How Anthropic Decoupled the Brain and Hands of Claude Agents

At the AI Engineer conference, Anthropic team members Priyanka and Gabe Semach shared the evolution of Claude Managed Agents from its early architecture to full decoupling. Rather than a product feature walkthrough, the talk was a rare post-mortem on the decision to tear down and rebuild an architecture—directly relevant to teams building production-grade agent systems.

The basic components of an agent: model, harness, and sandbox

Anthropic's definition is concise: an agent is "a model calling tools in a loop." But what really determines whether an agent works reliably is the harness layer wrapped around the model. The harness is responsible for initiating tool calls in the loop, managing context, and encapsulating capabilities the model doesn't have from training.

Priyanka gave a concrete example: Sonnet 4.5 exhibits so-called "context anxiety"—when it senses it's nearing the context limit, it rushes to wrap up the task. The harness therefore needed a context-reset mechanism. But with Opus 4.5, this limitation disappeared, and the reset logic became redundant. This shows that the harness is essentially a set of assumptions about gaps in model capability—and assumptions go stale as models iterate.

The third element is the sandbox. An agent needs a place to execute code, edit files, and install dependencies. Claude Code is the typical form of a local harness plus a local filesystem. In production, code written by the agent may contain bugs and be untrustworthy, so it must run in an isolated container, with a separate container per task to limit the blast radius.

Context anxiety is a model behavior pattern: when a conversation approaches the context window limit, the model tends to wrap up the task hastily, rushing through remaining unfinished work. This is a policy tendency formed during training rather than explicit programming logic, so it must be offset with engineering measures at the harness layer.

Prompt injection is a core threat in agent security: attackers disguise malicious instructions as tool return results or external data (such as web page content or file content), inducing the model to treat them as legitimate instructions. In agent scenarios the harm is amplified—the model can call tools, access credentials, and read and write files, so once injected and controlled, an attacker can manipulate the agent into unauthorized operations. This is precisely why Anthropic moved credentials out of the sandbox and had them injected by a proxy: even if the model is taken over via injection, it cannot obtain a token it has never seen.

Lessons from the first architecture: raising a "pet"

Anthropic's first architecture, delivered to early customers, stuffed everything into a single container: session logs, harness, and sandbox execution all localized. The upside was that there were no service boundaries to design, and file editing was nearly a system call. The problem was that this amounted to raising a pet—named, carefully cared for, and if it broke you had to revive it, and if you couldn't, the product went down.

There were three concrete pain points. Debugging was extremely difficult: packet loss and container death looked almost identical from the outside, so the team could only troubleshoot by streaming over WebSocket into the container. Data compliance was constrained: customer data stayed on these containers and could neither get in nor out. Network topology was rigid: when customers wanted to connect to MCP services in their VPC, the only options were network peering or packaging the harness for customers to run themselves.

The decoupled solution: three interfaces for session, brain, and hands

The refactored architecture splits into three independent interfaces. On the left is the Session, an append-only event log recording everything that happens in the session. In the middle is the Brain—the harness plus Claude's agent loop. On the right are the Hands—sandboxes provisioned on demand, MCP tool calls, and so on, destroyed once the task ends.

This design turns every component into a replaceable "herd" rather than a pet. If a sandbox dies, the error is returned to Claude as an ordinary tool call result, and it decides whether to restart or route around it. If the harness dies, a new instance reads the event log and continues from the last event, resuming work as if nothing happened. The only state that needs protection is the session log.

There's a key security change: credentials no longer enter the sandbox. Previously credentials sat inside the sandbox, making them an easy target for prompt injection. In the new architecture, when the sandbox needs to access an external resource, the request first goes through a proxy, which injects the token before calling the external endpoint or MCP. Claude never sees the credentials, so it naturally can't be induced to print them or write them to a file.

The append-only log also brings flexibility in context strategy. The system never discards or rewrites the event stream, so compression strategy is free to choose—whether a full summary or just the most recent N events placed into context—and can be adjusted as model capabilities change.

The performance gains are equally clear. Because inference calls can start immediately without waiting for the container sandbox to be ready, first-token latency dropped by about 90%.

Event log uses an append-only structure, meaning each event, once written, cannot be modified or deleted, and new events can only be appended to the end. This design brings two key benefits: first, after any component crashes, state can be rebuilt by replaying the log, with recovery precise to the last event; second, context compression strategy is completely decoupled from persistent storage—raw events are preserved in full, and compression is merely reading the log to generate a context view, so the strategy can be swapped at any time without affecting historical data. Unlike traditional database session tables that allow insert, update, and delete, an append-only log separates "recording facts" from "deriving state," and is an infrastructure pattern for building recoverable agent systems.

Proxy credential injection is a credential isolation pattern: code inside the sandbox never holds a token. When external resources (APIs, MCP services) need to be accessed, the request is first sent to a trusted proxy, which attaches the token to the request header before forwarding and then returns the response to the sandbox. This keeps the credential's lifecycle entirely outside the model's perception, so even if the sandbox is compromised or the model is induced via prompt injection, an attacker cannot extract the credential. The proxy also acts as a policy enforcement point, centrally applying domain allowlists, rate limits, and audit logs, moving the security boundary from the vulnerable sandbox interior to a controlled gateway.

Core conclusion: interfaces must outlive assumptions

The most memorable line from the talk: the harness encodes assumptions, and assumptions expire. Anthropic's approach was to build the architecture on stable interfaces—an append-only session log, a replaceable harness, and a pluggable execution layer. This way, compression strategy can change, the harness can be swapped entirely, yet the interfaces and architecture remain the same. One Brain can connect to multiple Hands, spanning sandboxes, customer VPCs, and MCP servers—far more flexible than a monolithic container approach.

Hands-on path: from environment to session

The workshop portion demonstrated the core API flow of Managed Agents. The first step is to use v1 environments to create an environment template, configure network policy (unrestricted or limited to specific domains and MCP), and preinstall packages. The second step is to create an Agent, specifying name, model (Opus, Sonnet, or Haiku), and system prompt, and mounting a base toolset, typically including bash, read, write, grep, and so on. The third step is to create a Session as the unit of work using the Agent ID and environment ID, with an initial state of idle.

Session interaction revolves around the event stream: the user sends a user.message event, and the Agent returns results. Custom tools let developers take over handling of specific tool calls—Claude emits a custom tool use event, the developer processes it, and returns a custom tool result. Errors are exposed via the session.error event, session idle indicates no task is in progress, and the interrupt event is used to abort a session. The console's quick start provides a guided flow, and participants can use the included API credits to build and test their first Agent.

For teams building their own agent infrastructure, the migration signal from this talk is clear: centralize state in a persistable log layer, treat the execution layer as a disposable resource, and isolate model assumptions inside a replaceable harness. These three points matter far more to long-term maintainability than which model you choose.

One-line Summary

Anthropic's retrospective on rebuilding Managed Agents: split into session log, harness, and sandbox interfaces—interfaces must outlive model assumptions.

Paragraph Summary

The Anthropic team at the AI Engineer conference reviewed the evolution of Claude Managed Agents from a single-container architecture to full decoupling. The early design crammed the session log, harness, and sandbox into one container, causing difficult debugging, data compliance constraints, and rigid VPC integration—an irreplaceable "pet." The rebuild split it into three interfaces: an append-only event log as the only state needing protection, a replaceable harness brain, and sandbox hands provisioned on demand and destroyed when a task ends. Credentials no longer enter the sandbox but are injected by a proxy on outbound calls, fundamentally cutting off the prompt-injection theft path; inference no longer waits for the sandbox, cutting first-token latency by roughly 90%. The core takeaway: assumptions encoded in the harness expire as models iterate, so architecture must be built on stable interfaces that outlive those assumptions.