Anthropic Managed Agents: Decoupling Claude's Brain from Its Hands

TL;DR

Anthropic introduced Managed Agents, a hosted platform that decouples Claude’s reasoning component (the “brain”) from its execution environments (the “hands”) and from the durable session log. This architectural shift improves reliability, scalability, and security for long‑running AI agents.

Why Decoupling Matters

Separating the brain, hands, and session into independent, interchangeable components eliminates the “pet” container model that caused single points of failure, debugging dead‑ends, and unnecessary latency. Each component can be replaced or scaled without affecting the others, allowing Claude to run longer, more complex tasks across diverse infrastructures.

Core Architectural Abstractions

Session – Durable Append‑Only Log

  • Purpose: Stores every event of an agent’s execution outside Claude’s context window.
  • Interface: getEvents() returns positional slices of the log; emitEvent(id, event) appends new entries.
  • Benefit: Provides a recoverable context object that survives crashes and can be queried flexibly by the brain.

Harness – Orchestration Loop

  • Purpose: Calls Claude, routes tool invocations, and interacts with the session.
  • Interface: execute(name, input) → string for invoking any hand; wake(sessionId) to restart after failure.
  • Benefit: Runs as a stateless service (“cattle”), so crashes are harmless and can be instantly replaced.

Sandbox – Execution Environment

  • Purpose: Executes code, edits files, and interacts with external resources.
  • Interface: Treated as a generic tool via execute(name, input) → string.
  • Benefit: Can be a container, a VPC‑bound service, or any custom runtime, without exposing credentials to Claude.

Solving the “Pet vs. Cattle” Problem

Initially, all components lived in a single container, making the container a pet – a unique, irreplaceable instance. Failure of that container meant loss of the session and required manual debugging through a WebSocket stream.

By moving the harness and session out of the container, they become cattle – interchangeable services that can be recreated on demand. When a sandbox dies, the harness reports a tool‑call error, and Claude can retry with a freshly provisioned container via provision({resources}).

Security Improvements

  • Credential Isolation: Tokens never reside inside the sandbox where Claude‑generated code runs.
  • Pattern: Tokens are either baked into the resource during sandbox initialization (e.g., Git clone) or stored in a secure vault accessed by a proxy (MCP) that the harness calls.
  • Result: Prompt‑injection attacks cannot steal credentials, and the sandbox cannot directly access privileged tokens.

Managing Context Beyond Claude’s Window

Long‑running tasks exceed Claude’s context limit. Prior approaches (compaction, memory tools, trimming) made irreversible decisions about what to retain. Managed Agents treat the session log as an external context object:

  • The brain can read any slice of the log via getEvents().
  • The harness may transform events before feeding them to Claude, enabling custom context engineering without hard‑coding assumptions.
  • This separation keeps context durable and queryable while allowing future models to implement new context‑management strategies.

Scaling to Many Brains and Hands

Many Brains

  • Decoupling eliminates the need to provision a container for each brain before inference begins.
  • Time‑to‑first‑token (TTFT) improved dramatically: p50 reduced by ~60 % and p95 by >90 % because inference can start as soon as pending events are read from the session log.

Many Hands

  • Each hand is a generic tool (execute(name, input) → string), allowing Claude to interact with containers, VPC resources, phones, or even emulators.
  • Hands are independent of the brain, so a brain can hand off work to another brain or invoke multiple hands concurrently.

Practical Implications for Users

  • Reliability: Failures in any component are isolated; sessions persist, and harnesses can restart automatically.
  • Performance: Reduced TTFT and the ability to provision sandboxes only when needed lower latency and cost.
  • Flexibility: Users can connect Claude to private networks, custom tools, or proprietary infrastructure without network peering or exposing credentials.
  • Future‑Proofing: The meta‑harness design anticipates new harnesses, sandboxes, and scaling patterns, ensuring the platform remains usable as Claude models evolve.

Conclusion

Anthropic’s Managed Agents apply a decades‑old operating‑system principle—virtualizing hardware via stable abstractions—to modern AI agents. By defining clear, interchangeable interfaces for the session, harness, and sandbox, Managed Agents provide a robust, secure, and scalable foundation for long‑running Claude‑driven workflows, while remaining agnostic to the specific implementations that future models may require.

Sources