What Are Claude Managed Agents? Anthropic's Fully Managed Cloud

Running an agent in production means standing up the agent loop, tool execution, a sandbox, and state persistence—all yourself. Claude Managed Agents takes that whole burden off your hands: Anthropic runs it for you. Launched as a public beta on April 8, 2026, it's a suite of composable APIs for building and deploying cloud-hosted agents at scale.

This article covers, based on official information, what Managed Agents is, how it differs from the self-hosted Agent SDK, persistent memory and "dreaming," outcomes-based grading and multi-agent, and pricing. The key points up front. ① Instead of "building your own agent loop," you get a fully managed environment where Claude can read files, run commands, browse the web, and execute code securely. ② It has workspace-scoped persistent memory (mounted at /mnt/memory), which a "dream" can reorganize and consolidate. ③ Pricing is tokens + $0.08 per session-hour.

1. What are Managed Agents?

In Anthropic's words, Managed Agents is "a suite of composable APIs for building and deploying cloud-hosted agents at scale," and the docs describe it as a "pre-built, configurable agent harness that runs in managed infrastructure." The core: "Instead of building your own agent loop, tool execution, and runtime, you get a fully managed environment where Claude can read files, run commands, browse the web, and execute code securely." Prompt caching, context compaction, sandboxing, and state persistence are built in from the start.

It's organized around four concepts—Agent (the definition) / Environment (where it runs) / Session / Events. The Environment can be an Anthropic-managed cloud sandbox or a self-hosted sandbox on your own infrastructure.

You can attach Anthropic's prebuilt skills (pptx, xlsx, docx, pdf) and skills you build and upload yourself to an agent (up to 500 per session). For tools, besides the built-in toolset and MCP servers, you can also define "custom tools" that your own code executes.

"Harness" here means everything in an agent other than the model — the loop, tools, memory, safety controls and so on. The idea itself is covered in What is Harness Engineering?

2. vs the Agent SDK (self-hosted vs managed)

The easy thing to conflate is the difference from the Claude Agent SDK. The two are a pair along the axis of "you run it" vs "Anthropic runs it."

In short: "want to build your own engine? Agent SDK. Want to rent the engine and focus on the content? Managed Agents." They aren't competitors—they're a choice about how much of the operations you hold yourself. For the concept of agents, see what is multi-agent; for building one, how to build a multi-agent system.

3. Persistent memory and "dreaming"

A signature feature of Managed Agents is persistent memory (a memory store). It's "a workspace-scoped collection of text documents," mounted as a directory (/mnt/memory/) inside the session's sandbox. The agent reads and writes it with normal file operations, and the contents persist across sessions. Every change creates an immutable memory version for auditing. Past versions are kept for 30 days after they are written, but the recent versions of a live memory are always kept regardless of age (so a memory that rarely changes can keep history older than 30 days). To keep history longer than that, export it through the API. Limits: 100 kB per memory, 10,000 memories per store, 8 stores per session.

A note for developers: the memory store APIs use their own beta header, agent-memory-2026-07-22. Sending it together with managed-agents-2026-04-01 returns a 400 error (attaching a memory store to a session still uses the usual header). In a self-hosted sandbox, memory is not a live mount; the worker process keeps a copy and syncs it (memory documentation).

More unusual is "dreaming." Per the official description: "A dream reads an existing memory store alongside past session transcripts, then produces a new, reorganized memory store: duplicates merged, stale or contradicted entries replaced with the latest value, and new insights surfaced." It's an async job (1–100 input sessions, with optional instructions) that requires its own beta header, dreaming-2026-04-21 (managed-agents-2026-04-01 alone does not unlock the dream endpoints).

You pick the model that runs a dream when you create it. The dreams documentation lists nine supported models during the research preview: Claude Opus 5.5, Claude Fable 5.1, Claude Opus 5, Claude Fable 5, Claude Opus 4.8, Claude Opus 4.7, Claude Sonnet 5.5, Claude Sonnet 5, Claude Sonnet 4.6 (checked October 12, 2026). Haiku models are not on the list, so they cannot run a dream. A dream is billed at the standard token rates of the model you choose.

4. Outcomes grading and multi-agent

A newer feature is outcomes-based grading. Per Anthropic: "You write a rubric describing what success looks like and the agent works toward it. A separate grader evaluates the output against your criteria in its own context window." Anthropic reports it "improved task success by up to 10 points over a standard prompting loop" (+8.4% for docx, +10.1% for pptx). These are Anthropic's own measurements—the announcement calls them "our internal benchmarks"—not third-party results. Public beta.

Multi-agent orchestration is also built in: "A lead agent breaks the job into pieces and delegates each one to a specialist with its own model, prompt, and tools," running in parallel on a shared filesystem. The design philosophy of orchestrating agents echoes how to build a multi-agent system.

There are now three ways to hand off work (multi-agent documentation). ① Delegating to subagents (one level of delegation only, up to 25 concurrent child threads). ② Dynamic workflows: the agent itself writes a program that runs multiple agents and combines their results, and the server executes it (up to 1,000 agents per run, and 10 concurrent runs per session by default). ③ Advisor: the agent keeps doing the work itself but asks a more capable model for advice at moments such as planning or a final check (the advice is billed at that model's rates). Every option bills tokens for every agent that runs, so Anthropic recommends setting a spending limit on the session.

5. What has been added since launch

Since the April 8, 2026 launch, Managed Agents has gained features every few weeks. Dates are from Anthropic's announcement posts (the October 2026 items are from the Claude Platform release notes).

• April 23, 2026 — Memory: memory stores launched in public beta.
• May 19, 2026 — Outcomes, multiagent orchestration, webhooks, dreaming: the first three in public beta, dreaming as a research preview. You can be notified by webhook when work is done.
• May 19, 2026 — Self-hosted sandboxes and MCP tunnels: tool execution alone can move to your own infrastructure (or a sandbox provider such as Cloudflare, Daytona, Modal or Vercel), while the loop, context management and error recovery stay with Anthropic. MCP tunnels connect MCP servers inside your private network without exposing them, as a research preview.
• June 9, 2026 — Scheduled deployments and vaults: an agent can start on a cron expression and timezone (minute-level granularity). For API keys stored in a vault, the sandbox only holds a placeholder; the real key is attached at the network boundary, only on requests to domains you allow, so the agent never sees it.
• October 7, 2026 — Network limits now cover web search and web fetch: when a cloud environment uses limited networking, its allowed hosts (allowed_hosts) now also apply to the web_search and web_fetch tools. A web_fetch call for a URL on a host that is not allowed returns an error, and web_search omits results from such hosts. If allowed_hosts is empty, neither tool returns a page or a search result. allow_package_managers and allow_mcp_servers add no hosts for these two tools. unrestricted networking and self-hosted sandboxes are not affected. In addition, creating a session fails with a 400 error when an enabled web tool's allowed_domains has an entry outside allowed_hosts (so does a session update that adds such an entry). An allowed_hosts entry matches one exact host unless it starts with *., so docs.example.com is not within ["example.com"].
• October 7, 2026 — Web fetch only reaches URLs already seen in the session: web_fetch now fetches only URLs that have already appeared in the session, for example in the text of a user message, in a web_search result, or in a page fetched earlier with web_fetch. This reduces the risk of data exfiltration. A URL that appears only in Claude's own output, the system prompt, an attached document, or the output of bash or an MCP tool does not count, and fetching it returns a url_not_in_prior_context error. To let the agent fetch a URL, send it in the text of a user.message event.
• October 9, 2026 — Dynamic workflows (beta): the dynamic workflows mentioned in option ② of section 4 became available. The agent writes a program that runs many agents in phases and combines their results, and the server runs it in the background as a workflow run. You set the agent's multiagent field to the multiagent_20261001 type with workflows enabled, and tell the agent in its system prompt when to start a run. You can follow a run through workflow_run.* events on the event stream.
• October 14, 2026 — Scheduled deployments now work on Claude Platform on AWS: scheduled deployments, launched in June, are now available on Claude Platform on AWS too (checked October 18, 2026). On AWS, each run creates a session as an IAM role in your own AWS account. You must first set the agent's execution_identity to aws_role; creating a deployment without it returns a 400 error. The scheduled deployments documentation still labels the feature as beta.
• October 14, 2026 — OpenTelemetry export (beta): Messages API requests and Managed Agents sessions can now be traced through OpenTelemetry into your existing monitoring stack (checked October 18, 2026). The Claude SDK emits spans in Python, TypeScript, C#, Go, Java, PHP and Ruby; to get spans for the API side, add an export destination in the Claude Console (official documentation).

You can also set a per-session spending cap (session budget): usage is priced at list rates and new model requests stop once the cap is reached.

6. Pricing and availability

Pricing has two dimensions: ① tokens (standard model rates, with prompt caching applied) + ② session runtime at $0.08 per session-hour. Runtime is metered to the millisecond and billed only while status is running (idle or rescheduling is free). Anthropic's worked example: a 1-hour coding session using 50,000 input and 15,000 output tokens comes to about $0.705 That example uses Claude Opus 5 rates ($5 input / $25 output per million tokens, per the pricing page as of September 2026).

Here is the same workload recalculated per model with the rates on the pricing page as of October 12, 2026. The right column matches Anthropic's second example, where 40,000 of the input tokens are cache reads (cache reads are normally 0.1× the input rate; on Opus 5.5 and Sonnet 5.5 they are 0.05×).

The $0.08 of runtime is the same on every row; the gap comes from tokens. The cheaper the model, the larger the share of runtime in the bill (about 40% on Haiku 4.5, about 90% on Haiku 5.5). Note that Haiku 5.5 switches to higher rates (input $0.50, output $2.50) once a single request's input exceeds 100,000 tokens. Agent sessions, where context keeps piling up, cross that line easily.

Runtime alone per month is hours per day × 30 days × $0.08. Only time in running status counts; time spent idle waiting for your next message does not. Keeping a session open all day costs only the time it actually works.

The two right-hand columns assume every hour uses the same tokens as the example above (50K input, 15K output, no caching). Real token use varies by orders of magnitude from task to task, so read the runtime column as a floor and cap token spend with a session budget.

7. Getting started

The official quickstart has four steps. Every request needs the beta header managed-agents-2026-04-01 (the SDK sets it for you).

1. Create an agent: define the model, system prompt, tools, MCP servers and skills. The built-in tool set (bash, file operations, web search and more) is enabled with agent_toolset_20260401. Create it once and reuse it by ID.
2. Create an environment: decide where it runs. For a cloud sandbox, set the packages to pre-install and whether outbound traffic is open (unrestricted) or limited to allowed hosts (limited). If you omit it in the API you get unrestricted, while the Console's creation screen starts at limited. Anthropic asks you to set it explicitly. Since October 7, 2026, the allowed hosts of limited networking also apply to the web search and web fetch tools, so add the sites those tools need to allowed_hosts (a host you add is also open to the sandbox).
3. Start a session: launch it with the agent and environment. This is also where you can set a spending cap (budget).
4. Send events and stream the results: send the user's message as an event; Claude runs tools on its own and streams results back as server-sent events (SSE). You can send more instructions mid-run or interrupt it.

You can also write the agent and environment as files and create them with the CLI's ant apply. To start from Claude Code, run /claude-api managed-agents-onboard in the latest version and an interactive guide walks you through the setup (official quickstart).

8. When it fits and when it doesn't

Based on the "when to use" section of the official docs and the conditions on the pricing page:

Summary

Claude Managed Agents is a fully managed environment where Anthropic operates the agent loop, tool execution, sandbox, and state persistence for you. Where the self-hosted Agent SDK means "you run the engine," Managed Agents means "Anthropic runs it, and you focus on the definition"—a paired choice that differs in where operational responsibility sits.

Its hallmarks are workspace-scoped persistent memory (mounted at /mnt/memory, persisting across sessions) and "dreaming" (research preview) to reorganize and consolidate it, plus outcomes-based grading and multi-agent orchestration. Pricing is tokens + $0.08 per session-hour, available to all API accounts as an April 2026 public beta (stateful, so not eligible for ZDR / HIPAA BAA). Related: Agent SDK guide, what is multi-agent, how to build a multi-agent system.

FAQ

Q. What are Managed Agents?
A. Anthropic's suite of APIs for building and deploying cloud-hosted agents. Instead of building your own agent loop, tool execution, and runtime, you get a fully managed environment where Claude can read files, run commands, browse the web, and execute code securely. Prompt caching, compaction, sandboxing, and state persistence are built in. It launched as a public beta on April 8, 2026.

Q. How does it differ from the Agent SDK?
A. In who owns operations. The Agent SDK is a self-hosted harness you run in Python / TypeScript, where you operate the loop, tools, and infrastructure. Managed Agents has Anthropic provide the loop, sandbox, state, and memory on managed infrastructure, and you focus on defining the agent. They're not competitors—it's a choice about how much of the operations you keep.

Q. What are persistent memory and "dreaming"?
A. Persistent memory (a memory store) is a workspace-scoped collection of text documents, mounted in the sandbox as /mnt/memory/; the agent reads and writes it with normal file operations and it persists across sessions. "Dreaming" is an async job that reads the existing memory and past session transcripts to produce a reorganized memory store—merging duplicates, updating stale values, and surfacing new insights. Dreaming is currently a research preview (access request required).

Q. How much does it cost?
A. Two dimensions: token charges + session runtime at $0.08 per session-hour. Runtime is metered to the millisecond and billed only while status is running (idle / rescheduling is free). Anthropic's estimate is about $0.705 for a 1-hour session using 50,000 input and 15,000 output tokens (at Claude Opus 5 rates: $0.625 in tokens plus $0.08 of runtime). With October 12, 2026 rates, the same workload is $0.58 on Opus 5.5, $0.33 on Sonnet 5.5, $0.205 on Haiku 4.5, and about $0.09 on Haiku 5.5. Runtime alone at 8 hours of running a day is $19.20 a month (8 × 30 × $0.08). Tokens use standard model rates with prompt caching.

Q. Can anyone use it?
A. It's a public beta from April 8, 2026, enabled by default for all API accounts, accessible via Claude Console / Platform CLI / Claude Code. But because it's stateful by design, it's not eligible for Zero Data Retention (ZDR) or a HIPAA BAA. Note also that features differ by stage—dreaming is a research preview requiring an access request (check the official docs for the latest).