Claude Managed Agents is Anthropic hosted harness for long-running agents, and this workshop builds a research desk with subagents, a self-grading outcome loop, and a shared memory store. Here is how the pieces fit together, what the speakers actually demonstrated, and where the current limits sit.
Claude Managed Agents in One Paragraph
Claude Managed Agents is Anthropic hosted agent service: you create an agent and an environment, start a session, then send and receive events while Anthropic runs the harness, sandbox, storage, and scaling. The current state of that product is documented in the Claude Managed Agents documentation.
The split matters for planning. Priyanka Phatak, who leads the Claude Managed Agents engineering team, told the AI Engineer World's Fair 2026 audience that once an agent is created, "all you have to do is start a session with the agent, send events, get back events. Everything else is managed by us."
A separate Claude Code harness is not the same runtime. Asked directly how the two relate, Gabe Cemaj, an Anthropic engineer, said the hosted service runs its own harness, heavily inspired by the Claude Code harness but rebuilt to be a "more generic, not just coding specific thing."
How the Session Event Stream Drives a Chat UI
A Claude Managed Agents session communicates through one event stream: the client posts user messages up to the session and consumes agent output as server-sent events. The chat UI in the workshop is a thin reader over that stream.
The code the workshop generates does two things. Pressing enter sends a user.message event containing the typed text, and the backend relays the session's SSE stream straight back to the browser so the page can render it. There is no bespoke message store in the app for this step.
Cemaj noted that if a chat application is all you need, this is where you stop. The interesting capability sits on the other side: sessions that keep running asynchronously for minutes, hours, or longer, which a request-and-response chat loop does not use.
Environments, Skills and the SEC EDGAR Agent
An environment is the template for the sandbox: which domains the agent may reach, which packages are installed, and the access rules in force. In the workshop the agent gets access to the SEC site plus Python packages for calling it.
Phatak described it as the sandbox template and noted that the demo uses unrestricted access for convenience, while a production agent would restrict reachable domains or specific MCP servers. Package dependencies are resolved at creation time and then cached and reused across sandbox reinstantiations.
A skill is a named capability the agent can invoke. The workshop adds an SEC EDGAR skill that documents how to use the Python package and requires the caller to identify itself with a name and email address, because the SEC asks who is calling.
Skills are living artifacts. Later in the workshop Cemaj updates the skill to teach it a new filing form and points out that any new session referencing that skill picks up the change. Existing sessions keep the version they loaded.
Outcomes: Task, Rubric and a Grader That Forces Retries
An outcome turns a vague request into a graded one. You supply the task, a rubric, and a maximum iteration count; the agent works, then a separate subagent checks the work against the rubric and either accepts it or sends it back for another attempt.
In the recorded run, the Nvidia analysis took roughly ten minutes. The agent found no prior note in its memory store, delegated extraction and risk evaluation to subagents, wrote a structured scorecard file, updated memory, and then the grader verified that the scorecard was delivered with well-defined numbers.
The grader is not a general correctness oracle. Asked how subagent work is graded, Cemaj answered that the outcome is defined at the overall session level, and that sub-outcome definitions for individual subagents do not exist today. A rubric that omits a failure mode will not catch it.
Attendees asked what stops agents from looping and burning tokens. Anthropic answer was that orchestration choices are largely left to the developer, and that per-session token or spend caps are being explored but are not offered today.
Vaults Keep Secrets Out of the Sandbox
A vault stores credentials behind placeholders. The agent's environment variable holds a placeholder value; when the agent calls a domain you authorized for that secret, Anthropic substitutes the real credential at egress.
The boundary is per-secret and per-domain. As Phatak described it, if a secret is scoped to the SEC and the agent tries to use the same variable against another host, no swap happens. That limits accidental leakage without handing the raw secret to agent-authored code.
Vaults also carry OAuth credentials. Phatak said you create a vault in the console, bundle credentials into it, and reference the vault when starting a session; the platform provisions the OAuth flow for supported providers such as Notion.
The workshop injected the SEC identity directly into the prompt because the SEC only needs a name and email. For anything sensitive, vaults are the path the engineers recommended on stage.
Subagents, Custom Tools and a Map-Reduce Harness
Subagents extend one session's reach without consuming its context. The main agent delegates to specialists with their own prompts, tools, and permissions, and each delegated run shows up as its own thread in the console for observability.
The head-of-research agent carries a self-reference, so it can spin up a copy of itself when it does not know in advance which specialization a task needs. Cemaj was explicit about what transfers: the self-reference copies the tool description, schemas, and prompt into the new subagent, not the parent's conversation transcript.
A custom tool called dispatch analysis lets the main agent spawn multiple sessions for different tickers. The application server orchestrates those sessions and aggregates their results, which is the map-reduce shape the workshop closes on.
Memory sharing is separate from transcript sharing. The workshop attaches a shared memory store so different sessions accumulate knowledge about different financial instruments, and memory can be attached at more than one scope, for example a user-level store plus an organization-level store on the same session.
Deployments, Dreaming and Session History Limits
Deployments API schedules recurring sessions on a cadence, which is how the workshop frames long-horizon analysis that keeps updating. Dreaming is the learning step: it reads transcripts and memories across sessions and rewrites memory so later agents find better starting points.
Dreaming is currently constrained to memory stores. Cemaj said it could later extend to skills, prompts, and agent definitions, but today memory is the only target.
Session history cannot be rewound. You can steer a running session by sending a user message event, and queueing around ten messages at a time is fine in practice, but roll-back and roll-forward are not available. Session forking is on the roadmap, not shipped.
Attendees also asked about data lock-in. The answer given was that everything is API-based, so memories can be extracted and moved elsewhere, though memory providers other than the built-in store require an MCP server or custom tool.
Claude Managed Agents Compared with the Agent SDK
The Agent SDK and Claude Managed Agents are different products with different operating costs. The table below separates them on the dimensions the workshop speakers actually addressed.
| Dimension | Claude Managed Agents | Agent SDK |
|---|---|---|
| What it is | Hosted service: harness, sandbox, storage, scaling under Anthropic | Packaged headless Claude Code the developer runs |
| Who runs the runtime | Anthropic infrastructure | The developer's own environment |
| Harness origin | Rebuilt, inspired by Claude Code, not coding-specific | Claude Code's own harness |
| Long-running work | Sessions persisting across hours or longer | Bounded by the host process |
| Self-hosted option | Self-hosted sandboxes via third-party providers | Native to running it yourself |
Cemaj's phrasing on stage was that the Agent SDK is "Claude Code in the form of a binary that you can take and run wherever you want," while managed agents is a fully hosted service with its own harness.
Claude Managed Agents FAQ
- What are Claude Managed Agents? They are Anthropic hosted agent service in which the harness, sandbox, scaling, and event-log storage run on Anthropic infrastructure. An application creates an agent and environment, starts a session, and exchanges events with it. Anthropic own engineers described the harness as rebuilt for general tasks rather than coding alone.
- Is Claude Managed Agents the same as Claude Code or the Agent SDK? No. The Agent SDK ships a packaged headless Claude Code harness that you run yourself. Claude Managed Agents runs a separate harness that Anthropic built and hosts, though the company says it took lessons from the Claude Code harness.
- How do outcomes and graders work? You define a task, a rubric, and a maximum iteration count at the session level. A grader subagent checks the delivered work against the rubric and either accepts it or triggers another attempt. Sub-outcomes for individual subagents were not supported at the time of the workshop.
- Can an agent spin up other agents? Yes. Subagents run with their own prompts, tools, and permissions, and an agent can reference itself so it can clone its own definition when a task's specialization is unknown. The clone receives the prompt, tool descriptions, and schemas, not the parent's transcript.
- Do different sessions share what they learn? A shared memory store can be attached to sessions so knowledge about instruments or entities carries across them. Memories also can be attached at multiple scopes, such as per user and per organization, on the same session.
- Are API keys and OAuth tokens exposed to the agent? Vaults keep them out of agent-authored code. The sandbox holds a placeholder, and Anthropic swaps in the real credential at egress only for the domains you authorized for that specific secret.
- Can a running session be rewound? Not currently. You can steer the agent by sending further user message events, but there is no rewind or roll-forward, and session forking was described as a roadmap item rather than a shipped feature.
- What limits should developers plan around? Per-session spend and token caps were not offered at the time of the workshop, so loop and cost control sit with the developer's orchestration. Dependency installation happens at environment creation and is cached afterward.
- Can enterprise data be reached without exposing services publicly? MCP tunnels connect Anthropic network to yours without publishing the MCP server to the internet. Alternatively, self-hosted sandboxes can run in a network peered with your applications and services.
Turning Conference Talks into Written Guides
The workshop's value sits in details that a slide deck loses: the placeholder swap at egress, the fact that a self-referencing subagent does not inherit the parent transcript, the ten-minute graded run on Nvidia's filings. Those are the sentences a reader needs, and they are exactly what gets compressed away when a talk stays on video.
If you have recorded conversations, walkthroughs, or conference sessions, Skala Blog turns a YouTube video into a draft article: paste the URL, let the transcript come through, and edit the result into something a reader can act on.
Teams building with agent frameworks can also follow the work of Gustavo Dev Doido, whose Crazystack Typescript material and Bootcamp do Dev Doido programs cover TypeScript and full-stack engineering.
Fork this article
Start a new branch from the same video, shaped your way. You keep the credit; the original keeps the attribution.
A fork in another language is filed as a translation of this article, so the two pages point at each other. You can unlink it later from the editor.
0/240
You are creating
- Format
- For
- Language
- Source
- Your angle
You will be asked to sign in before it is generated.
Buy credits