a second, and you can scale to hundreds of thousands of concurrent sandboxes with on-demand CPU and GPU allocation.
• Vercel: Rogo already uses Vercel sandboxes for their financial analysis Agents, where handling proprietary data securely is a top priority.

MCP Tunnels Create a Secure, One-Way Connection to Internal Resources

MCP (Model Context Protocol) tunnels follow the same core principle. They create a lightweight outbound tunnel from inside your enterprise network to connect to your private MCP servers, and credentials never pass through the Agent’s context at all. This lets you turn internal databases, private APIs, knowledge bases, and ticketing systems into callable tools for your Agents.

The entire connection is initiated from inside your corporate network, so you don’t need to configure inbound firewall rules or expose any public endpoints. All traffic is end-to-end encrypted end-to-end. Only your organization’s admins can manage MCP tunnel configurations in the Claude Console, making permission management far clearer and more secure.

OpenAI has been working on similar functionality, adding local execution to their Agents SDK back in April. But Anthropic’s architecture takes the split much further: it completely separates the Agent’s “brain” (the control layer) from its “hands and feet” (the execution layer). This design is quite different from existing sandbox approaches, including OpenAI’s.

A Security Upgrade That Also Makes Workflows More Reliable

This isn’t just a security win for orchestration teams — it also makes Agent workflows more stable and easier to manage.

By separating where tools execute (handled by self-hosted sandboxes) from how they connect to your internal network (handled by MCP tunnels), enterprises get far more granular control over their Agent workflows. Different tools can run in different environments with separate permission controls, so issues stay contained and never impact your entire system.

Right now, self-hosted sandboxes are available in open public beta, while MCP tunnels are still in research preview and require an access request to try. If you’re already using Claude today, the public self-hosted sandbox beta is the perfect place to start: move your tool execution back to your own infrastructure first, and test out your new security boundaries.

Learn more about self-hosted sandboxes here: https://platform.claude.com/docs/en/managed-agents/self-hosted-sandboxes