Anthropic on July 19 introduced two enterprise features for Claude Managed Agents: self-hosted sandboxes and MCP tunnels. Unlike OpenAI and Google, which typically require tools and data to reside in vendor-managed clouds, Anthropic moves execution back to customer infrastructure while keeping the orchestration layer in its cloud.
Sandboxes Go On-Prem: Four Partners, Different Strengths
A sandbox is an isolated environment where an AI agent executes tools. After each task, the environment is wiped clean to prevent data leakage. Previously Anthropic hosted the sandbox; now enterprises can deploy it on their own servers. Anthropic still handles the agent loop — orchestration, context management, error recovery — while actual tool execution runs on customer infrastructure.
Four partners offer distinct approaches: Cloudflare uses microVMs with lightweight isolates, zero-trust credential injection (secrets never stored on disk), and auditable egress traffic; Daytona focuses on long-running stateful execution, allowing agents to pause and restore from the same point, with SSH and preview URLs for human review; Modal optimizes for AI workloads with sub-second startup and scalable to hundreds of thousands of concurrent sandboxes, CPU/GPU billed on-demand; Vercel delivers VM-level isolation, VPC peering, and a "bring your own cloud" option, with sub-millisecond startup and credentials injected by firewall at the network edge — never entering the sandbox.
MCP Tunnels: Solving the Last Mile for Enterprise AI
MCP (Model Context Protocol) is the standard interface for AI agents to connect external tools and data. The problem: enterprise crown jewels — internal databases, private APIs, knowledge bases — sit behind firewalls and are not exposed. Traditional solutions require opening inbound firewall rules or setting up public endpoints, which security teams reject.
MCP tunnels directly fix this. Enterprises deploy a lightweight gateway inside their private network that initiates a single outbound connection — no inbound rules, no public endpoints, all traffic end-to-end encrypted. This architecture resembles a reverse VPN: the connection originates internally, so external systems cannot touch internal assets. Agents access private MCP servers via the tunnel, effectively gaining internal access while staying compliant. The tunnels support both Managed Agents and Messages API, centrally managed by admins from the Claude Console workspace settings — no per-developer configuration needed.
Deeper Strategy: Winning the AI Infrastructure Architecture Battle
Going back to April 8, when Anthropic first launched Managed Agents at ~$0.08/hour, positioning it as a way to save enterprises from building their own agent infrastructure. The industry focused on the pricing model. This update reveals a deeper goal: Anthropic wants to control not just which AI is used, but how enterprise AI infrastructure is architected. Self-hosted sandboxes appeal to regulated industries — finance, healthcare, government — with strict data residency requirements. MCP tunnels remove the most common blocker for AI agents in enterprises: accessing systems that will never be opened to the public. Compute can be outsourced; data cannot. Anthropic chooses to keep data in place and send the agent's brain inside.