Claude Managed Agents

Summary#

Claude Managed Agents is Anthropic's server-hosted agent runtime, sold through the Claude API and configured in Claude Console. A developer creates an agent (client.beta.agents.create: name, model, toolset), opens a session against an environment, and sends it events. Everything on this page comes from one source unless marked otherwise: Richard MacManus's Latent Space report (2026-10-12) of a workshop by Anthropic's CJ Avilla and Harrison Stall at AI Engineer New York, with the slide and code photos transcribed. That makes it vendor-claim: Anthropic presenting its own product, relayed by a reporter. No independent party has measured the runtime.

The product predates this source. Katelyn Lesse, Head of Engineering for Claude Platform, said its design documents dated back "up to two years" before it was built (The state of the tech industry in 2026, practitioner-opinion). The AI Native Product Cadence and Implementation Abundance Inverts Product Work pages cite that as the case where pre-AI planning survived.

Architecture: the brain runs apart from the hands#

One slide gives the runtime's split. The brain (agent loop, session state) is always hosted by Anthropic. The hands (sandbox, code execution, shell commands) run in Anthropic's sandbox or one the customer hosts, linked to the brain by tool calls. Outbound traffic from the hands passes an egress proxy that adds credentials: "In Anthropic's sandbox, API keys are added at the egress proxy and MCP credentials are added by Anthropic. The sandbox never holds the real values."

This is the "brains and hands" split DHH (David Heinemeier Hansson) built by hand for untrusted PR content (Agentic Prompt Injection), sold as a managed product, with one extra piece: secrets stay out of the execution environment entirely. The slide says nothing about the channel DHH flagged as still open, tool output returning from the sandbox to the model.

Dynamic workflows ("flows"), October 2026#

Announced the Friday before the talk. One field switches it on: multiagent={"type": "multiagent_20261001"} on the agent, and then a prompt such as "Run a workflow: which of these 300 contracts have a change-of-control clause?" The lead agent plans, then writes an orchestration program that launches agents, collects results and manages information flow. Before this, Managed Agents required the developer to configure a coordinator and a roster of subagents. Pre-configured subagents can still be passed in the agent config. The presenters say the feature began in Claude Code (see Dynamic Workflows: An Algebra for Agents, where the product-side figures and the outside measurements are carried).

Stated properties:

• Durability. "Long-running shouldn't mean someone keeps it running": a closed laptop, a dropped connection or a crashed process does not end the run, and "finished steps never re-run."
• Communication is through a shared filesystem only. The API offers no way to tell one workflow subagent to message another.
• Inspection. A graph view in Console shows each transition, including the payload the lead agent passed to each subagent.

Controls: budgets, interrupts, defaults#

• Session budget. budget={"type": "limit", "max_list_cost": {"amount": "125", "currency": "USD"}} caps a session at $1.25. The cap is list price in whole US cents, and requests already running when it is reached finish first. Anthropic's advice is to set it low enough to stop a flow mid-run and watch what the run does at the cap.
• Interrupt. A user.interrupt event halts a session; it resumes on the next message.
• The model is not told its budget. Stall said informing models of their budgets could make them "a little bit anxious." That is a quip, not a measurement.
• Width is set by "evals and lower defaults." Asked whether a ticker scan could spawn hundreds of subagents, Stall said defaults are low and ambitious tasks generally need explicit encouragement to parallelize.

Dreaming#

A research-preview feature. Per Anthropic's documentation as quoted in the report, a dream "reads an existing memory store alongside past session transcripts, then produces a new, reorganized memory store," merging duplicates, replacing "stale or contradicted entries" and surfacing "new insights." Avilla offered it as the way to make repeated flows cheaper over time. Flows do not improve themselves: asked whether a watchlist flow could notice its scanning model was inadequate and change its next run, Stall said that is not built in, and pointed to hill-climbing and dreaming as the routes. Nothing in the source measures a dream's effect. A pass that rewrites a memory store from transcripts is also a write path, the surface Memory and Context Poisoning studies.

Connections#

• Dynamic Workflows: An Algebra for Agents — the orchestration primitive this runtime now hosts, and where its claimed figures (a 4.7–6.6× cost premium for higher recall on a 25-ticker scan) sit against Claude Code's shipped defaults and outside measurements
• Agentic Prompt Injection — the brain/hands split, built by hand in practice before Anthropic productized it with credentials kept out of the sandbox
• Anthropic — the vendor
• Claude Code — where dynamic workflows started, per the presenters

Sources#

• How Anthropic's Dynamic Workflows Coordinate Claude Agents — Richard MacManus, Latent Space, 2026-10-12, vendor-claim (community report of an Anthropic workshop by CJ Avilla and Harrison Stall at AI Engineer New York; slide and code photos transcribed in the raw). Cited for the brain/hands slide, the dynamic-workflow enablement code, the budget and interrupt code, durability, filesystem-only communication, the Console graph, and the Q&A on defaults, budget awareness and dreaming
• The state of the tech industry in 2026 — Gergely Orosz, The Pragmatic Engineer, 2026-10-06, practitioner-opinion. Cited for Lesse's two-years-of-planning-documents quote only