Claude Managed Agents Architecture Separates Brain From Hands

Anthropic just revealed the technical architecture behind Claude Managed Agents. This isn't a product overview, it's a system design lesson worth studying for anyone building AI agents.

The Problem With the Old Architecture

The original architecture tightly coupled containers with sessions, turning every instance into a "pet", carefully nurtured and never allowed to die. If the container died, the whole session went with it. Worse, when engineers needed to debug something, they had to open a shell directly into the container holding a user's data. That was a serious security risk, and the Anthropic team was determined to get rid of it.

Virtualizing Three Independent Components

Taking a cue from how operating systems abstract hardware through stable concepts like "process" and "file", the new architecture splits the system into three clear layers. The Session is an append-only log that records every event, acting as a context object that lives outside Claude's context window. The Harness is the stateless control loop that calls Claude and routes tool calls to infrastructure, which makes it easy to scale horizontally. The Sandbox is the code execution environment, provisioned on demand instead of ahead of time. Every tool target, from containers to phones to emulators, goes through a single interface: execute(name, input) → string.

Zero Trust Security for the Sandbox

The design choice that stands out most: credentials never touch the sandbox. The git auth token is only used at the exact moment of cloning a repo, OAuth tokens sit in a separate vault, and every outside API call goes through a proxy. Claude never sees the token at all. This is zero trust philosophy applied all the way through, the sandbox is just the "hands" doing the work, it doesn't need to know where the "keys" are kept.

A Remarkable Performance Boost

The numbers say it all: about a 60% drop in p50 TTFT (Time to First Token) and over 90% at p95. The secret is that the session log stores durable context outside the context window. Previously, every session had to pay the full cost of container setup, now inference can start right away from the existing session log. The harness can also transform events before feeding them into context, which smartly boosts the prompt cache hit rate.

Multi Agent Systems and Design Philosophy

This architecture opens the door to genuinely powerful multi agent systems. Multiple "brains" (harnesses) can scale horizontally without needing a paired container. Multiple "hands" (sandboxes and tools) can be accessed through one unified interface. Notably, a brain can hand its hands off to another brain, which gives the system remarkable flexibility. The core philosophy is "opinionated about interfaces, not implementations": the system requires Claude to be able to manipulate state and execute computation, but it never assumes how many brains or hands there are, or where they live.

Are you building an AI agent and running into trouble separating execution from reasoning? Does this architecture offer any ideas for your own system?

Source: https://www.anthropic.com/engineering/managed-agents