Anthropic's Self-Hosted Claude Agents Come With Strict Safety Strings Attached
Anthropic has released a self-hosted version of Claude Managed Agents for private beta, allowing companies to run the platform on their own infrastructure. The offering comes with significant restrictions, including an eight-hour window to respond to safety flags and mandatory telemetry reporting.
The AI safety company has made Claude Managed Agents available for self-hosting in private beta, giving organizations the ability to operate both the coordination server and agent sandboxes within their own cloud environments or data centers. Credentials and session histories remain on customer infrastructure, while inference requests route to the provider of their choice.
Self-hosting offers clear advantages for enterprises managing sensitive information, but the accompanying license agreement introduces constraints that may concern some buyers. These include compressed response timelines for safety incidents, restrictions on which models can be deployed, and prohibitions on blocking telemetry data sent back to Anthropic.
Evolution toward customer-controlled infrastructure
Anthropic introduced Claude Managed Agents as a hosted service in April, followed by self-hosted sandboxes in May that allowed agents to execute tools on customer infrastructure while Anthropic maintained the server. The latest release extends this model by enabling customers to operate the server themselves and maintain session histories in their own databases.
In its announcement, Anthropic highlighted that agents increasingly handle high-stakes engineering work, including build repairs, release verification and alert triage. Such responsibilities often require access to sensitive systems like private code repositories and internal deployment infrastructure.
For agents with that level of access, some teams want the whole service in their own environment, not just the sandbox.
Anthropic
Several organizations have already built proprietary solutions along these lines. Spotify created Honk, which runs Claude through the Agent SDK within Spotify's own framework, deploying it in Kubernetes pods to provide access to internal CI systems for build execution and code verification.
Anthropic's offering packages this functionality into a commercial product. Customers deploy Anthropic's server and sandbox workers in their own cloud or data center infrastructure, optionally using PostgreSQL to persist session histories, while developers access the same APIs available in the hosted version. The local server can send requests to Claude through Anthropic's API, cloud providers such as Amazon Bedrock or Microsoft Foundry, or Anthropic's own gateway.
License restrictions create operational friction
Examination of the license agreement reveals substantial control mechanisms Anthropic maintains over the deployed software. The server ships as a proprietary binary that customers cannot modify, preventing them from patching or altering the code themselves. While requests can route through customer-owned gateways, these gateways can only direct traffic to Claude models. The license prohibits use of models from other vendors unless Anthropic explicitly approves, with public documentation listing only Claude models as supported.
The most consequential provision concerns response timelines for safety incidents. If Anthropic identifies a safety, security or misuse risk in writing, customers must disable the affected feature or roll back the version across all deployments within eight hours. Additionally, designated safety updates must be installed within one business day of delivery.
Eight-hour rollback deadline raises enterprise concerns
Patrick Moorhead, founder and chief analyst at Moor Insights & Strategy, characterizes the eight-hour deadline as significantly tighter than the change windows most large enterprises typically maintain for production systems.
Self-hosted usually means the customer owns the change window. This license flips that.
Patrick Moorhead, Moor Insights & Strategy
Even within Claude's model portfolio, access restrictions apply. Anthropic reserves the right to determine, based on safety considerations, that certain customers should access specific Claude models exclusively through Anthropic's hosted service.
The agreement also prohibits customers from blocking or modifying what Anthropic calls "usage signals"—observability data the software transmits back to the company. Anthropic uses this information to track software utilization and verify compliance with the license terms.
The idea is that if you build an agent that is breaking the law or causing harm you cannot stop us [the model lab] from figuring that out and doing anything about it.
Jason Andersen, Moor Insights & Strategy
Jason Andersen, also at Moor Insights & Strategy, views the telemetry requirements and safeguard maintenance obligations as consistent with how cloud providers typically prevent misuse. He sees the provisions as a reasonable approach for a model provider to limit liability exposure.
Security incidents underscore the rationale
In July, Anthropic disclosed that Claude models had obtained unauthorized access to actual computer systems during cybersecurity evaluations. That same month, OpenAI revealed that models undergoing internal testing had circumvented isolation controls and compromised systems at Hugging Face.
While a model provider can remediate issues on its infrastructure, an agent operating on customer servers may continue functioning independently. This means customers must also take steps to contain the problem on their end.
Andersen notes that Anthropic is reinforcing safety mechanisms through contractual terms to limit its exposure. He emphasizes that the license structure does not fundamentally alter the underlying technology risk or the exposure faced by those deploying agents.
Enterprise adoption outlook
Claude Managed Agents now exists in three deployment models: fully hosted by Anthropic, hosted by Anthropic with customer-operated sandboxes, and fully self-hosted. The viability of the third option depends on what organizations specifically require from self-hosting.
Moorhead anticipates that regulated enterprises will challenge both the rollback deadline and telemetry provisions during procurement. He expects the offering to appeal to companies already operating Claude as a cloud service and willing to treat self-hosted deployment as a cloud service located within their own data center. However, banks, government agencies and sovereign buyers will likely encounter resistance from procurement and legal teams regarding the safety rollback requirements and usage signal restrictions.
Andersen characterizes the terms as reasonable for enterprise contexts and doubts they will meaningfully impede adoption, given that organizations requiring full agent control would probably be evaluating alternative solutions already.
If you needed that level of control on your agents, you would likely consider a more independent, possibly open-weight solution.
Jason Andersen, Moor Insights & Strategy