On April 8, Anthropic launched Claude Managed Agents — a hosted platform for running long-lived AI agents in the cloud. You define the agent’s tasks, tools, and guardrails; they run the infrastructure. The interesting part is not the product. It is the architecture underneath.
Anthropic published an engineering blog called “Scaling Managed Agents: Decoupling the brain from the hands” that walks through how they separated the orchestration loop from the execution environment. Reading it felt like seeing a blueprint of decisions I have already made — and a few I have not.
I run a personal agent infrastructure. An orchestrator dispatches coding tasks to headless workers on remote machines. I have been building this for months, iterating through the same problems Anthropic describes.
Managed Agents virtualises three things. A session is an append-only event log — everything that happened, durably stored outside the agent’s context window. A harness is the orchestration loop — it calls Claude, routes tool calls to sandboxes, handles retries. It is stateless; if it crashes, a new one reads the session log and resumes. A sandbox is an isolated container where code runs. It dies and gets replaced without affecting the session or harness. The key property: all three are independently replaceable. The harness does not know what the sandbox is. The session does not care which harness reads it.
If you have been building agent infrastructure, this architecture looks familiar. I have an orchestrator that dispatches tasks to workers on a remote ARM machine. The orchestrator writes specs, the worker executes, a verdict gate checks the output. Each piece is separate. Workers are disposable. The orchestrator does not touch implementation code. Anthropic arrived at the same decomposition for the same reasons. Workers must be cattle, not pets — their early design put everything in one container, and when the container failed the session was lost. The orchestrator must be stateless — their harness crashes, a new one calls wake with the session ID and resumes. Credentials never enter the sandbox — they bake git tokens into local remotes during container init and store OAuth tokens in a vault behind a proxy. The validation matters because these are not obvious decisions. The simpler path is one big container, credentials in environment variables, state in memory. Every agent framework starts there.
The biggest gap in my system is their session as a queryable object. Anthropic’s session is an append-only event log with a getEvents call — you can read positional slices, rewind to before a specific action, re-read context that was compacted away. The session lives outside the context window but remains accessible to the harness. My equivalent is a fifteen-line state file that gets overwritten each checkpoint, plus raw session JSONL that nobody reads. If a worker crashes, I lose whatever was not checkpointed. The insight is that the context window is a view, not the source of truth. Context engineering — compaction, trimming, summarisation — is lossy by definition. An append-only event log means those guesses are reversible.
Their self-evaluation loops are also ahead of mine. In research preview, Managed Agents supports defining success criteria that the agent iterates against until met. In internal testing, this improved task success by up to ten percentage points, with the largest gains on the hardest problems. My system does post-hoc verdicts: the worker runs once, a separate gate checks the output, pass or fail, one shot. The difference is obvious: iterate before declaring done, not after. Acceptance criteria in the spec, worker self-checks against them, loops until they pass. The verdict gate becomes an external auditor confirming work the worker already believes is correct.
The subtlest insight is what I would call the meta-harness concept. The engineering blog opens with a specific example: Sonnet 4.5 had “context anxiety” — it would wrap up tasks prematurely as it approached the context limit. They added context resets to the harness to compensate. Then Opus 4.5 came along, the behaviour disappeared, and the resets became dead weight. Harnesses encode assumptions about what the model cannot do, and those assumptions expire. My coaching file — a list of what the implementer model does wrong, prepended to every dispatch — is exactly this kind of expiring assumption. Some entries describe real model limitations. Others describe limitations the model has already outgrown. The coaching file should be a diff against reality, tested regularly and pruned aggressively.
The architecture is interesting. The business move is more interesting. Three actions in three days: cut off third-party subscription arbitrage, ship the strongest model, launch the agent platform. The session-hour pricing means Anthropic now has revenue decoupled from token volume. They are selling compute time, not just intelligence. That is a cloud infrastructure business model, not an API business model.
For solo builders, the implication is clear: the agent platform layer is consolidating upward. Build the parts that are specific to your workflow. Do not build generic sandboxing, session management, or credential vaults — those are becoming commodity infrastructure. Build the judgment layer: which tasks to dispatch, what acceptance criteria to set, how to route between models and compute targets. That is where the leverage is.