Anthropic has announced two new features for Claude Managed Agents: self-hosted sandboxes (public beta) and MCP tunnels (research preview). The sandbox where an agent executes tools moves to infrastructure you control, while the agent loop (orchestration, context management, error recovery) stays on Anthropic’s side. This keeps sensitive files, packages, and services within your perimeter, applying existing network policies, audit logging, and security tooling. You also control compute resources—CPU, memory, runtime image—so agents handling heavy builds or image generation get the capacity they need.

You can bring your own sandbox client or use one of four supported providers. Cloudflare runs sandboxes with microVMs and lightweight isolates, offering zero-trust secrets injection, customizable proxies, and internal service connections over Cloudflare’s network. Amplitude is building its Design Agent on Managed Agents and Cloudflare. Daytona sandboxes are full composable, long-running, and stateful; they can be paused and restored with full state. Clay’s engineering agent Sculptor uses Managed Agents and Daytona. Modal, built for AI workloads, provides sub-second startup on any image, scales to hundreds of thousands of concurrent sandboxes, and offers CPU and GPU on demand. Vercel sandboxes combine VM security, VPC peering, and bring-your-own-cloud with millisecond startup; the Vercel Sandbox firewall injects credentials at the network boundary. Rogo, an AI platform for institutional finance, builds an analyst agent on Managed Agents and Vercel Sandbox.

MCP tunnels let agents reach Model Context Protocol (MCP) servers inside your private network without exposing them to the public internet. Internal databases, private APIs, knowledge bases, and ticketing systems become callable tools. A lightweight gateway you deploy makes a single outbound connection, with no inbound firewall rules, no public endpoints, and end-to-end encryption. MCP tunnels are supported in Managed Agents and the Messages API, and are managed from workspace settings in the Claude Console by organization admins. Self-hosted sandboxes are in public beta; MCP tunnels are in research preview and require requesting access. The article directs readers to docs, cookbooks for setting up a sandbox provider, and the Claude Console for deploying agents.