Anthropic Requires Safety Patches Within One Business Day

Self-hosted Claude Managed Agents lets you keep agent sessions, transcripts and credentials in your own cloud or data centre, and route model calls through Bedrock, Google Cloud or Foundry instead of Anthropic. The cost is an on-call commitment: the server licence requires you to install Anthropic's safety updates within one business day and roll back a flagged version within 8 hours, and every prompt still leaves your network for inference.

Anthropic opened the option as a private beta on November 12, with access through your Anthropic account team. There is no published price, no general availability date and no stated eligibility rule. If your security team ruled out hosted Managed Agents over transcript custody or data residency, this changes the answer. It also hands your platform team a server, a database and a set of contractual deadlines that the hosted product never asked you to staff.

What Self-Hosted Claude Managed Agents Actually Runs on Your Infrastructure

Self-hosted Managed Agents moves the whole agent service into your network; only the model stays outside. Anthropic's documentation splits Managed Agents into two parts you can host. Sandboxes are the containers or VMs where an agent's tools run commands and touch files. The service is the API, the agent loop, and the storage for agents, sessions and session history.

Until this week you could host only the first part. Anthropic launched self-hosted sandboxes in public beta on May 19, but the agent loop, which handles "orchestration, context management, and error recovery," stayed on Anthropic's infrastructure. The new option puts both on your side. A deployment is:

• cma-server, which serves the API, runs the agent loop and stores every session's history. It never runs shell or file tools itself.
• PostgreSQL 16 or later. Without a database the server keeps everything in memory, and a restart erases it.
• Workers, which poll the server and run the agent's shell and file tools inside your sandboxes.
• A console at the server's address, where people sign in through your own identity provider.

The developer APIs are the same as the hosted service, so the SDK and the ant CLI point at your server unchanged. Help Net Security put the operational consequence plainly: the customer now owns the server, the database and the firewall rules, and has to keep them patched and configured.

What Still Leaves Your Network

Every model call still sends the full conversation to whichever inference provider you configure. Anthropic's data and access page says each call carries "the conversation so far, including prompts, tool inputs, and tool results." Claude does not run inside your perimeter. What you gain is the choice of where that traffic lands: the Claude API by default, or Amazon Bedrock, Claude Models on Google Cloud (Google managed), Microsoft Foundry, or your own model gateway.

The provider choice also decides what Anthropic can see about your usage. When the Claude API serves the model, each call carries up to three headers with your server's session, agent and environment IDs. The IDs hold no names or content, but they encode when your server created them, and Anthropic says "no setting turns them off." Calls also carry a User-Agent naming the server software and a metadata.user_id label of cma-server, which Anthropic uses to count self-hosted usage. Under Bedrock and Google-managed Vertex, the server never sends the headers or the label. The server also pings the Claude API every 60 seconds to check its credential when Anthropic is the provider; those checks run no inference.

Anthropic has no remote access to the server or its logs, and it issues none of the credentials the server accepts. Logs go to standard error and traces go only where your OpenTelemetry variables point.

One default deserves a line in your security review. Under the Anthropic provider, the server requests the Claude API's server-side fallback: when a safety classifier declines a request, another Claude model, "possibly a less capable one," can answer instead, and no event reports the switch. Set inference.model_fallback: false if your evals assume a fixed model.

---

The Licence Terms Your Platform Team Has to Staff

The licence is royalty-free, and its operating obligations are tighter than most enterprise software agreements. The Software License Agreement: Claude Managed Agents Server grants the binary at no charge (§2.1); model usage stays under your separate Anthropic agreement (§2.4). The obligations that matter to an operations team:

Clause	What it requires
§5.2 Safety Updates	Deploy each one "within 1 business day after Anthropic delivers it"
§5.3 Rollback	Disable a feature or roll back a version "within 8 hours after the notice" of a safety, security or misuse risk
§5.4 Other updates	Commercially reasonable efforts to deploy within 30 days
§5.5 Withdrawal	Stop using a withdrawn version within 30 days of notice
§5.7 Incidents	Notify Anthropic within 48 hours of confirming one
§5.8 Custom safeguards	Run the safeguards Anthropic specifies; no disabling without written consent
§5.9 Usage signals	"Licensee will not remove, block, alter, or falsify Usage Signals"
§7.5 Code access	Report unauthorized access to the licensed code within 72 hours
§8.2 Liability	Anthropic's total liability capped at US$100,000
§9.2 Termination	Either side may terminate for convenience on 90 days' notice

Read §5.1 alongside that table: "Anthropic has no obligation to support any version of the Licensed Code." You must patch on Anthropic's clock, and Anthropic owes you no support window. Under §5.6, Anthropic may also decide that some customers can reach certain models "only through Anthropic's hosted service," so a model you plan around may not be available to your deployment.

The 8-hour rollback is the clause to test. Most change-advisory processes cannot move a production release in 8 hours, overnight or on a weekend. If yours cannot, you need a pre-approved emergency change path for this one system before you sign. The clock starts at Anthropic's written notice.

The §5.9 ban on blocking usage signals is narrower in practice than it reads. The documented signals are the headers and labels above, and they only travel on Claude API, Foundry and compatible-gateway calls. A proxy that strips them would breach the licence; routing through Bedrock means they are never generated.

Why Regulated Teams Will Want It Anyway

Self-hosting is the only way to run Managed Agents under zero data retention. Anthropic's API and data retention page lists Managed Agents as "Not eligible for ZDR, except for self-hosted Managed Agents," and not eligible for HIPAA either. The reason is that the hosted service stores session transcripts until you delete them. Self-hosted, you store them, and your ZDR arrangement covers the model calls the same way it covers other Messages API traffic. For more on where retention exceptions hide, see our breakdown of zero data retention across the major LLM APIs.

The other draw is procurement. If your Claude spend already runs through Amazon Bedrock or Microsoft Foundry, self-hosting lets agent model calls bill through that provider. On Bedrock, Anthropic's retention page names the cloud provider, not Anthropic, as the data processor; on Foundry, Anthropic remains the processor. That is a real difference from Mistral Studio's self-hosted agents, which still send state and traces to Mistral.

The strongest argument against is cost you cannot yet see. The hosted product bills tokens plus $0.08 per session-hour of runtime; for the self-hosted version, the same page says to contact your account team. You will be comparing a known meter against an unknown licence price plus your own Postgres, compute and on-call rota. Our comparison of AgentCore, Agent Engine and Foundry Agent Service pricing is a useful baseline for what managed runtime should cost.

What You Lose by Leaving the Hosted Service

The self-hosted server drops several hosted features, and nothing migrates across. Anthropic's differences page says "Nothing is copied from the hosted service, session history included," so agents, skills, vault credentials and memory stores have to be recreated. The gaps that will hit existing workloads:

• No cloud environments; every environment needs your own workers.
• No Files API or file session resources. Files go in the worker's directory, and images or PDFs must be sent as base64. An image sent by URL is accepted and silently never reaches the model.
• No mcp_oauth credentials, because the server has no token refresh flow. You store static bearer tokens and rotate them yourself.
• No prebuilt docx, pdf, pptx or xlsx skills, no scheduled deployments, no dreams and no webhooks.
• Multiagent orchestration only in coordinator mode, with up to 20 listed subagents. An advisor setting returns an error, and agent-defined subagents are not available.

Several defaults are safer than the hosted ones, and they will break agents that worked yesterday. The MCP host allowlist is empty, matches exact hostnames only, and the server refuses to save an agent that names an unlisted host. Web search and fetch are off until you enable them. Git access needs an allowlist of hosts and push branches, but the server does not refuse force pushes, and its log reports ok even for a push your Git host rejected.

Two security notes belong in the design review. The agent's bash tool is "a real shell with the worker process's permissions and network access," and the worker does not isolate it; the container or VM you run it in is the boundary. And each deployment serves one tenant at one trust level: the server API key reaches every environment, so trusted and untrusted workloads need separate deployments, each with its own database. If you are still choosing a sandbox layer, our comparison of E2B, Modal and Daytona covers isolation and idle billing.

---

What to Do Before You Ask for the Beta

This Week:

1. Get your security lead and platform owner to read §5 and §9 of the licence together, and write down who would execute an 8-hour rollback at 2 a.m. on a Saturday. If nobody can, stop there.
2. Decide your inference provider first. If Anthropic seeing session-level usage IDs is a problem, Bedrock or Google-managed Vertex removes them; if you need web_fetch, only the Anthropic and Foundry providers offer it.
3. Ask your account team three questions in writing: the licence price, the eligibility criteria for the beta, and which models §5.6 might restrict to the hosted service for your organisation.

This Month:

1. Inventory your hosted Managed Agents workloads against the differences list. Flag anything using webhooks, scheduled deployments, file resources, mcp_oauth or the advisor.
2. Draft the deployment topology: one deployment per trust level, PostgreSQL 16+ with backups (deleting a session through the API does not reach backups), and a sandbox per session with the environment key kept out of it.
3. Pre-approve an emergency change path for this server with your change advisory board so the 1-business-day safety update is routine.

Before Production:

1. Set inference.model_fallback: false if you run on the Anthropic provider and your evals assume one model.
2. Put force-push protection on every branch in allowed_push_refs, and check pushes on the Git host, since the server log says ok either way.
3. Add the 48-hour incident notice and the 72-hour code-access notice to your incident runbook.

The Bottom Line

The pattern is familiar from the move to private-cloud Kubernetes distributions a decade ago: the vendor lets you hold the data, and in exchange you run its release train on its schedule. Anthropic has written that schedule into the contract more tightly than most, with a 1-business-day patch window, an 8-hour rollback and a $100,000 liability cap. For a bank or a hospital that could not put agent transcripts on someone else's servers, that is a workable trade. For everyone else, self-hosted sandboxes keep tool execution in your network without the server, the database or the rollback clock.

Price the on-call rota before you ask your account team for the download.

Continue Reading

• Mistral Studio Self-Hosted Agents Send State and Traces to Mistral
• Use Bedrock's None Mode to Enforce Zero Data Retention
• Google Agent Runtime's $510 Meter Beats AgentCore's $846
• E2B vs Modal vs Daytona: Idle Time Sets Sandbox Bills
• LLM Data Residency: Which Providers Actually Keep Data In Region
• Microsoft Starts Billing for Copilot Harness on December 1
• Claude Managed Agents: Why Anthropic Runs Your AI Infrastructure