Self-Hosted Claude Agents Keep the Control Plane Local, Not the Model

Anthropic's self-hosted Claude Managed Agents private beta puts 3 components under customer operation: the Managed Agents server, a PostgreSQL database, and workers. Help Net Security reported the offering on November 12, 2026. The described deployment keeps sandboxes, credential handling, and session history in the customer's cloud or on-premises environment.

That is not the same as self-hosting Claude model weights. The architecture can route models to external providers, so a local agent control plane does not establish that all application data stays inside the customer environment. Buyers need to inspect where execution is managed and where inference happens as separate questions.

Access is through the account team, with pricing by quote. The announcement therefore describes a deployment option to investigate, not a publicly priced replacement whose operating cost can be read directly from a signup page. Any business case still needs a concrete service proposal and an internal ownership plan.

The local boundary covers execution management

The reported deployment places the Managed Agents server, workers, and 1 PostgreSQL store in the customer environment. That gives a buyer identifiable components to put through an infrastructure review. It also makes the customer responsible for deciding who operates them and how their access fits existing administrative controls.

Local session history is relevant because the place where an agent runs is not the only place where its work persists. A review should identify who can read stored sessions, how long they are retained, and how application owners request their removal. These are proposed due-diligence questions, not controls that the report independently verifies for a buyer's eventual installation.

Likewise, keeping sandboxes in a customer cloud or on-premises environment establishes a deployment location, not a universal security result. The customer still needs to understand how workers receive tasks and which actions those tasks are allowed to perform. Self-hosting changes who can set and inspect those boundaries; it does not establish that their initial configuration meets a particular organization's requirements.

Credential injection and model inference are separate reviews

Help Net Security describes secrets being injected through a proxy rather than stored in the sandbox. That is a specific credential-handling choice worth investigating. A buyer should ask how the proxy authorizes use and how operators can verify its behavior, rather than collapsing the mechanism into a claim that credentials cannot be misused.

A useful analytical framing is 2 boundaries: the agent control plane and model inference. This is a review structure, not a measured vendor security result. The control plane may be in the customer's environment while requests to an external model provider still cross a separate network and contractual boundary.

The resulting question is what information is sent for inference and under which provider terms. The fact sheet does not establish that no data leaves the customer environment. A buyer should require the proposed routing configuration and data-flow description before writing a residency or confidentiality claim into an approval document.

Customer operation adds obligations as well as control

The 3-component deployment provides a concrete operating footprint, but the supplied report does not price the work needed to maintain it. The customer has to assign responsibility for the server, database, and workers. Any cost comparison that includes only the vendor quote would leave that internal responsibility outside the decision.

Private-beta status also matters to planning. Access through an account team is different from an established public ordering path, and quote-based pricing cannot support an assumed universal rate. A procurement team should ask which deployment conditions and support commitments apply to its own proposed use rather than filling those gaps from the product label.

The honest trade-off is more direct control over part of the system in exchange for operating and review work. A buyer seeking local execution management may find that attractive. A buyer whose requirement is locally hosted model weights has a different requirement, which this announcement does not establish as satisfied. The distinction should be resolved before a pilot is described internally as an approved no-egress design.

What To Do About It

• Draw the actual data path: Ask the account team to mark sandbox execution, credential proxy calls, stored history, and external model requests on the proposed deployment diagram. Review control-plane operation and model inference as 2 separate boundaries.
• Assign component owners: Give infrastructure and application teams explicit responsibility for access review, maintenance, and incident handling before agreeing to a pilot. Cover the Managed Agents server, PostgreSQL, and workers as 3 named components.
• Inspect credential use: Request a demonstration showing where a secret is held and how an authorized task uses it, without accepting sandbox location as the whole answer. Record the observed behavior against the reported proxy-injection design from November 12, 2026.
• Request a complete proposal: Obtain the beta terms, support assumptions, and commercial quote, then add your own operating responsibilities before comparing alternatives. Include retention and access decisions for the 1 PostgreSQL store.

The Bottom Line

Self-hosted Claude Managed Agents provides a customer-operated control-plane option with 3 named components. It does not establish local Claude model weights or guarantee that inference data never leaves the environment. The reported proxy-based credential handling deserves a focused review alongside the separate model-routing path. Buy the deployment only if its actual data flows and operating obligations match the requirement, not because self-hosted sounds like a complete security boundary.