New Features for Claude Managed Agents: Self-Hosted Sandboxes and MCP Tunnels Explained

Anthropic announced on May 19, 2025, that Claude Managed Agents would receive two major enterprise-grade features: Self-hosted Sandboxes and MCP Tunnels. These two capabilities allow enterprises to run AI agents within their own security boundaries while maintaining full control over data, compute resources, and network connections.

Core Architecture: Separating Agent Loop from Tool Execution

The central design philosophy behind this update is decoupling the AI agent's "orchestration layer" from its "execution layer." Specifically, the Agent Loop—responsible for orchestration, context management, and error recovery—continues to run on Anthropic's infrastructure, while tool execution migrates to environments configured by the enterprise itself.

The essence of the Agent Loop is an iterative "perceive-reason-act" closed loop: the model receives the current state and tool return results, decides which tool to call next or whether to output a final answer, then feeds tool execution results back to the model, cycling until the task is complete. This mechanism was first systematically described in the ReAct (Reasoning + Acting) paper and later became the foundational paradigm for frameworks like LangChain and AutoGPT. The complexity of the orchestration layer lies in handling retry logic for failed tool calls, dynamic management of the context window, state tracking for multi-step tasks, and coordination of parallel tool calls—these represent the core value Anthropic provides at the managed level and the most expensive part for enterprises to implement on their own.

This architecture delivers three direct benefits:

• Enterprises can leverage Anthropic's technical advantages in agent orchestration without exposing sensitive files, code repositories, or internal services to external environments
• Existing network policies, audit logs, and security tools remain in effect—data never leaves the enterprise boundary
• Enterprises maintain autonomous control over compute resource configuration—CPU, memory, and runtime images are all set on the enterprise side, which is particularly important for compute-intensive tasks like long builds or image generation

It's worth noting that the core compliance challenges enterprises face when deploying AI agents span multiple dimensions: data sovereignty (GDPR, China's Data Security Law require data not to leave borders), industry regulations (SOC 2 and ISO 27001 for finance, HIPAA for healthcare), and internal security policies (code must not be uploaded to third-party services). The traditional SaaS AI tool model of "data to the cloud" fundamentally conflicts with these requirements. The self-hosted sandbox architecture directly addresses this contradiction: by confining data processing within the enterprise VPC (Virtual Private Cloud), introducing AI capabilities no longer triggers data compliance reviews.

Self-Hosted Sandboxes: Four Hosting Providers to Choose From

Enterprises can choose to run sandboxes on their own infrastructure or use one of the following four hosting providers. Each provider has distinct strengths in isolation technology, startup speed, and resource scheduling.

Before understanding the technical differences between providers, it's helpful to understand the evolution of sandbox isolation technology. microVM is a lightweight isolation technology that sits between traditional virtual machines (VMs) and containers, with AWS Firecracker as the representative example. Traditional VMs provide strong isolation but are slow to start (seconds) with high resource overhead; containers start quickly but share the kernel, creating escape risks. microVMs achieve millisecond-level startup through a streamlined VMM (Virtual Machine Monitor) while retaining hardware-level isolation. This is especially important for AI agent sandboxes: the code executed by agents may come from untrusted LLM output and must run in strictly isolated environments to prevent host escape.

Cloudflare: Zero Trust Architecture and Global Network

Cloudflare uses microVMs and lightweight isolation technology to run sandboxes at scale. Its distinguishing features include zero-trust secret injection, customizable proxies (for auditing, rerouting, or modifying outbound traffic), and the ability to connect to internal services through the Cloudflare network.

Zero Trust is a "never trust, always verify" network security model proposed by Forrester analyst John Kindervag in 2010 and validated at scale through Google's BeyondCorp implementation. In AI agent scenarios, zero-trust architecture is particularly critical: agents may dynamically generate and execute code, accessing multiple internal systems where traditional static firewall rules are inadequate. Cloudflare's zero-trust secret injection mechanism ensures credentials are injected outside the sandbox—even if code within the sandbox is compromised, attackers cannot directly obtain the original credentials, fundamentally cutting off the credential leakage path.

Design tooling company Amplitude is building its internal Design Agent on Managed Agents and Cloudflare for brand-consistent, production-grade UI and marketing design. Amplitude's design team stated that they "had the first working version of the design agent running in two days."

Daytona: Stateful Long-Running Sandboxes

Daytona sandboxes are full composable computers that support long-running and stateful operations. The same foundational primitive can handle quick burst tasks as well as agents working for hours. Sandboxes are accessible during sessions via SSH or authenticated preview URLs, and can be paused and resumed with complete state.

The "stateful" characteristic is crucial for complex engineering tasks. Stateless sandboxes destroy the environment after each tool call, suitable for brief code execution; stateful sandboxes maintain the file system, process state, and installed dependencies throughout an entire agent session, enabling workflows like "clone repo → install dependencies → multiple rounds of modifications → run tests" that require persistent context.

Customer data platform Clay's GTM engineering agent Sculptor is built on Managed Agents and Daytona, capable of autonomously building, testing, and monitoring workflows. Clay AI engineer Ryan Chang stated: "Claude Managed Agents let us replicate the power of our local agents while gaining the reliability, version control, and background execution of cloud agents."

Modal: Cloud Platform Purpose-Built for AI Workloads

Modal is a cloud platform built specifically for AI workloads, with sandboxes that share the same foundation as Modal's functions, storage, and networking primitives. Modal's custom container runtime achieves sub-second startup on any image, supports scaling to hundreds of thousands of concurrent sandboxes, and provides CPU and GPU resources on demand.

Modal's core differentiation lies in its "functions as infrastructure" design philosophy: developers declare compute requirements (GPU model, memory size, concurrency) with Python decorators, and the platform automatically handles resource scheduling. This stands in stark contrast to traditional cloud platforms that require manual cluster configuration. For AI agent scenarios that need to run large-scale image generation, model inference, or data processing, Modal's elastic GPU scheduling capability offers a cost-performance advantage that other providers struggle to match.

DoorDash co-founder Andy Fang stated that they are evaluating combining Claude Managed Agents with Modal to scale agentic commerce capabilities for local merchants.

Vercel: Millisecond Startup and VPC Peering

Vercel sandboxes combine VM security, VPC peering, and bring-your-own-cloud capabilities while maintaining millisecond-level startup times. Their sandbox firewall injects credentials at the network boundary, ensuring credentials never enter the sandbox interior.

VPC Peering is a networking technology that enables direct communication between two independent Virtual Private Clouds—traffic doesn't traverse the public internet, resulting in low latency and high security. For industries like finance and healthcare that have strict requirements for data transmission paths, VPC peering is a critical technical mechanism for meeting compliance requirements. Vercel combines this enterprise-grade networking capability with its frontend deployment platform's ultra-fast startup characteristics, making its sandbox solution ideal for high-throughput scenarios that require frequent environment creation and destruction.